SAMRA study plan

Define risk, uncertainty, hazard, and opportunity in your own words and distinguish risk from issue and from impact

Explain the ISO 31000 risk management process steps and how they map onto the SAMRA exam domains

Differentiate inherent, residual, and target risk and compute each from a simple likelihood-times-consequence example

Compare qualitative, semi-quantitative, and quantitative assessment approaches and state when each is defensible

Build a risk appetite versus risk tolerance distinction with one worked organizational example

Apply at least four risk identification techniques (brainstorming, structured interviews, checklist, SWOT, scenario analysis) to one case organization

Construct a cause-event-consequence statement for each identified risk so the risk is testable

Perform a bow-tie analysis linking threats, preventive controls, the top event, mitigative controls, and consequences

Classify risks by source and by category using a consistent taxonomy

Evaluate identified risks against criteria to decide which require treatment

Quantify likelihood and consequence using calibrated scales and document what each scale anchor means

Select and justify a control strategy from the treatment options (avoid, reduce, transfer, accept, exploit, share) for each high-priority risk

Design a hierarchy-of-controls argument for three risks, showing why a lower-order control was rejected

Distinguish detective, preventive, and corrective controls and place each in a control map

Identify control ownership, timing, and cost so treatment plans are actionable

Map the organization's risk framework against ISO 31000 principles, framework, and process clauses and note gaps

Explain how COSO ERM components connect to governance structures such as a board risk committee and a three-lines model

Define roles and responsibilities for risk ownership across the first, second, and third lines

Draft risk criteria and appetite statements that a governance body could actually approve

Compare at least two risk management standards or guidance documents and state where they diverge

Design a risk reporting pack for three audiences (board, executive, operational) with the right level of aggregation for each

Write risk statements and heat-map commentary that avoid vague language and state movement since the last period

Define key risk indicators with thresholds, data sources, and escalation triggers

Build a monitoring calendar that assigns review frequency by risk velocity and severity

Describe how to close the loop from monitoring findings into updated assessments and treatment plans

Explain how project risk management differs from enterprise risk management in scope, horizon, and ownership

Build a project risk breakdown structure covering technical, schedule, cost, resource, and external categories

Apply qualitative screening and quantitative techniques such as expected monetary value and Monte Carlo logic to a project case

Integrate program-level and project-level risks, including escalation and aggregation of correlated risks

Design a lessons-learned and post-implementation review process that feeds continuous improvement

Scan for emerging risks using horizon scanning, scenario planning, and weak-signal analysis, and record the method used

Assess at least three emerging risk themes such as cyber, climate, supply chain concentration, AI, or workforce change for organizational relevance

Define organizational resilience in terms of absorptive, adaptive, and restorative capacity and connect it to business continuity

Test a continuity plan against a plausible disruption scenario and identify single points of failure

Distinguish emerging risk from known risk and explain why standard registers underrepresent it

Consolidate all eight domains into a single one-page concept map showing how they interlock

Complete two timed practice sets and analyze every error by domain and by failure type (knowledge gap, misread, or reasoning error)

Re-teach the three weakest sub-topics aloud or in writing without notes to confirm retention

Rehearse the calculation types (residual risk, expected monetary value, control effectiveness) under time pressure

Finalize an exam-day strategy covering question triage, time per item, and handling of ambiguous wording