Risk Management Framework, Identification and Assessment
Domain 5 covers the risk management framework and the identification and assessment of risk. SL3 candidates must distinguish frameworks, risk appetite statements and assessment techniques, and show how risk information reaches decision-makers.
Core rules and concepts
- ISO 31000 provides principles and a process: communication and consultation, scope/context, risk assessment (identification, analysis, evaluation), risk treatment, monitoring and review. COSO ERM integrates risk with strategy and performance across governance and culture, strategy and objective-setting, performance, review and revision, and information/communication/monitoring.
- Risk appetite is the amount and type of risk an organisation is willing to pursue; risk tolerance is the acceptable variation around a specific objective; risk capacity is the maximum it can bear.
- Identification techniques: workshops, interviews, process mapping, checklists, scenario analysis, bow-tie analysis, Delphi and SWIFT.
- Assessment: combine likelihood and impact using defined scales; record inherent and residual risk; aggregate across the portfolio.
Worked example
A warehouse fire risk is scored likelihood 4 and impact 5 on a 5×5 matrix, giving 20 (extreme). Existing sprinklers and training reduce likelihood to 2 and impact to 4, giving residual 8 (medium). The risk owner compares further treatment - a LKR 25m suppression system - with the expected loss reduction and decides whether residual 8 is within appetite. The reasoning separates inherent from residual risk and shows the control's effect rather than asserting 'the risk is managed'.
Traps that cost marks
Confusing inherent and residual risk; scoring without agreed impact definitions; treating risk as only downside; ignoring correlated risks that aggregate; and labelling a risk 'high' without reference to appetite.