Risk Management Framework and Processes
What the exam tests
Risk management questions test the ISO 31000 and COSO ERM language, the risk process, risk appetite and the board's oversight role. You should be able to score risks, select a treatment and identify who owns the risk.
Core rules and concepts
- Risk is the effect of uncertainty on objectives (ISO 31000:2018); it can be upside or downside. Risk management is coordinated activity to direct and control risk.
- ISO 31000 process: scope and context; risk identification; analysis; evaluation; treatment; communication and consultation; monitoring and review. Record outputs in a risk register with owner, cause, event, consequence, controls, inherent and residual rating.
- COSO ERM 2017 has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.
- Risk appetite is the amount of risk the board is willing to accept; risk tolerance is the acceptable variation around a target; risk capacity is the maximum it can bear. KRIs signal appetite breaches.
- Treatment: avoid, reduce, share or transfer (insurance, hedging, outsourcing) or accept. Residual risk must sit within appetite.
- Indian governance: s.134(3)(n) requires the Board's report to state the risk management policy and elements of risk that may threaten the company's existence. LODR Regulation 21 requires a risk management committee for the top 1000 listed entities by market capitalisation.
- Three lines model: business owns risk; risk and compliance functions advise and monitor; internal audit provides independent assurance.
Worked example
A cyber risk has likelihood 4 and impact 5 on a 5×5 matrix, giving an inherent score of 20. The board's appetite threshold is 12. Management installs multi-factor authentication and segmentation, reducing likelihood to 3 and impact to 4, so residual risk is 12 - at appetite. The risk owner is the CIO, not the risk committee; the committee oversees and challenges. If residual remained 16, the board should require further treatment or formally accept an out-of-appetite exposure with a time-bound plan.
Traps that cost marks
- Presenting risk management as risk elimination.
- Confusing inherent risk with residual risk.
- Saying the risk management committee manages the risk; it oversees.
- Ignoring low-likelihood, high-impact risks such as fraud or litigation.