Practice of Risk Management
Domain 2 tests application of the risk process: establishing context, identifying, analysing, evaluating and treating risk, then monitoring, recording and reporting it. Questions often give a scenario and ask which technique, treatment option or register field fits.
Process and techniques
- ISO 31000 process: communication and consultation; scope, context and criteria; risk assessment (identification, analysis, evaluation); treatment; monitoring and review; recording and reporting. Communication and consultation run throughout.
- Identification is structured: brainstorming, interviews, Delphi (anonymous expert consensus), SWIFT (structured what-if), HAZOP (guide words on a process), FMEA (failure modes, effects, RPN = severity × occurrence × detection), fault-tree (deductive) and bow-tie (causes–event–consequences–controls). Match technique to complexity and novelty.
- Analysis can be qualitative, semi-quantitative (risk matrix) or quantitative (Monte Carlo, expected loss). Evaluation compares results with risk criteria and appetite to prioritise.
- Treatment options in ISO 31000: avoid, reduce, transfer/share, accept, and increase/exploit for opportunities. Controls are preventive, detective or corrective. Assess residual risk and secondary risk, and check cost against benefit.
- Monitoring uses KRIs with thresholds. A risk register records cause, event, consequence, owner, controls, inherent and residual ratings, treatment actions and review date.
Worked example
An FMEA of a payment process identifies duplicate payments. Severity 8, occurrence 4, detection 5 gives RPN 160. Adding a pre-payment validation check lowers occurrence to 2, so RPN falls to 80. The residual score is within tolerance, so the process owner accepts it with monthly monitoring. RPN prioritises; it does not measure money.
Traps
Multiplying ordinal 1–5 scales gives false precision; RPN thresholds are arbitrary. Don't confuse inherent with residual risk, or the risk owner with the action owner. 'Transfer' does not remove reputational or regulatory exposure. Don't accept a risk without delegated authority, and don't treat a register as a static list.