I85PREP
⌘ K
ISO 31000 RM study materials
ISO 31000 RM study resources

ISO 31000 RM practice questions

One question at a time. Build your ISO 31000 RM understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of risk management

According to ISO 31000:2018, how is risk defined?

  1. The potential for financial loss in a project
  2. The probability that a hazard will cause harm
  3. The effect of uncertainty on objectives Correct answer.
  4. The likelihood of an adverse event occurring

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, and notes that such effects are deviations from what is expected. The definition is deliberately broad so that risk is not equated only with hazards or losses. This allows opportunities as well as threats to be managed within the same process.

Question 2Fundamental principles and concepts of risk management

In ISO 31000 terms, the effects of risk on objectives are best described as:

  1. Neutral until a loss event occurs
  2. Either positive or negative, or both Correct answer.
  3. Always positive, because uncertainty creates opportunity
  4. Always negative, because risk implies loss

Explanation

ISO 31000 states that risk effects are deviations from what is expected and can be positive and/or negative. The definition explicitly allows for opportunities as well as threats. Organizations therefore manage risk to pursue upside as well as to prevent harm.

Question 3Fundamental principles and concepts of risk management

Which phrase best matches the ISO 31000 definition of risk management?

  1. Periodic audit of the organization's control environment
  2. Purchase of insurance to transfer financial exposures
  3. Elimination of all uncertainty from organizational decisions
  4. Coordinated activities to direct and control risk Correct answer.

Explanation

Risk management is defined as coordinated activities to direct and control an organization with regard to risk. It is an ongoing management activity rather than a single transaction or assurance exercise. Insurance and audit may support it but do not define it.

Question 4Fundamental principles and concepts of risk management

ISO 31000 treats uncertainty as a state of deficient information concerning:

  1. A deficiency in information that is limited to legal and regulatory requirements
  2. Understanding or knowledge of an event, its consequence or likelihood Correct answer.
  3. A deficiency in information that is limited to financial reporting data and systems
  4. A deficiency in information that is limited to employee competence and training records

Explanation

Uncertainty is described as a state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood. It is therefore broader than missing financial or legal data. Uncertainty is inherent in risk assessment and should be identified and considered.

Question 5Fundamental principles and concepts of risk management

Which ISO 31000 principle calls for the appropriate and timely involvement of stakeholders in risk management?

  1. Inclusive Correct answer.
  2. Dynamic
  3. Integrated
  4. Customized

Explanation

The inclusive principle requires appropriate and timely involvement of stakeholders, which improves awareness and enables them to contribute their knowledge and views. Inclusion supports better-informed decisions and greater ownership of risk. The other principles address embedding, change responsiveness and tailoring.

Question 6Fundamental principles and concepts of risk management

Risk criteria, established during the scope, context and criteria stage, are best described as:

  1. Terms of reference for evaluating risk significance Correct answer.
  2. The budget allocated to risk treatment activities
  3. The controls already in place for each identified risk
  4. A complete list of all risks identified across the organization

Explanation

Risk criteria are the terms of reference against which the significance of risk is evaluated. They reflect the organization's objectives, obligations and risk appetite, and they guide decisions about whether treatment is needed. They are not a list of risks, controls or funding.

Question 7Fundamental principles and concepts of risk management

After risk treatment has been applied, the risk that remains is called:

  1. Inherent risk
  2. Systemic risk
  3. Gross risk
  4. Residual risk Correct answer.

Explanation

Residual risk is the risk remaining after risk treatment has been implemented. ISO 31000 requires that residual risk be considered and monitored, because treatment rarely removes risk entirely. Inherent or gross risk refers to the level before treatment.

Question 8Fundamental principles and concepts of risk management

In ISO 31000, the person or entity with accountability and authority to manage a risk is the:

  1. Risk owner Correct answer.
  2. Compliance officer
  3. Internal auditor
  4. Risk assessor

Explanation

The risk owner is the person or entity with the accountability and authority to manage a risk. This role is distinct from those who facilitate assessment or provide assurance. Clear ownership supports effective treatment and monitoring.

Question 9Fundamental principles and concepts of risk management

What is the primary purpose of the risk management framework described in ISO 31000?

  1. To help integrate risk management into significant activities and functions Correct answer.
  2. To certify the organization against external regulatory requirements and standards
  3. To replace the risk management process with a set of documented procedures and forms
  4. To transfer risk to third parties through contractual and insurance arrangements

Explanation

The framework provides the foundations and arrangements that embed risk management throughout the organization. Its purpose is to assist in integrating risk management into significant activities and functions. It supports and sustains the risk management process rather than replacing it.

Question 10Fundamental principles and concepts of risk management

Which action best demonstrates top management's leadership and commitment to risk management under ISO 31000?

  1. Delegating all risk decisions to an external consultant and reviewing only the final report
  2. Restricting risk information to the executive team
  3. Commissioning a one-off risk assessment for the annual report
  4. Integrating risk management into strategy, policies and processes Correct answer.

Explanation

Leadership and commitment include aligning risk management with the organization's strategy, governance and policies, and ensuring resources are available. Top management is expected to embed risk management rather than delegate or isolate it. One-off assessments and restricted information flow undermine this commitment.

Question 11Fundamental principles and concepts of risk management

Which sequence reflects the ISO 31000 risk management process?

  1. Monitoring and review, then risk treatment, then scope and context, then risk assessment
  2. Risk treatment, then risk identification, then risk analysis, then risk evaluation
  3. Scope, context and criteria; risk assessment; risk treatment; monitoring and review Correct answer.
  4. Risk evaluation, then risk treatment, then risk identification, then risk analysis

Explanation

The process begins by establishing scope, context and risk criteria, then performs risk assessment through identification, analysis and evaluation. Treatment follows, with monitoring and review applied throughout, as are communication and consultation. The sequence is not a rigid one-way path, but this is the general order.

Question 12Fundamental principles and concepts of risk management

Why does ISO 31000 place communication and consultation throughout the risk management process?

  1. To satisfy external auditors and regulators before each assessment cycle is signed off
  2. To ensure that every identified risk is eliminated from the register
  3. To combine expertise and ensure stakeholders understand the basis for decisions Correct answer.
  4. To replace the need for monitoring and review activities

Explanation

Communication and consultation bring together different areas of expertise and different views, and help stakeholders understand risk and the basis for decisions. They also build ownership and support effective treatment. They are continuous activities that complement, not replace, monitoring and review.

Question 13Fundamental principles and concepts of risk management

The purpose of risk identification is to:

  1. To compare estimated risk levels against the organization's risk criteria
  2. To find, recognize and describe risks that may help or hinder objectives Correct answer.
  3. To assign a monetary value to each identified risk for the financial statements
  4. To select and implement the most cost-effective treatment options

Explanation

Risk identification aims to find, recognize and describe risks that may help or hinder the organization in achieving its objectives. This includes sources, causes, events and potential consequences. Valuation, comparison with criteria and treatment selection occur in later stages.

Question 14Fundamental principles and concepts of risk management

Risk analysis in ISO 31000 is primarily concerned with:

  1. Comprehending the nature and level of the risk Correct answer.
  2. Documenting the risk register for audit and reporting purposes
  3. Eliminating uncertainty from the decision-making process
  4. Deciding whether risk treatment is required for each risk

Explanation

Risk analysis seeks to comprehend the nature and characteristics of risk, including the level of risk. It considers causes, consequences, likelihood, controls and the uncertainty involved. The decision about whether treatment is needed comes at the evaluation stage.

Question 15Fundamental principles and concepts of risk management

What is the purpose of risk evaluation?

  1. To compare analysis results with criteria to decide whether treatment is needed Correct answer.
  2. To communicate the risk to external stakeholders through the annual sustainability report
  3. To identify the sources, causes and potential consequences of each risk before any assessment is performed
  4. To select the cheapest available control measure that satisfies the insurance provider's requirements

Explanation

Risk evaluation compares the results of risk analysis with the established risk criteria. This determines whether the risk is acceptable or whether treatment is required. Identification and communication are separate activities within the process.

Question 16Fundamental principles and concepts of risk management

Which of the following is an ISO 31000 risk treatment option?

  1. Transferring every identified risk to an insurer regardless of cost
  2. Ignoring all risks that fall below the organization's stated risk appetite
  3. Recording a risk in the register without any further action or review
  4. Avoiding the activity that gives rise to the risk Correct answer.

Explanation

One recognized treatment option is to avoid the risk by deciding not to start or continue the activity that gives rise to it. Other options include changing likelihood or consequences, sharing the risk and retaining it with informed decision-making. Merely recording or ignoring a risk is not treatment.

Question 17Fundamental principles and concepts of risk management

How does ISO 31000 describe monitoring and review within the risk management process?

  1. An optional step that is only needed when a loss occurs
  2. A one-time activity performed only at the closure of a major project or programme
  3. A planned part of the process, with defined timing and responsibilities Correct answer.
  4. A task restricted to the internal audit function

Explanation

Monitoring and review are planned parts of the risk management process, with clear responsibilities, timing and frequency. They can be periodic or ad hoc and should cover both the process and its outputs. They are not confined to audit or to post-loss situations.

Question 18Fundamental principles and concepts of risk management

What is the main purpose of recording and reporting in the risk management process?

  1. To communicate risk information to stakeholders and support decisions Correct answer.
  2. To satisfy insurance underwriting requirements only
  3. To create a legal shield against future claims
  4. To replace the need for communication and consultation with stakeholders

Explanation

Recording and reporting communicate risk information to relevant stakeholders and support decision-making, accountability and continual improvement. Records also preserve evidence of the process and its outcomes. Their purpose is broader than insurance or legal protection.

Question 19Fundamental principles and concepts of risk management

The principle of integration in ISO 31000 means that risk management should be:

  1. Documented in a single standalone manual
  2. Managed by a separate department independent of operations
  3. Embedded in all activities and part of governance Correct answer.
  4. Performed only after major incidents or losses

Explanation

Integration means risk management is embedded in all organizational activities and forms part of governance, strategy, planning and culture. It is not a separate silo or a reaction to incidents. A standalone manual does not by itself achieve integration.

Question 20Fundamental principles and concepts of risk management

The principle of best available information requires that risk management inputs be based on:

  1. The personal judgement of the most senior manager in the organization
  2. Only quantitative data drawn from the organization's financial systems
  3. The data that is easiest and cheapest to collect at short notice
  4. Historical and current data and expectations, noting limitations Correct answer.

Explanation

Inputs to risk management should be based on historical and current information and on expectations, while acknowledging the limitations of the data and models used. Both quantitative and qualitative information can be relevant. Decision-makers should be aware of the assumptions and uncertainties involved.

Question 21Fundamental principles and concepts of risk management

An organization operating in a highly regulated market designs its framework to reflect its legal obligations, culture and stakeholder expectations. Which principle does this best illustrate?

  1. Dynamic
  2. Inclusive
  3. Integrated
  4. Customized Correct answer.

Explanation

The customized principle requires that the framework and process be tailored to the organization's external and internal context. Legal obligations, culture and stakeholder expectations are context factors. Integration, inclusion and dynamism address different aspects of good risk management.

Question 22Fundamental principles and concepts of risk management

A company's risk profile changes rapidly because of new technology and shifting regulations. Which ISO 31000 principle is most directly engaged?

  1. Dynamic Correct answer.
  2. Structured and comprehensive
  3. Inclusive
  4. Best available information

Explanation

The dynamic principle states that risk management anticipates, detects, acknowledges and responds to changes in the external and internal context. Rapid technological and regulatory change is exactly the kind of change this principle addresses. The other principles concern approach, inputs and stakeholder involvement.

Question 23Fundamental principles and concepts of risk management

ISO 31000 states that human behaviour and culture significantly influence risk management. This is captured by which principle?

  1. Continual improvement
  2. Human and cultural factors Correct answer.
  3. Customized
  4. Integrated

Explanation

The human and cultural factors principle recognizes that behaviour and culture significantly influence all aspects of risk management. It calls for understanding these influences and addressing them in the framework and process. Continual improvement, customization and integration address different concerns.

Question 24Fundamental principles and concepts of risk management

During risk evaluation, an analyzed risk is found to fall within the organization's defined acceptable range. What does ISO 31000 suggest should happen next?

  1. Treat the risk with additional controls regardless of cost
  2. Remove the risk from the register permanently
  3. Reassign the risk to a different owner
  4. Accept the risk and continue monitoring and review Correct answer.

Explanation

If the analyzed risk falls within the established criteria, treatment may not be required and the risk can be accepted. Monitoring and review must continue so that changes in the risk or its context are detected. Removing the risk permanently or applying controls regardless of cost is not consistent with the standard.

Question 25Fundamental principles and concepts of risk management

Why does ISO 31000 describe the risk management process as iterative?

  1. The process must be repeated annually to comply with regulatory requirements
  2. New information or changes in context require revisiting earlier stages Correct answer.
  3. Evaluation must always precede identification
  4. Each stage must be completed by a different department

Explanation

The process is iterative because new information and changes in context can require earlier stages to be revisited and updated. Monitoring and review feed learning back into scoping, assessment and treatment. It is not a fixed one-pass sequence, nor is its timing set only by regulation.

Question 26Fundamental principles and concepts of risk management

Under ISO 31000, risk is defined as the:

  1. potential for financial loss arising from an event
  2. effect of uncertainty on objectives Correct answer.
  3. probability that a hazard will cause harm to people
  4. gap between planned controls and implemented controls

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, where such effects are deviations from the expected and may be positive or negative. The definition is anchored in objectives rather than in harm or loss alone.

Question 27Fundamental principles and concepts of risk management

Which statement reflects the ISO 31000 view of risk?

  1. Risk can lead to positive as well as negative outcomes. Correct answer.
  2. Risk is another word for a problem that has already occurred.
  3. Risk arises only from threats that could harm the organization.
  4. Risk exists only where financial exposure can be quantified.

Explanation

ISO 31000 explains that the effect of uncertainty may be a deviation from the expected that is positive, negative, or both, so opportunities fall within the scope of risk. Risk management therefore addresses upside as well as downside.

Question 28Fundamental principles and concepts of risk management

ISO 31000 notes that risk is usually expressed in terms of:

  1. cost, schedule and quality thresholds
  2. policies, procedures and performance measures
  3. sources, events, consequences and likelihood Correct answer.
  4. owners, controls and treatment actions

Explanation

The standard states that risk is usually expressed in terms of risk sources, potential events, their consequences and their likelihood. These elements provide the shared vocabulary for describing and analysing risk.

Question 29Fundamental principles and concepts of risk management

ISO 31000 defines risk management as coordinated activities to:

  1. direct and control the organization with regard to risk Correct answer.
  2. document every management decision in a central register
  3. eliminate all uncertainty from organizational decision making
  4. transfer risk to the parties best able to bear it

Explanation

The definition of risk management is the coordinated activities to direct and control an organization with regard to risk. It encompasses the framework, the process and the principles, not a single technique such as transfer or documentation.

Question 30Fundamental principles and concepts of risk management

ISO 31000 states that managing risk contributes to:

  1. value creation and protection Correct answer.
  2. predictable outcomes across all projects
  3. guaranteed achievement of strategic goals
  4. the elimination of regulatory scrutiny

Explanation

The standard links risk management to the creation and protection of value, through improved performance, encouragement of innovation and better use of resources in pursuit of objectives.

Question 31Fundamental principles and concepts of risk management

In ISO 31000, uncertainty is best described as:

  1. the complete inability to assign probabilities to any outcome
  2. the variance between a planned budget and the actual expenditure
  3. a deficiency of information about an event or its consequences Correct answer.
  4. a future event whose financial cost has not yet been estimated

Explanation

Uncertainty is described as a state, even partial, of deficiency of information related to the understanding or knowledge of an event, its consequence or its likelihood. It is the source of risk rather than risk itself.

Question 32Fundamental principles and concepts of risk management

The ISO 31000 principle of 'structured and comprehensive' means that risk management:

  1. follows an identical documented template in every organization
  2. reports every risk to the board regardless of size
  3. is applied only to formally approved projects
  4. uses a systematic approach yielding consistent results Correct answer.

Explanation

A structured and comprehensive approach means risk management is systematic and timely, which contributes to consistent and comparable results. The structure should be proportionate rather than copied identically everywhere.

Question 33Fundamental principles and concepts of risk management

Which statement correctly distinguishes the risk management framework from the risk management process?

  1. The framework is used only by the board, while the process is used only by staff
  2. The process describes the organization's governance and reporting arrangements
  3. The framework is the step-by-step sequence used to treat individual risks
  4. The framework is the set of arrangements supporting the process Correct answer.

Explanation

The framework comprises the foundations and arrangements, such as leadership, integration and evaluation, that embed risk management across the organization. The process is the set of activities applied to manage risk within that framework.

Question 34Fundamental principles and concepts of risk management

A small family-owned logistics firm designs its risk framework around its own size, sector and culture rather than copying a multinational's approach. Which ISO 31000 principle does this illustrate?

  1. Inclusive
  2. Dynamic
  3. Customized Correct answer.
  4. Continual improvement

Explanation

The customized principle holds that the framework and process should be proportionate to the organization's external and internal context. Tailoring them to size, sector and culture is exactly what this principle requires.

Question 35Fundamental principles and concepts of risk management

During a safety risk assessment, a plant manager invites shift operators, contractors and union representatives to contribute. This best demonstrates which principle?

  1. Structured and comprehensive
  2. Inclusive Correct answer.
  3. Integrated
  4. Best available information

Explanation

The inclusive principle requires the appropriate and timely involvement of stakeholders, recognizing that their knowledge, views and perceptions improve risk management. Operators and contractors hold information that managers alone may lack.

Question 36Fundamental principles and concepts of risk management

An organization's risk register is reviewed only once a year, so newly opened overseas operations are absent from it for months. Which principle is most clearly weakened?

  1. Customized
  2. Dynamic Correct answer.
  3. Inclusive
  4. Structured and comprehensive

Explanation

The dynamic principle requires risk management to anticipate, detect, acknowledge and respond to change in an appropriate and timely manner. An annual-only review fails to reflect emerging operations as circumstances change.

Question 37Fundamental principles and concepts of risk management

Which activity best demonstrates the principle of continual improvement in risk management?

  1. Recertifying the risk register at each financial year end
  2. Delegating every risk decision to the audit committee
  3. Using performance measures to enhance the framework Correct answer.
  4. Adding more entries to the corporate risk register each year

Explanation

Continual improvement involves measuring risk management performance against purpose, plans, indicators and expected behaviour, and using the results to improve the framework and process. It is about enhancement based on evidence, not volume or routine sign-off.

Question 38Fundamental principles and concepts of risk management

When establishing the context of the risk management process, an organization should consider:

  1. its external and internal environment and objectives Correct answer.
  2. only the objectives approved by the board for the coming year
  3. only risks that have been recorded during the past five years
  4. only the treatment options that fit within the current budget

Explanation

Establishing context requires articulating the organization's objectives and defining the external and internal parameters to be taken into account, including stakeholders, culture, regulation and the wider environment.

Question 39Fundamental principles and concepts of risk management

Which group should be involved in communication and consultation about a risk?

  1. Only the internal audit function
  2. Only external regulators and auditors
  3. Relevant internal and external stakeholders Correct answer.
  4. Only the risk management department

Explanation

ISO 31000 calls for communication and consultation with appropriate internal and external stakeholders at all stages, because they can affect or be affected by the risk and often hold information needed for analysis.

Question 40Fundamental principles and concepts of risk management

In ISO 31000 terms, a control is:

  1. a measure that maintains or modifies risk Correct answer.
  2. an insurance policy covering a specific peril
  3. a budget allocated to risk treatment activities
  4. a document recording decisions about a risk

Explanation

ISO 31000 defines a control as a measure that maintains and/or modifies risk. Controls can be policies, procedures, devices, practices or organizational arrangements, and insurance is only one possible example.

Question 41Fundamental principles and concepts of risk management

When choosing among risk treatment options, an organization should select the option that:

  1. requires the least consultation with internal stakeholders
  2. has already been used successfully by comparable organizations
  3. best balances benefits against cost and effort Correct answer.
  4. removes the risk from the register regardless of the cost involved

Explanation

Treatment selection weighs the expected benefits against the cost and effort of implementation, together with feasibility and the values and perceptions of stakeholders. Copying others or minimizing consultation does not satisfy that test.

Question 42Fundamental principles and concepts of risk management

A risk treatment plan should specify, among other things:

  1. the complete history of previous incidents in the organization
  2. the competitor benchmarks used to justify the treatment
  3. responsibilities, resources and performance measures Correct answer.
  4. the names of every employee working in the affected unit

Explanation

ISO 31000 indicates that treatment plans should identify the rationale, responsibilities, proposed actions, resource requirements, performance measures, constraints, reporting and monitoring needs, and timing.

Question 43Fundamental principles and concepts of risk management

Which item is most appropriate for monitoring and review within the risk management process?

  1. The annual marketing budget allocation
  2. Individual staff performance appraisal ratings
  3. The number of pages in the risk register
  4. Changes in context and in risk indicators Correct answer.

Explanation

Monitoring and review should track changes in the external and internal context, the performance of controls and indicators, and the effectiveness of the process itself. This keeps analysis and treatment relevant as circumstances evolve.

Question 44Fundamental principles and concepts of risk management

An organization's risk attitude refers to:

  1. the total amount of risk it is capable of bearing
  2. the set of risks that it has formally decided to accept
  3. the maximum financial loss it can absorb before insolvency
  4. its approach to assessing and pursuing or avoiding risk Correct answer.

Explanation

Risk attitude is the organization's approach to assessing and eventually pursuing, retaining, taking on or turning away from risk. It is distinct from capacity and tolerance, which concern how much risk can be borne.

Question 45Fundamental principles and concepts of risk management

In ISO 31000, stakeholders are defined as:

  1. the regulators and supervisors that license the organization's activities
  2. parties that can affect or be affected by a decision or activity Correct answer.
  3. the employees who carry out the risk management process day to day
  4. the shareholders and lenders that provide the organization's capital

Explanation

The definition is deliberately broad: a stakeholder is a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Including perceived effects matters because perceptions shape how risk is understood and answered.

Question 46Fundamental principles and concepts of risk management

An organization has a well-documented risk process used by the risk function, but business units ignore it and the executive team never refers to risk in decision making. Which element of the ISO 31000 model is most clearly deficient?

  1. The scope of the annual internal audit programme
  2. The choice of risk identification techniques used by the risk function
  3. The framework's leadership and integration Correct answer.
  4. The design of the likelihood and consequence scales

Explanation

ISO 31000 places leadership and commitment, and the integration of risk management into governance and decision making, at the heart of the framework. A process that exists but is not used in decisions shows those framework elements are weak, regardless of technique quality.

Question 47Fundamental principles and concepts of risk management

ISO 31000 treatment options include 'taking the risk'. Which situation best illustrates this option?

  1. A firm launches a product line with uncertain demand Correct answer.
  2. A firm exits a country whose regulatory regime is unstable
  3. A firm buys insurance against flood damage at its main warehouse
  4. A firm installs filters to reduce emissions from its main plant

Explanation

Taking or pursuing a risk means accepting the uncertainty in order to pursue a potential opportunity. Buying insurance is sharing, exiting a market is avoiding, and installing filters is reducing likelihood or consequence.

Question 48Fundamental principles and concepts of risk management

Using ISO 31000 terminology, which pairing correctly distinguishes a risk source from an event?

  1. Loss of key staff is a source; a director resigning is an event Correct answer.
  2. A regulatory change is an event and a compliance failure is a risk source
  3. A warehouse fire is a risk source and inadequate wiring is an event
  4. Poor safety culture is an event and a worker injury is a risk source

Explanation

A risk source is an element which alone or in combination has the potential to give rise to risk, while an event is an occurrence or a change of a particular set of circumstances. Loss of key staff is a potential source, and a specific resignation is the occurrence.

Question 49Fundamental principles and concepts of risk management

An engineering firm performs a full risk assessment at project initiation and then does not revisit it until project closure. Which criticism is most consistent with ISO 31000?

  1. The firm failed to appoint a risk owner for each project risk
  2. The firm relied too heavily on expert judgement during analysis
  3. The process was treated as one-off rather than iterative Correct answer.
  4. The firm did not record risks in a consistent and auditable format

Explanation

The ISO 31000 process is iterative: monitoring and review are ongoing, and new information and changed context feed back into identification, analysis, evaluation and treatment throughout the life of the activity.

Question 50Fundamental principles and concepts of risk management

A risk register contains entries such as 'server outage last month caused a two-day service interruption'. What is the main conceptual problem?

  1. A realized event is an issue, not a risk Correct answer.
  2. The entry lacks a named treatment owner
  3. The entry should have been assigned a numerical score
  4. The entry duplicates the incident log format

Explanation

Risk concerns the effect of uncertainty on objectives and therefore relates to possible future effects. An event that has already happened with known effects is an issue to be managed, although it can usefully inform identification of related future risks.