I85PREP
⌘ K
IRM International Certificate study materials
IRM International Certificate study resources

IRM International Certificate practice questions

One question at a time. Build your IRM International Certificate understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Principles of Risk and Risk Management

In the ISO 31000 risk management framework, which term describes the effect of uncertainty on objectives, where the effect may be positive or negative?

  1. Exposure
  2. Risk Correct answer.
  3. Control
  4. Hazard

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, and it explicitly notes that effects can be positive as well as negative. This two-sided definition distinguishes risk from purely downside concepts and underpins the treatment of opportunities within risk management.

Question 2Principles of Risk and Risk Management

A risk manager assesses the likelihood and consequences of an event and expresses the result as a single combined score. Which step of the risk management process does this represent?

  1. Risk analysis Correct answer.
  2. Risk identification
  3. Risk communication
  4. Risk treatment

Explanation

Risk analysis is the process of comprehending the nature of risk and determining its level, which combines likelihood and consequence estimates. Identification merely finds risks, treatment modifies them, and communication exchanges information about them.

Question 3Principles of Risk and Risk Management

Which concept describes the maximum level of risk that an organisation is willing to accept in pursuit of its objectives before action is required?

  1. Risk appetite Correct answer.
  2. Risk tolerance
  3. Risk profile
  4. Risk capacity

Explanation

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain. It is a forward-looking statement of willingness, which is then operationalised through tolerance limits and monitoring.

Question 4Principles of Risk and Risk Management

A manufacturer buys insurance against fire damage to its warehouse. In risk management terminology, this is best described as which type of response?

  1. Risk transfer Correct answer.
  2. Risk exploitation
  3. Risk retention
  4. Risk avoidance

Explanation

Purchasing insurance transfers the financial consequences of a risk to a third party, although the underlying physical risk may remain. Transfer is one of the standard treatment options alongside avoid, reduce and retain.

Question 5Principles of Risk and Risk Management

What is the primary purpose of a risk register?

  1. To describe the organisational chart of the risk function
  2. To record identified risks, their assessments and assigned owners Correct answer.
  3. To document the financial statements of the organisation
  4. To list the insurance policies currently in force

Explanation

A risk register is the central record of identified risks together with their assessment, ownership, controls and treatment actions. It supports monitoring and reporting throughout the risk management cycle.

Question 6Principles of Risk and Risk Management

Which of the following is an example of an internal source of risk for a bank?

  1. A failure of the bank's own loan approval controls Correct answer.
  2. A change in central bank interest rates
  3. A natural disaster affecting a supplier's factory
  4. A shift in customer preferences caused by a competitor

Explanation

Internal risks arise from within the organisation, such as people, processes and systems failures. A breakdown in the bank's own loan approval controls is therefore an internal source.

Question 7Principles of Risk and Risk Management

In the commonly used likelihood-consequence matrix, what does a risk rating typically combine?

  1. Probability of occurrence and severity of impact Correct answer.
  2. Cost of control and frequency of audit
  3. Duration of project and number of suppliers
  4. Number of staff and size of budget

Explanation

A risk matrix plots likelihood against consequence to produce a composite rating that guides prioritisation. The two axes are probability and severity of impact, not administrative or resourcing variables.

Question 8Principles of Risk and Risk Management

Which of the following best describes residual risk?

  1. The risk before any controls have been considered
  2. The risk that an auditor will detect a material misstatement
  3. The risk that remains after controls and treatment have been applied Correct answer.
  4. The risk that a control itself will fail to operate

Explanation

Residual risk is the level of risk remaining once existing controls and treatment measures are taken into account. It is compared with the target risk level to decide whether further action is needed.

Question 9Principles of Risk and Risk Management

A firm decides to stop offering a particular high-risk product line altogether. Which risk treatment option has it chosen?

  1. Reduction
  2. Acceptance
  3. Avoidance Correct answer.
  4. Sharing

Explanation

Avoidance eliminates the risk by discontinuing the activity that generates it. Because the product line is no longer offered, the associated exposure is removed rather than mitigated or transferred.

Question 10Principles of Risk and Risk Management

Which statement correctly distinguishes inherent risk from residual risk?

  1. Inherent risk is always lower than residual risk for the same activity
  2. Inherent risk is assessed before controls, while residual risk is assessed after controls Correct answer.
  3. Residual risk applies only to financial risks, whereas inherent risk applies only to operational risks
  4. Inherent risk is set by regulators, while residual risk is set by auditors

Explanation

Inherent risk is the exposure present before considering the effect of controls, whereas residual risk reflects the position after controls operate. Comparing the two helps demonstrate the value added by the control environment.

Question 11Principles of Risk and Risk Management

A risk owner in an enterprise risk management framework is best described as the person who:

  1. Independently audits the risk management function
  2. Provides external legal advice on contracts
  3. Maintains the organisation's insurance portfolio
  4. Has authority and accountability for managing a specific risk Correct answer.

Explanation

A risk owner is assigned accountability and authority to manage a particular risk, including its controls and treatment. Clear ownership is a core principle of effective risk governance.

Question 12Principles of Risk and Risk Management

Which of the following is the best example of a key risk indicator (KRI)?

  1. The organisation's total annual revenue
  2. The number of overdue corrective actions on high-risk findings Correct answer.
  3. The average length of customer contracts
  4. The number of employees in the finance department

Explanation

A KRI is a metric that provides early warning of changing risk exposure, such as a rising backlog of overdue corrective actions. It should be linked to a specific risk and monitored against thresholds.

Question 13Principles of Risk and Risk Management

Why does the risk management process place communication and consultation throughout all stages rather than only at the end?

  1. Because it guarantees that no risk will be realised
  2. Because stakeholder input shapes how risks are identified, assessed and treated at every stage Correct answer.
  3. Because it removes the need for documented risk assessments
  4. Because communication is only required for regulatory reporting purposes

Explanation

Communication and consultation are continuous activities that bring stakeholder perspectives into identification, analysis and treatment. They improve the quality of decisions and build ownership, rather than serving only as a final reporting step.

Question 14Principles of Risk and Risk Management

A company sets a tolerance limit stating that no single transaction may expose it to more than 2% of capital. This limit is best described as a:

  1. Risk treatment plan for a specific project
  2. Risk appetite statement expressed in qualitative terms
  3. Risk register entry describing a control
  4. Risk tolerance expressed as a quantitative threshold Correct answer.

Explanation

Risk tolerance translates appetite into measurable boundaries, such as a maximum exposure per transaction. The numeric 2% of capital limit is a quantitative threshold used to monitor and constrain risk-taking.

Question 15Principles of Risk and Risk Management

Which of the following best explains why risk management should be proportionate to the level of risk?

  1. Proportionality means ignoring low risks entirely
  2. Controls and assessment effort should match the significance of the risk so resources are used efficiently Correct answer.
  3. Proportionality requires that every risk be transferred to a third party
  4. All risks must receive identical treatment regardless of their size

Explanation

Proportionality means the effort and controls applied should be commensurate with the significance of the risk. This ensures resources are directed where they add the most value while still addressing lower risks appropriately.

Question 16Principles of Risk and Risk Management

A project team identifies a risk that a key supplier may fail to deliver. They decide to qualify a second supplier in advance. Which treatment option does this illustrate?

  1. Risk acceptance with no action
  2. Risk reduction through mitigation measures Correct answer.
  3. Risk avoidance by cancelling the project
  4. Risk exploitation of an opportunity

Explanation

Qualifying a backup supplier reduces the likelihood or impact of a delivery failure, which is a mitigation measure. The activity continues, so this is reduction rather than avoidance.

Question 17Principles of Risk and Risk Management

Which of the following is a characteristic of a well-designed control?

  1. It is designed only after a loss event has occurred
  2. It eliminates the need to monitor the associated risk
  3. It is undocumented so that staff cannot circumvent it
  4. It is proportionate to the risk and its operation can be evidenced Correct answer.

Explanation

Effective controls are proportionate to the risk they address and produce evidence that they operated as intended. This evidence supports monitoring and assurance over time.

Question 18Principles of Risk and Risk Management

A risk assessment team rates a risk as high likelihood and low impact. Which statement best reflects how such a risk should typically be handled?

  1. It must be escalated as the highest priority risk in the register
  2. It may warrant monitoring and low-cost reduction rather than major capital investment Correct answer.
  3. It should be ignored because the impact is low
  4. It should always be transferred to an insurer regardless of cost

Explanation

A high-likelihood, low-impact risk often calls for cost-effective reduction and monitoring rather than expensive treatment. The appropriate response depends on the combined rating and the cost of control relative to the benefit.

Question 19Principles of Risk and Risk Management

In risk governance, what is the role of the 'three lines model'?

  1. It divides risk into three financial categories
  2. It separates management, risk oversight and independent assurance responsibilities Correct answer.
  3. It mandates three levels of insurance cover
  4. It requires three separate external auditors for every organisation

Explanation

The three lines model clarifies roles: operational management owns and manages risk, a risk and compliance function provides oversight, and internal audit provides independent assurance. This separation strengthens accountability and objectivity.

Question 20Principles of Risk and Risk Management

An organisation records a risk event, analyses its cause, and updates its controls to prevent recurrence. Which activity does this describe?

  1. Strategic planning
  2. Risk appetite setting
  3. Incident management and lessons learned Correct answer.
  4. Risk financing

Explanation

Capturing an event, investigating root causes and improving controls is incident management with lessons learned. This feedback loop strengthens the control environment and reduces the chance of recurrence.

Question 21Principles of Risk and Risk Management

A firm's risk profile shows a concentration of exposure to a single large customer. Which concept does this primarily illustrate?

  1. Model risk arising from flawed assumptions
  2. Liquidity risk arising from short-term funding gaps
  3. Reputational risk arising from adverse publicity
  4. Concentration risk arising from limited diversification Correct answer.

Explanation

Dependence on one large customer creates concentration risk because losses from that relationship cannot be offset by diversification. It is distinct from liquidity, model and reputational risks, which have different causes.

Question 22Principles of Risk and Risk Management

Which statement best captures the relationship between uncertainty and risk in risk management?

  1. Uncertainty and risk are identical and can be used interchangeably in all contexts
  2. Risk focuses on effects of uncertainty on objectives where outcomes and likelihoods can be characterised Correct answer.
  3. Risk exists only when outcomes are completely unknown and unpredictable
  4. Uncertainty is eliminated once a risk register is complete

Explanation

Risk management addresses the effect of uncertainty on objectives, focusing on exposures whose likelihood and impact can be characterised and managed. Pure uncertainty involves outcomes that cannot be reliably assigned probabilities, which is a related but distinct concept.

Question 23Principles of Risk and Risk Management

A risk manager argues that a control reduces likelihood but increases the severity of impact if it fails. What is the most appropriate analytical response?

  1. Reclassify the risk as an opportunity
  2. Remove the control because it has any downside
  3. Assess the control's net effect on residual risk, including the consequences of control failure Correct answer.
  4. Assume the control is beneficial because it addresses likelihood

Explanation

Controls can introduce new failure modes, so their net effect on residual risk must be assessed, including the impact if the control itself fails. This analysis supports a balanced decision on whether the control is worthwhile.

Question 24Principles of Risk and Risk Management

An organisation applies a risk criterion that combines likelihood and impact, then aggregates individual risk ratings to compare them against appetite. Which limitation should the analyst recognise?

  1. Aggregated ratings can obscure correlations and tail dependencies between risks Correct answer.
  2. Aggregation always overstates the true level of risk
  3. Appetite statements are irrelevant once risks are rated
  4. Risk criteria cannot be applied to operational risks

Explanation

Summing or averaging individual ratings can hide correlations and concentration that produce larger combined losses than the parts suggest. Analysts should consider dependencies and tail events rather than relying solely on aggregated scores.

Question 25Principles of Risk and Risk Management

A board wants assurance that its risk appetite is actually being followed in day-to-day decisions. Which mechanism most directly provides this?

  1. Delegating all risk decisions to external consultants
  2. Monitoring risk exposures against defined tolerance limits with escalation triggers Correct answer.
  3. Increasing the number of risks recorded in the register
  4. Publishing the appetite statement on the corporate website

Explanation

Assurance that appetite is respected comes from monitoring exposures against tolerance limits and escalating breaches through defined triggers. This connects the high-level appetite statement to operational decision-making.

Question 26Principles of Risk and Risk Management

In risk management terminology, what does the term 'risk appetite' describe?

  1. The maximum insurance cover the organisation is able to purchase in the market
  2. The amount and type of risk an organisation is willing to pursue or retain in order to meet its objectives Correct answer.
  3. The set of controls the organisation has implemented to reduce operational failures
  4. The total value of losses the organisation has actually suffered over the past financial year

Explanation

Risk appetite expresses the broad amount and type of risk an entity is willing to accept in pursuit of its objectives, and it is set at governing-body level. It is forward-looking and directional rather than a record of past losses or a description of controls.

Question 27Principles of Risk and Risk Management

Which statement best distinguishes a 'hazard' from a 'risk'?

  1. A hazard is a source of potential harm, whereas risk is the combination of the likelihood of harm and its consequences Correct answer.
  2. A hazard is always measurable in monetary terms, whereas risk is always qualitative
  3. A hazard is the same as a risk once a control has been applied
  4. A hazard exists only in physical workplaces, whereas risk applies only to financial exposures

Explanation

A hazard is a source or situation with potential to cause harm, while risk expresses how likely that harm is and how severe it would be. The two are related but conceptually distinct: the hazard exists independently of any judgement about likelihood or consequence.

Question 28Principles of Risk and Risk Management

An organisation defines risk as 'the effect of uncertainty on objectives'. Which element of this definition is most directly addressed by identifying and assessing uncertainty?

  1. The objectives, because they are fixed and cannot be revised once set
  2. The effect on objectives, because uncertainty always produces negative outcomes
  3. The organisation, because risk only exists at enterprise level
  4. The uncertainty, because it captures deviation from the expected and can be positive or negative Correct answer.

Explanation

This definition centres on uncertainty, meaning deviation from what is expected, and such deviation may be favourable or adverse. Identifying uncertainty therefore covers both upside opportunity and downside threat, not only losses.

Question 29Principles of Risk and Risk Management

A risk manager is classifying risks by their origin. Which of the following is best classified as an external risk?

  1. Failure of an internally developed software patch
  2. Inadequate segregation of duties in the accounts payable team
  3. Errors made by the organisation's own credit assessors
  4. A change in government tariff policy affecting imported components Correct answer.

Explanation

External risks arise from the environment in which the organisation operates, such as regulatory, political or market changes, and are largely outside its control. The other options describe internal process, people or system failures.

Question 30Principles of Risk and Risk Management

Which of the following best describes the purpose of a risk register?

  1. To list only those risks that have already materialised into losses
  2. To provide audited financial statements for external shareholders
  3. To record identified risks together with agreed owners, assessments and treatment actions in a structured, maintained form Correct answer.
  4. To replace the need for board-level oversight of risk

Explanation

A risk register is a structured record of identified risks, typically capturing description, owner, assessment, controls and planned actions, and it is kept current. It supports monitoring and decision-making rather than replacing governance or reporting only realised events.

Question 31Principles of Risk and Risk Management

An analyst states that a risk has a 'likelihood' of occurring within the next twelve months. What is the analyst actually estimating?

  1. The speed with which the organisation could recover from the event
  2. The total financial loss that the event would cause
  3. The number of controls currently in place to prevent the event
  4. The probability or frequency that the risk event will occur in that period Correct answer.

Explanation

Likelihood is the chance or frequency of an event occurring within a defined timeframe, expressed qualitatively or quantitatively. It is distinct from impact, which concerns the magnitude of consequences if the event happens.

Question 32Principles of Risk and Risk Management

Which statement best explains why risk identification should draw on multiple sources and perspectives?

  1. Because each source views the organisation from a different angle, so combining them reduces the chance that significant risks are missed Correct answer.
  2. Because a single source always produces more reliable results than several
  3. Because regulators require every source to be documented in identical format
  4. Because using several sources guarantees that no risk will ever materialise

Explanation

Different sources, such as workshops, incident data, audits and external intelligence, reveal different exposures. Combining them improves completeness of the risk profile, though it never guarantees that no risk will occur.

Question 33Principles of Risk and Risk Management

In the risk management process, what is the main purpose of 'risk evaluation' after risks have been analysed?

  1. To record the risk in the register with an assigned owner
  2. To implement the chosen controls and monitor their effectiveness
  3. To communicate the risk policy to external stakeholders
  4. To compare analysed risk levels against agreed criteria in order to decide whether treatment is required Correct answer.

Explanation

Evaluation compares the analysed level of risk with the organisation's risk criteria and appetite to decide whether the risk is acceptable or needs treatment. Implementation and monitoring follow later in the process.

Question 34Principles of Risk and Risk Management

A risk practitioner describes a control as 'preventive'. Which example best fits that description?

  1. A mandatory dual authorisation step before a large payment is released Correct answer.
  2. A post-incident review that identifies root causes
  3. An insurance policy that reimburses losses after an event
  4. A monthly reconciliation that detects errors after they have occurred

Explanation

Preventive controls act before an event to stop it occurring or reduce its likelihood, such as requiring dual authorisation. Detective controls identify problems after the fact, and corrective actions follow incidents.

Question 35Principles of Risk and Risk Management

Which of the following best describes 'risk culture' within an organisation?

  1. The written set of risk policies approved by the board
  2. The software system used to maintain the risk register
  3. The shared values, attitudes and behaviours that determine how risks are identified, discussed and acted upon day to day Correct answer.
  4. The organisational chart showing reporting lines for the risk function

Explanation

Risk culture concerns the observable norms and behaviours, not merely formal documents or systems. It determines whether people escalate concerns, challenge assumptions and follow through on risk decisions.

Question 36Principles of Risk and Risk Management

An organisation faces a risk whose expected impact exceeds its appetite, and it decides to share part of the exposure with a third party through a contractual arrangement. Which treatment category does this represent?

  1. Risk retention
  2. Risk sharing or transfer Correct answer.
  3. Risk acceptance
  4. Risk avoidance

Explanation

Sharing or transferring risk allocates part of the exposure to another party, for example through insurance, outsourcing or contractual indemnities. Avoidance removes the activity, while retention keeps the exposure internally.

Question 37Principles of Risk and Risk Management

Which statement best explains the concept of 'risk tolerance' as used alongside risk appetite?

  1. It describes the willingness of individual employees to break policy
  2. It is the maximum number of risks the register can hold
  3. It is the total budget allocated to the internal audit function
  4. It sets the acceptable variation or deviation from the desired risk level that the organisation is prepared to work within Correct answer.

Explanation

Tolerance defines the boundaries of acceptable variation around the desired risk level, often expressed as limits or thresholds. It translates appetite into operational boundaries that can be monitored.

Question 38Principles of Risk and Risk Management

A risk owner reports that a risk's likelihood has increased after a supplier's financial results were published. Which part of the risk management process should this trigger?

  1. Removal of the risk owner from the role
  2. Reassessment of the risk and review of whether existing treatment remains adequate Correct answer.
  3. Immediate closure of the risk in the register
  4. Reclassification of the risk as an external audit finding

Explanation

Risk management is iterative, so new information should prompt reassessment and a check that controls and treatment remain fit for purpose. Monitoring and review exist precisely to capture such changes.

Question 39Principles of Risk and Risk Management

Which of the following best explains why risk management should be integrated into existing business processes rather than run as a standalone activity?

  1. Because decisions made in planning, procurement and operations are where risk is actually taken, so embedding the process makes it relevant and timely Correct answer.
  2. Because standalone risk departments are prohibited by most regulatory frameworks
  3. Because it allows the organisation to eliminate all residual risk
  4. Because integration removes the need for any risk reporting

Explanation

Risk is created and managed through ordinary business decisions, so embedding risk thinking in those processes makes it timely and actionable. Integration complements governance and reporting rather than replacing them.

Question 40Principles of Risk and Risk Management

A firm uses a heat map to present its risk profile to the board. What is the main limitation of relying solely on a heat map for this purpose?

  1. It replaces the need for any qualitative judgement
  2. It always understates the number of risks because it can display only ten items
  3. It cannot be used for risks that have a financial impact
  4. It can obscure the size and nature of exposures behind broad colour bands, so underlying data and assumptions are not visible Correct answer.

Explanation

Heat maps summarise risks into broad likelihood and impact bands, which aids communication but hides the magnitude, data quality and assumptions behind each rating. Boards therefore need supporting detail alongside the visual summary.

Question 41Principles of Risk and Risk Management

An organisation is deciding how much resource to devote to treating a particular risk. Which consideration is most consistent with sound risk-based decision-making?

  1. Deferring the decision until the risk has already materialised
  2. Selecting the cheapest control regardless of its effect on the risk
  3. Comparing the cost of treatment with the expected reduction in loss and the organisation's appetite for that risk Correct answer.
  4. Always choosing the most expensive control because cost signals quality

Explanation

Proportionate treatment compares the cost of the control with the risk reduction it delivers, judged against appetite and legal duties. Neither cost nor expense alone is a sound basis for selecting controls.

Question 42Principles of Risk and Risk Management

Which of the following is the best example of a 'detective' control in a risk management context?

  1. Encrypting customer data at rest
  2. Requiring approval before a new supplier is onboarded
  3. Reviewing exception reports to identify transactions that breached policy limits Correct answer.
  4. Providing risk awareness training to new employees

Explanation

Detective controls identify events or errors after they have occurred so that they can be addressed, and exception reporting is a classic example. Approval gates and encryption act before or during an event, and training aims to prevent errors arising.

Question 43Principles of Risk and Risk Management

Which statement best describes the relationship between 'inherent risk' and the controls an organisation applies?

  1. Inherent risk is assessed before controls are taken into account, so it reflects the gross exposure of the activity Correct answer.
  2. Inherent risk is measured only after all controls have been tested and found effective
  3. Inherent risk applies only to financial reporting risks
  4. Inherent risk is identical to residual risk in every case

Explanation

Inherent risk is the gross level of risk before any controls or mitigations are considered, which allows the value of controls to be assessed by comparison with residual risk. Residual risk is the level remaining after controls.

Question 44Principles of Risk and Risk Management

A risk manager notes that a control has been designed correctly but is applied inconsistently by staff. Which conclusion is most appropriate?

  1. The risk no longer exists because a control is documented
  2. The inconsistency proves the risk was misidentified
  3. The control should be removed because design is the only thing that matters
  4. The control's design may be sound but its operating effectiveness is deficient Correct answer.

Explanation

Control effectiveness depends on both design and operation; a well-designed control that is applied inconsistently provides weak assurance. The appropriate response is to strengthen operation, for example through monitoring, training or automation.

Question 45Principles of Risk and Risk Management

Which of the following best explains why an organisation should define risk criteria before assessing its risks?

  1. Criteria are required only for insurance purchasing decisions
  2. Criteria provide a consistent yardstick for judging significance and deciding which risks need escalation or treatment Correct answer.
  3. Criteria ensure that every identified risk will be treated
  4. Criteria eliminate the need to estimate likelihood and impact

Explanation

Risk criteria set the terms of reference, such as scales and thresholds, so that assessments are comparable and decisions about significance are consistent. They do not remove the need for assessment or guarantee that every risk is treated.

Question 46Principles of Risk and Risk Management

In an enterprise risk management framework, what is the primary function of a risk committee reporting to the board?

  1. To prepare the organisation's statutory financial statements
  2. To conduct the organisation's external audit
  3. To approve individual employee expense claims
  4. To oversee the risk framework, challenge management's risk assessments and advise the board on risk matters Correct answer.

Explanation

A board risk committee provides oversight and challenge on the risk framework and profile, and advises the board. Financial statement preparation and external audit are separate functions.

Question 47Principles of Risk and Risk Management

An organisation records that a risk event caused a loss that was larger than expected because two separate failures occurred together. Which concept does this best illustrate?

  1. Risk correlation or concentration, where related exposures combine to produce a greater combined effect Correct answer.
  2. Risk avoidance, because the activity was stopped afterwards
  3. Risk appetite, because the loss was within the stated limit
  4. Risk transfer, because the loss was shared with a third party

Explanation

When separate failures occur together or are correlated, their combined effect can exceed what each would produce alone, which is a concentration or correlation effect. This is why aggregation and dependency analysis matter in risk assessment.

Question 48Principles of Risk and Risk Management

Which statement best captures the difference between 'risk management' and 'crisis management'?

  1. Risk management ends when a crisis begins, and the two never interact
  2. Risk management addresses potential future events proactively, whereas crisis management responds to an event that has already occurred Correct answer.
  3. Crisis management is a subset of risk identification
  4. Risk management applies only to financial risks, whereas crisis management applies to all risks

Explanation

Risk management is forward-looking and seeks to identify, assess and treat potential events, while crisis management is the response once a severe event has occurred. The two connect because lessons from crises feed back into future risk management.

Question 49Principles of Risk and Risk Management

A risk practitioner is selecting a method to assess a new, poorly understood risk for which little historical data exists. Which approach is most appropriate?

  1. Ignoring the risk until sufficient historical data accumulates
  2. Assigning the lowest possible rating because no data supports a higher one
  3. A structured qualitative technique such as scenario analysis or expert workshops, supplemented by any available data Correct answer.
  4. A purely statistical model built on the assumption that the future will mirror the past

Explanation

Where data are scarce, structured qualitative methods such as scenario analysis and expert judgement help to surface assumptions and plausible outcomes. Statistical models depending on historical data are unreliable in such conditions.

Question 50Principles of Risk and Risk Management

Which of the following best explains why an organisation should document its risk assessment methodology, including scales and assumptions?

  1. It removes the need for management judgement in decision-making
  2. It is only relevant when an external regulator requests it
  3. It guarantees that the assessment will produce accurate predictions
  4. It supports consistency, comparability and defensibility of risk decisions over time and across the organisation Correct answer.

Explanation

Documented methodology allows different assessors to apply the same scales and assumptions consistently, makes results comparable and enables decisions to be explained and defended. It supports rather than replaces judgement.