Fundamentals of Risk Management and Risk Assessment
The Fundamentals domain tests whether you can define risk precisely, distinguish it from neighbouring ideas, and use the ISO 31000:2018 principles and process as a working model rather than a diagram to recite.
Definitions that carry marks
- Risk is the “effect of uncertainty on objectives” (ISO 31000:2018). The effect may be positive or negative; without an objective there is no risk.
- An issue has already happened; a hazard is a source of harm; uncertainty is incomplete information. Exam stems often blur these.
- Risk assessment = identification + analysis + evaluation. It is one part of the wider process, alongside communication and consultation, scope/context/criteria, treatment, monitoring and review, and recording and reporting.
- Inherent risk is assessed before controls; residual after controls; target is the level you intend to reach. Report which one you mean.
Principles and process
The principles are integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement. The process is iterative: monitoring can send you back to identification, and treatment can change the context.
Criteria, appetite, tolerance
Risk criteria are the reference against which significance is judged. Risk appetite is the amount of risk an organization is willing to pursue or retain; tolerance is the acceptable deviation around a limit; capacity is the maximum it could absorb. These are different questions and exam options often swap them.
Worked example
A manufacturer relies on one supplier for a critical component. Inherent assessment: likelihood 4, consequence 5 on a 5×5 matrix = 20 (critical). Controls: qualify a second supplier and monitor supplier financial health. These mainly reduce likelihood to 2, so residual = 2×5 = 10. The board's appetite threshold is 12, so 10 is within appetite but above the target of 8; the risk stays on the register with a quarterly review and a trigger if single-source spend exceeds 30%. Reasoning: you cannot usually reduce consequence when the component is single-sourced, so the control targets likelihood; the score is not treated as a precise measurement, and the acceptance decision is recorded.
Traps that cost marks
Treating risk as only downside; identifying risks before agreeing objectives and context; quoting a matrix score as if it were a cardinal measure; presenting residual risk as inherent; confusing tolerance with appetite; assuming treatment eliminates risk rather than changing it.