CISR Risk Management common mistakes
CISR Risk Management · Understand the traps and how to avoid them.
Treating risk management as a standalone insurance-buying exercise, so questions that ask where risk management sits relative to other management functions or how it creates value beyond loss financing are answered from a purchasing perspective rather than a process perspective.
Many candidates enter the exam from a broking or claims background where the visible output of risk management is a policy. The introductory material describes risk management as an iterative, organisation-wide process with objectives (protection of assets, earnings stability, social responsibility, growth) and the exam tests that framing, not the transaction.
What to do instead
Before answering, restate the question in process terms: identify, analyse, control, finance, administer. For objective questions, memorise the distinction between pre-loss objectives (economy, reduced anxiety, legal compliance, social responsibility) and post-loss objectives (survival, continuity, earnings stability, growth, social responsibility) and be able to place a scenario on that list. Rehearse a one-page summary of the risk management process and its feedback loop until you can reproduce it from memory.
Confusing risk with hazard, peril, and uncertainty, so a question describing a condition that increases the chance or severity of a loss is labelled as the risk itself or as the peril.
Everyday language uses these words interchangeably. The exam uses the technical definitions consistently: risk is uncertainty about outcomes (or the possibility of loss), peril is the cause of loss, hazard is a condition that increases the likelihood or severity, and exposure is what is at stake. Candidates who read quickly default to the everyday meaning.
What to do instead
Build a four-column glossary (term, definition, example, common distractor) and drill it until the classification is automatic. For each practice stem, underline the noun that names the thing being asked about before looking at the options. Classify hazards into physical, moral, and morale categories and practise mapping short scenarios to each, because exam items frequently test the moral/morale distinction.
Producing an unstructured list of risks in identification questions instead of applying a systematic identification technique, and missing the category of risk the question is probing for (for example, missing strategic or reputational risk when the stem describes a change in customer behaviour).
Candidates under time pressure write down whatever comes to mind first, which is usually the familiar physical and liability exposures. Identification frameworks (checklists, flowcharts, financial statement analysis, inspections, scenario analysis, brainstorming, Delphi, fault trees, hazard and operability studies) exist precisely to prevent blind spots, and the exam rewards selecting the technique that fits the situation described.
What to do instead
Learn each identification technique with one strength and one limitation, and practise choosing between them for a described organisation (for example, a new process with no loss history favours scenario analysis or HAZOP over a historical claims review). When a question asks for risks, force yourself to sweep the standard categories: property, liability, human resources, income, and strategic/reputational. Use a flowchart habit for any stem describing a production or service process.
Skipping the exposure base when estimating maximum possible loss, probable maximum loss, or expected loss, so the answer is a number without units or is computed on the wrong value (for example, using replacement cost where the question specifies actual cash value, or ignoring business interruption exposure).
Candidates focus on the probability and the physical damage figure and treat the exposure base as background. Exam items deliberately supply several plausible values (market value, replacement cost, book value, income lost) and the correct answer depends on which base the scenario defines and on whether the loss is a total or partial one.
What to do instead
Adopt a three-step routine for every quantitative item: write the exposure base with its units, write the loss scenario (total versus partial, and the valuation basis), then compute. Learn the standard relationships: expected loss equals frequency times average severity; maximum possible loss assumes the worst credible total loss; probable maximum loss assumes the worst likely loss given controls. Practise with business interruption items where the exposure is gross profit or continuing expenses rather than property value.
Treating risk control and risk financing as alternatives rather than as a sequence, and selecting a control measure in a question that is actually asking how the residual risk should be financed.
The two categories are taught together and both reduce the impact of risk, so candidates reach for the familiar answer (buy insurance, or install a sprinkler) without checking which stage of the process the stem is describing. Many items describe a control already in place and ask what remains to be done.
What to do instead
For every scenario, draw a two-by-two: control (reduce frequency, reduce severity) and finance (retain, transfer). Then ask what the stem has already done and what it is asking for. Memorise the control sub-categories (avoidance, loss prevention, loss reduction, separation, duplication, diversification, and transfer of control) and be ready to name the specific technique that matches the described action.
Confusing risk avoidance with risk reduction and recommending avoidance for a core operating risk that the organisation cannot exit, or recommending retention without checking whether the loss is insurable or whether the organisation can absorb it.
Avoidance sounds like the safest answer and is often the intuitive choice. The exam tests the trade-off: avoidance eliminates the exposure but also eliminates the activity and its return, so it is appropriate only when the risk is not essential to the organisation's objectives and the downside is unacceptable. Retention similarly has planned and unplanned forms and requires a funding decision.
What to do instead
Learn a decision rule: avoidance only when the activity is non-core or the loss is catastrophic and unavoidable by other means; retention only when frequency is high and severity is low, or when insurance is unavailable or uneconomic, and only with a funded reserve or a captive. Practise classifying retention into passive, active, funded, and unfunded, and be able to say which one a described organisation is using.
Mixing up the risk financing techniques and their cost-of-risk components, for example treating a deductible as a transfer, a retrospective rating plan as pure retention, or a hold-harmless clause as insurance.
The techniques overlap in practice and the terminology is close: deductibles, self-insured retentions, captives, retrospective rating, and contractual transfer all shift part of the loss. Candidates match on the surface label rather than on who bears the loss and when.
What to do instead
For each technique, write who bears the loss, how much, and when the cash flows. Distinguish retention (the organisation bears the loss, funded or unfunded) from transfer (another party bears it, by contract or insurance). Learn the cost-of-risk equation (premiums plus retained losses plus control costs plus administrative costs) and practise allocating a described cost to the correct component. Treat contractual transfer separately from insurance transfer and note that a hold-harmless clause transfers liability, not the obligation to pay a judgment if the other party defaults.
Answering insurance-programme design questions with a single lever, such as choosing the lowest premium or the highest deductible, instead of weighing retention level, limit, coinsurance, and exclusions against the organisation's loss profile and risk tolerance.
Candidates default to premium minimisation because it is the most visible number. The exam rewards the total-cost view: a higher deductible lowers premium but increases retained losses, and a limit that is too low leaves a catastrophic gap. Coinsurance and exclusions change the effective cover in ways that are easy to miss.
What to do instead
For every programme-design item, set out the trade-off explicitly: retention level against premium, limit against maximum possible loss, and breadth of cover against exclusions and conditions. Learn how coinsurance penalties work when the insured value is understated, and practise computing the recovery under a coinsurance clause. Compare total cost of risk across two or three candidate programmes rather than ranking on premium alone.
Ignoring the administrative and governance layer in questions about policy, records, communication, and monitoring, and answering as if the risk management decision ends once the technique is chosen.
The administration domain is less technical and feels like filler, so candidates skim it. Exam items test the specific artefacts and cycles: the risk management policy statement, the risk register, claims and incident records, the monitoring and review cycle, and the allocation of responsibility.
What to do instead
Memorise the purpose of each administrative artefact (policy statement sets objectives and authority; register records identified risks, owners, controls, and status; incident records feed back into identification and analysis). Learn the review cycle and who owns each step. For scenario items, ask who is accountable, what is documented, and how the result is fed back into the process before selecting an answer.
Reading the stem for the topic rather than the question, so a stem describing a fire in a warehouse draws a property-insurance answer when the question actually asks which identification technique would have surfaced the risk, or which control would have reduced severity.
Under time pressure candidates pattern-match on the scenario content and stop reading at the first familiar term. Exam writers deliberately build stems where the scenario is shared across several possible questions, and the final clause determines the domain and the correct option.
What to do instead
Read the last sentence first and underline the interrogative (identify, analyse, control, finance, administer) and the object (risk, technique, cost, party). Then read the scenario with that target in mind. In practice, cover the options while reading the stem and predict the answer before revealing them. Flag and return to any item where two options seem correct, and choose the one that answers the specific interrogative rather than the one that is merely true of the scenario.