III IC-86 common mistakes
III IC-86 · Understand the traps and how to avoid them.
Treating 'risk' as synonymous with 'danger' or 'bad outcome' and therefore excluding upside variability from definitions, answers, and calculations.
Everyday language frames risk as pure loss, so candidates carry that framing into questions about uncertainty, opportunity, and two-sided distributions without noticing the conflict.
What to do instead
Before answering any definitional or classification item, restate risk as effect of uncertainty on objectives, which can be positive or negative. When an option mentions opportunity or upside, test whether the stem's framing (uncertainty, objectives) supports it rather than dismissing it automatically.
Using likelihood times impact as the only risk score and ignoring velocity, proximity, or detectability when the stem supplies those attributes.
Simple scoring matrices are the most rehearsed tool, so candidates default to them even when the question deliberately adds timing or detection information that changes prioritization.
What to do instead
Read the stem for every attribute given (speed of onset, time to impact, ease of detection, controllability) and rank using all supplied factors. If two risks share the same product but differ in velocity, the faster one usually needs earlier response; state that reasoning explicitly.
Confusing inherent risk with residual risk, or target risk with current risk, when selecting which figure to report or compare against tolerance.
The terms look interchangeable and many candidates memorize one number per risk instead of tracking the risk through treatment states.
What to do instead
Build a mental timeline: inherent (before controls) → current residual (controls as they exist today) → target residual (after planned treatment). Match the stem's tense and wording ('currently exposed', 'after mitigation', 'acceptable level') to the correct point on that timeline before choosing.
Selecting 'avoid' or 'transfer' as the response whenever severity is high, without checking feasibility, cost, or whether the response actually changes the exposure.
High severity triggers a reflex toward the strongest-sounding option, and candidates forget that avoidance may be impossible and transfer (e.g., insurance) usually leaves residual risk and does not eliminate the event.
What to do instead
For each response option ask two questions: is it feasible given the stem's constraints, and does it alter likelihood, impact, or both? Reject options that merely move financial consequence while leaving the underlying exposure unchanged, and prefer the response the stem's constraints actually permit.
Treating a control as effective because it exists, rather than assessing design adequacy and operating effectiveness separately.
Candidates equate documented controls with functioning controls, which is exactly the gap many exam items are built to expose.
What to do instead
For any control described in a stem, split the judgment: was it designed to address this cause (design), and is there evidence it operated as intended during the period (operating effectiveness)? If the stem gives no testing evidence, do not credit the control as effective.
Misclassifying a risk as strategic, operational, financial, or compliance based on the department that owns it rather than the nature of the uncertainty and its consequence.
Organizational labels are memorable, so candidates map categories to owners instead of to the underlying exposure being described.
What to do instead
Classify by consequence type: objective/competitive positioning (strategic), process and delivery failure (operational), funding, liquidity, market or credit variability (financial), legal or regulatory breach (compliance). Ignore who owns it and ask what actually goes wrong if the risk materializes.
Aggregating risks by summing individual scores or averaging ratings and calling the total the enterprise exposure, without accounting for correlation or concentration.
Arithmetic aggregation is easy and looks rigorous, and candidates overlook that correlated risks compound while independent ones diversify.
What to do instead
When a stem asks about portfolio or aggregate exposure, check whether risks share a common driver or occur simultaneously. If they do, exposure is greater than the simple sum of parts; if independent, it may be less. Choose the option that reflects correlation and concentration, and flag aggregation methods that ignore them.
Ignoring risk appetite and tolerance statements and recommending treatment based on severity alone.
Candidates focus on the risk itself and treat appetite as background context rather than the decision criterion the question is testing.
What to do instead
Locate the appetite or tolerance threshold in the stem first and compare the exposure to it. If exposure sits within tolerance, the correct answer often favors monitor and accept; if it breaches tolerance, escalate or treat. Let the threshold, not the raw severity, drive the recommendation.
Describing risk monitoring as a one-time review or annual exercise rather than a continuous cycle with defined indicators, triggers, and reporting lines.
Candidates compress the risk process into discrete steps and lose the feedback loop, which is where many monitoring and reporting questions live.
What to do instead
For monitoring items, identify three elements: the indicator or limit, the trigger threshold, and the escalation path and cadence. Prefer answers that specify all three and that treat monitoring as ongoing, with reassessment triggered by change rather than by the calendar alone.
Confusing the roles of the risk owner, the risk manager, and internal audit, and assigning accountability for treatment to the wrong function.
The functions overlap in practice, and candidates default to whoever sounds most authoritative or most independent.
What to do instead
Anchor accountability with the risk owner, who is responsible for managing the exposure and for treatment decisions within delegated authority. The risk manager facilitates framework, aggregation, and reporting; internal audit provides independent assurance and should not own or operate controls. Match the stem's verb (owns, advises, assures) to the correct role.