Risk Management
Risk Management (III IC-86)
This domain tests whether you can run a defensible risk process, not just recite definitions. Expect questions that ask you to classify a risk, choose a treatment, or explain why residual risk differs from inherent risk. The examiner rewards precise use of ISO 31000:2018 and COSO ERM 2017 vocabulary.
Core rules
- Risk is the effect of uncertainty on objectives; it includes upside and downside. Risk management is coordinated activities to direct and control risk.
- ISO 31000 sequence: establish scope/context and risk criteria → identify → analyse → evaluate → treat → communicate/consult → monitor/review. Do not skip criteria: they define what "high" means.
- Analyse by likelihood and impact; evaluate against risk appetite (amount willing to pursue) and risk tolerance (acceptable variation). Rate inherent risk before controls and residual risk after controls.
- Treatment: avoid, reduce, transfer, retain. Insurance transfers financial consequence, not the underlying hazard, legal liability, or reputation damage.
- Record each risk with cause-event-consequence, owner, controls, key risk indicator (KRI), rating, treatment and review date.
- Insurable risks are typically pure, accidental, measurable, pooled across many exposures, and not catastrophic to the insurer. Moral hazard and adverse selection distort pooling.
Worked example
A warehouse fire risk scores likelihood 3 and impact 5 on a 5×5 matrix = 15 (high). Inherent rating triggers action. Sprinklers and hot-work permits reduce likelihood to 2; a deductible and claims protocol reduce financial impact to 4. Residual score 8 (medium). Reasoning: the firm retains predictable small losses through the deductible, transfers severe tail loss through property insurance, and reduces frequency through controls. Transfer alone would leave business interruption and reputational exposure untreated.
Traps
Confusing appetite with tolerance; treating transfer as elimination; rating residual risk before testing control effectiveness; ignoring control cost; calling speculative risk insurable; leaving risks without an owner.