M_o_R 4 Practitioner common mistakes
M_o_R 4 Practitioner · Understand the traps and how to avoid them.
Treating the eight M_o_R principles as a checklist of activities to be ticked off, and answering 'how many principles must be applied' or 'which principle can be skipped for small projects' by selecting a subset.
Candidates carry over a 'tailor by dropping elements' mindset from other frameworks and assume principles are optional good practice rather than mandatory foundations. The principles are all expected to be applied and evidenced; what varies is how they are applied, not whether.
What to do instead
Learn the principles as non-negotiable foundations whose application is tailored in how, not in whether. Practise answering 'tailoring' questions by describing how each principle is still demonstrated (for example, how 'creates value' is shown on a small change) rather than which principle is dropped.
Confusing the principle 'creates value' with financial return only, and rejecting options where value is non-financial (reputation, compliance, safety, stakeholder confidence).
Candidates equate 'value' with monetary benefit and overlook that M_o_R frames value as the contribution to objectives, which can be social, regulatory, or reputational. Scenario questions often hinge on a non-financial value judgement.
What to do instead
Define value in the answer as contribution to the organisation's objectives, whatever their form. In scenario questions, explicitly link the risk response to the objective it protects (compliance, safety, reputation) rather than only to cost saving.
Producing a risk management approach that lists policy statements but omits the required components (objectives, scope, roles and responsibilities, process, risk appetite and tolerance, reporting, and review/assurance arrangements).
Candidates write a persuasive narrative about commitment to risk management and forget that the approach is a structured document with defined content. Marks are lost for missing components even when the prose is strong.
What to do instead
Memorise the approach's content headings and use them as a skeleton for every answer: purpose and objectives, scope, principles applied, process and techniques, roles and responsibilities, risk appetite and tolerances, reporting and escalation, assurance and review, and supporting tools. Check each heading is addressed before finishing.
Writing the approach as a generic template with no reference to the organisation's context, such as its objectives, regulatory environment, existing frameworks, or the perspectives it must cover.
Candidates reproduce textbook content because it feels safe, but the Practitioner exam rewards contextualisation. An approach that could belong to any organisation cannot demonstrate understanding of tailoring.
What to do instead
Before writing, identify two or three contextual anchors from the scenario (sector regulation, strategic objectives, organisational culture, existing governance) and explicitly show how the approach responds to each. Use sentences of the form 'because the organisation operates under X, the approach requires Y'.
Describing the risk management process as a linear sequence that ends at 'implement responses', omitting the iterative feedback loops and the 'identify context' and 'monitor and review' stages.
Candidates draw the process as a straight line from identify to respond and forget that M_o_R presents it as a cycle embedded in the approach, with context setting first and continuous monitoring feeding back into all stages.
What to do instead
Learn the process as eight elements: identify context, identify risks, assess risks, plan responses, implement responses, and the embedded activities of communicate, monitor, and review. When answering, show at least one feedback loop, for example how monitoring triggers reassessment or a change in context.
Treating 'identify context' as a one-off scoping exercise done at the start, and failing to revisit it when internal or external conditions change.
Candidates see context as background information rather than a live input to risk identification and assessment. Scenario questions about a regulatory change or a new strategy are designed to test whether context is re-examined.
What to do instead
Describe context as the internal and external parameters (objectives, stakeholders, regulatory, economic, cultural, and risk appetite) that must be established and refreshed. In scenario answers, state explicitly when a change in context would require the process to be re-entered.
Confusing risk appetite with risk tolerance, or using the terms interchangeably, so that escalation thresholds and response decisions are justified against the wrong concept.
The two terms are closely related and both appear in policy statements, so candidates memorise neither precisely. Appetite is the amount and type of risk an organisation is willing to seek or retain; tolerance is the defined acceptable variation around a specific objective.
What to do instead
Anchor the distinction with a concrete example: appetite is the board's statement of how much risk it will accept in pursuit of objectives, while tolerance is the measurable limit (for example, a percentage variance on a project budget) that triggers escalation. In answers, use appetite for strategic direction and tolerance for operational thresholds.
Listing risk responses without mapping them to the four response types (avoid, reduce, transfer, accept) or without stating the residual risk position after the response.
Candidates describe sensible actions but leave the examiner unable to see which response category is being applied and whether the residual exposure falls within tolerance. This loses marks for both process knowledge and evaluation.
What to do instead
For each significant risk, state the response type, the action, the owner, and the expected residual risk and whether it is within tolerance. Where a response combines types (for example reduce plus transfer through insurance), say so explicitly.
Treating embedding as a one-off communication exercise and proposing only training or a newsletter, without addressing culture, performance management, and the alignment of incentives and governance.
Candidates equate embedding with awareness raising. The exam expects a sustained programme that changes behaviour through leadership example, integration with decision-making and performance review, and clear accountability.
What to do instead
Build embedding answers around multiple levers: visible leadership sponsorship, integration into existing processes and decision gates, defined accountabilities, performance indicators and reporting, learning from events, and regular review. Name at least two measurable indicators of whether embedding is working.
Describing the risk perspectives (strategic, programme, project, operational) as separate processes rather than the same process applied at different levels, and failing to explain how risks escalate between them.
Candidates learn each perspective in isolation and miss that M_o_R applies one process across perspectives, with roles and reporting lines connecting them. Questions about aggregation and escalation expose this gap.
What to do instead
Map each perspective to its objectives, typical risk types, owner, and reporting route, then practise describing how a project risk that exceeds tolerance is escalated to the programme or strategic level and how aggregated risks inform strategic decisions. Emphasise the shared process and the differing scope and authority.