I85PREP
⌘ K
M_o_R 4 Practitioner study materials
M_o_R 4 Practitioner study resources

M_o_R 4 Practitioner practice questions

One question at a time. Build your M_o_R 4 Practitioner understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk management principles

In M_o_R, which principle states that risk management should be applied at every level of the organization, from strategic down to operational?

  1. Risk management informs decision-making
  2. Risk management is continually improved
  3. Risk management is aligned with the organization's objectives
  4. Risk management is embedded in all activities Correct answer.

Explanation

The principle of embedding means risk management is not a bolt-on activity but is built into all activities, roles and levels, including strategic, programme, project and operational contexts. It stresses integration into everyday work rather than a separate specialist process.

Question 2Risk management principles

A risk practitioner is asked what the M_o_R principles are for. Which answer best reflects their purpose?

  1. They are the foundation that guides how risk management is designed and applied Correct answer.
  2. They are a checklist of documents that must be produced for each risk assessment
  3. They are optional techniques used only in project risk workshops
  4. They are mandatory controls imposed by an external regulator

Explanation

The M_o_R principles are the underlying rules and values that shape how risk management is set up and carried out across the organization. They guide good practice rather than prescribing a fixed set of documents or techniques.

Question 3Risk management principles

Which pair correctly matches a M_o_R principle with what it emphasizes?

  1. Risk management is tailored - it is adapted to the organization's context and needs Correct answer.
  2. Risk management is aligned with objectives - it prioritizes the largest risks regardless of goals
  3. Risk management supports continual improvement - it focuses on audit findings only
  4. Risk management informs decision-making - it replaces professional judgement with scoring

Explanation

Tailoring means the approach is adapted to the organization's size, sector, culture and objectives rather than applied as a rigid one-size-fits-all method. This is a core M_o_R principle about fitting practice to context.

Question 4Risk management principles

An organization's risk policy states that risk management 'creates a culture of openness'. Which M_o_R principle does this most directly reflect?

  1. Risk management is continually improved
  2. Risk management is embedded in all activities
  3. Risk management is aligned with objectives
  4. Risk management is transparent and inclusive Correct answer.

Explanation

The transparency and inclusivity principle promotes open discussion of risk, honest reporting and involvement of stakeholders, which underpins a culture of openness. It encourages raising concerns without fear rather than hiding them.

Question 5Risk management principles

A practitioner argues that because M_o_R has principles, organizations must follow a single prescribed process. How should this be answered?

  1. Correct, but only for public sector organizations
  2. Incorrect, the principles guide behaviour while processes are tailored to the organization Correct answer.
  3. Correct, the principles and processes are fixed and must be applied identically
  4. Incorrect, because M_o_R has no processes at all

Explanation

M_o_R distinguishes principles, which are fundamental and enduring, from processes, which are adapted to fit the organization's context. The guidance expects tailoring of the process while keeping the principles intact.

Question 6Risk management principles

Which statement best describes the M_o_R principle 'risk management informs decision-making'?

  1. Decisions should be made only by the risk function
  2. All decisions must be deferred until risks are eliminated
  3. Risk information should be used to support choices at the point where decisions are made Correct answer.
  4. Risk registers must be reviewed only at year end before budgeting

Explanation

This principle holds that risk understanding should feed into decisions when and where they are taken, so that choices are made with awareness of uncertainty and exposure. It is about informing, not controlling, decision rights.

Question 7Risk management principles

A manager says risk management is 'something the risk team does at month end'. Which principle is most clearly being violated?

  1. Risk management is embedded in all activities Correct answer.
  2. Risk management is tailored
  3. Risk management is aligned with objectives
  4. Risk management is continually improved

Explanation

Treating risk management as a periodic task owned by a specialist team contradicts the embedding principle, which expects risk consideration to be part of everyday activities and decisions by all staff. It should be integrated, not isolated.

Question 8Risk management principles

Which of the following is the best example of applying the M_o_R principle of continual improvement?

  1. Reviewing risk process effectiveness and adjusting it based on lessons learned Correct answer.
  2. Producing the same risk register format unchanged for five years
  3. Removing all risk training to save budget
  4. Delegating all risk decisions to an external consultant

Explanation

Continual improvement means regularly assessing how well risk management is working and refining it using feedback, lessons and performance information. It is an ongoing cycle of learning rather than static repetition.

Question 9Risk management principles

The M_o_R principle of alignment with objectives implies that risk management should:

  1. Prioritize risks that are easiest to mitigate
  2. Focus only on financial risks that affect the budget
  3. Be driven solely by external audit requirements
  4. Support the achievement of the organization's stated goals and priorities Correct answer.

Explanation

Alignment means risk management is directed at helping the organization achieve its objectives, so risk effort should be proportionate to what matters for those goals. It is not limited to finance, audit or ease of treatment.

Question 10Risk management principles

A small charity adopts M_o_R but uses a lightweight, informal risk process suited to its size. Which principle does this best illustrate?

  1. Risk management informs decision-making
  2. Risk management is transparent and inclusive
  3. Risk management is tailored Correct answer.
  4. Risk management is embedded in all activities

Explanation

Tailoring is the principle that the risk approach should be proportionate and adapted to the organization's size, complexity and context. A lightweight process for a small charity is a textbook application of tailoring.

Question 11Risk management principles

Which statement about the relationship between M_o_R principles and the organization's risk culture is most accurate?

  1. Principles have no bearing on culture; culture is set only by HR policy
  2. Principles reinforce behaviours such as openness, accountability and informed challenge Correct answer.
  3. Principles only matter once a risk management framework is fully mature
  4. Principles replace the need for leadership commitment

Explanation

The principles shape expected behaviours, encouraging openness, clear accountability and evidence-based challenge, which together build a healthy risk culture. They complement, rather than replace, leadership commitment.

Question 12Risk management principles

A risk practitioner is challenged that 'transparent and inclusive' risk management slows decisions. What is the most appropriate response consistent with M_o_R?

  1. Share all risk information with everyone regardless of sensitivity
  2. Involve relevant stakeholders proportionately so decisions are better informed and more durable Correct answer.
  3. Keep risk discussions confidential to the risk team
  4. Exclude stakeholders to speed up all decisions

Explanation

Transparency and inclusivity call for engaging the right stakeholders in a proportionate way, improving the quality and acceptance of decisions. It does not mean indiscriminate disclosure or excluding people.

Question 13Risk management principles

Which M_o_R principle most directly explains why risk management should continue to evolve as the organization's external environment changes?

  1. Risk management informs decision-making
  2. Risk management is aligned with objectives
  3. Risk management is embedded in all activities
  4. Risk management is continually improved Correct answer.

Explanation

Continual improvement means the risk approach is reviewed and adapted as context, objectives and the external environment change. It keeps the practice relevant rather than static.

Question 14Risk management principles

Which of these best captures why M_o_R treats the principles as enduring while processes are adaptable?

  1. Because principles change every year while processes stay fixed
  2. Because processes are more important than principles and override them
  3. Because principles are legally binding and processes are optional
  4. Because principles express fundamental values that hold regardless of context, while processes must fit local circumstances Correct answer.

Explanation

Principles are the stable foundation expressing what good risk management means, whereas processes are means to that end and must be tailored to the organization. This separation lets the guidance remain valid across diverse contexts.

Question 15Risk management principles

An organization uses M_o_R at strategic, programme, project and operational levels. Which principle does this most directly demonstrate?

  1. Risk management is continually improved
  2. Risk management informs decision-making
  3. Risk management is embedded in all activities Correct answer.
  4. Risk management is tailored

Explanation

Applying risk management consistently across strategic, programme, project and operational contexts shows the embedding principle in action. It reflects integration across the organization's levels and activities.

Question 16Risk management principles

Which behaviour is most consistent with the M_o_R principle that risk management informs decision-making?

  1. Presenting risk exposure alongside options so decision-makers can weigh trade-offs Correct answer.
  2. Ignoring risk information when it conflicts with a preferred option
  3. Documenting risks but never referencing them in governance meetings
  4. Removing risk from the agenda to keep meetings short

Explanation

Informing decision-making means risk exposure is presented in a way that lets decision-makers compare options and trade-offs. Risk information should be visible at the point of choice.

Question 17Risk management principles

A practitioner claims that once the risk process is tailored, no further changes are needed. Which principle does this overlook?

  1. Risk management is continually improved Correct answer.
  2. Risk management is transparent and inclusive
  3. Risk management is aligned with objectives
  4. Risk management is embedded in all activities

Explanation

Tailoring is not a one-off exercise; continual improvement requires periodic review and adjustment as circumstances change. Assuming the process is finished overlooks the improvement principle.

Question 18Risk management principles

Which statement best explains why M_o_R emphasizes that risk management should be proportionate?

  1. Because only high-severity risks should ever be recorded
  2. Because proportionality is a legal requirement in all sectors
  3. Because all risks must be treated with identical effort regardless of significance
  4. Because effort should match the significance of the risk and the context, supporting the tailoring principle Correct answer.

Explanation

Proportionality is central to tailoring: risk effort and formality should reflect the significance of the risk and the organization's context. It avoids both over-engineering and neglect.

Question 19Risk management principles

Which of the following best illustrates the M_o_R principle 'risk management is aligned with objectives' in practice?

  1. Risk workshops are held only when auditors request them
  2. Risk appetite is set at zero for all risk categories
  3. Risk criteria are derived from the organization's strategic goals and tolerances Correct answer.
  4. Risk reporting focuses exclusively on historical incidents

Explanation

Alignment means risk criteria, appetite and reporting are anchored in the organization's objectives and tolerances. This ensures risk work supports what the organization is trying to achieve.

Question 20Risk management principles

A risk manager wants to demonstrate that the organization's risk management is transparent. Which action best supports this?

  1. Removing risk discussions from project meetings
  2. Publishing clear risk reporting to relevant stakeholders at an appropriate level of detail Correct answer.
  3. Keeping the risk register confidential to the risk team
  4. Restricting risk information to the board only

Explanation

Transparency means risk information is communicated openly to relevant stakeholders in a form and level of detail they can use. It supports informed challenge and shared understanding.

Question 21Risk management principles

Which statement about M_o_R principles is most accurate?

  1. They apply only to operational risk and exclude strategic risk
  2. They are optional and can be ignored once a framework exists
  3. They are intended to guide behaviour and decision-making across all levels of the organization Correct answer.
  4. They prescribe the exact number of risk registers an organization must keep

Explanation

The principles are guidance for behaviour and decision-making that applies across strategic, programme, project and operational levels. They are not a prescriptive rulebook about artefacts.

Question 22Risk management principles

An organization discovers that its risk process works well at project level but is ignored by senior leaders. Which principle is least well demonstrated?

  1. Risk management is embedded in all activities Correct answer.
  2. Risk management informs decision-making
  3. Risk management is tailored
  4. Risk management is continually improved

Explanation

If senior leaders ignore the process, risk management is not embedded across all levels and activities. Embedding requires visible application from strategic leadership down to operational teams.

Question 23Risk management principles

Which of these best describes how the M_o_R principle of inclusivity should influence stakeholder engagement in risk management?

  1. Engagement should be limited to external regulators
  2. Relevant stakeholders, including those affected by risks, should be engaged appropriately Correct answer.
  3. Only senior managers should contribute to risk identification
  4. Stakeholders should be engaged only after decisions are made

Explanation

Inclusivity means engaging relevant stakeholders, including those affected by risks, so that diverse perspectives inform risk understanding and decisions. Engagement should be timely and appropriate, not an afterthought.

Question 24Risk management principles

A practitioner is asked how the M_o_R principles relate to the organization's risk management framework. Which answer is most accurate?

  1. The principles replace the framework entirely
  2. The principles apply only before a framework is created
  3. The principles inform how the framework is designed, applied and improved Correct answer.
  4. The framework makes the principles obsolete

Explanation

The principles shape the design, application and ongoing improvement of the framework, including its processes, roles and reporting. They remain relevant throughout the framework's life.

Question 25Risk management principles

Which M_o_R principle most directly supports the idea that risk management should help the organization seize opportunities as well as avoid threats?

  1. Risk management is embedded in all activities
  2. Risk management is continually improved
  3. Risk management is tailored
  4. Risk management is aligned with objectives Correct answer.

Explanation

Alignment with objectives frames risk management around achieving goals, which includes taking calculated opportunities as well as protecting against threats. It connects risk work to value creation, not just loss avoidance.

Question 26Risk management principles

In M_o_R, the eight principles are described as enduring. What does this mean for a practitioner designing a risk process for a new business unit?

  1. The principles must be copied verbatim into the process documentation to prove compliance.
  2. The principles can be set aside where the business unit's objectives differ from the corporate ones.
  3. The principles must be reflected in whatever process is designed, even though the process itself can be tailored. Correct answer.
  4. The principles only apply once the business unit reaches a defined size threshold.

Explanation

M_o_R distinguishes principles, which are enduring and should always be evident, from the processes and techniques that can be tailored to context. A practitioner therefore designs a proportionate process while ensuring each principle is visibly reflected in how risk is managed. The principles are not documentation templates, nor are they conditional on organizational size.

Question 27Risk management principles

A risk practitioner is explaining the M_o_R principle of proportionate risk management to a sceptical operations director. Which argument is most consistent with the principle?

  1. Proportionality requires that all risk activity be outsourced to specialist consultants.
  2. Risk effort should be scaled to the level of risk and the value at stake, so low-value activities receive lighter treatment. Correct answer.
  3. Proportionality means reducing the number of risks recorded until the register fits on one page.
  4. Every risk must receive an identical level of analysis so that results are comparable across the organization.

Explanation

Proportionality in M_o_R means the effort, formality and cost of risk management are matched to the significance of the risk and the value of what is at stake. High-value or high-uncertainty activities warrant deeper analysis, while routine low-value ones can be handled more lightly. It is not about uniformity, register length, or outsourcing.

Question 28Risk management principles

Which action best demonstrates that risk management in an organization is transparent and inclusive?

  1. Holding risk discussions only among senior managers who own the largest budgets.
  2. Recording risks in a system that only the risk function can access.
  3. Restricting risk information to the board to avoid alarming staff.
  4. Publishing the risk policy and inviting staff at all levels to raise and discuss risks through defined channels. Correct answer.

Explanation

Transparency and inclusivity require that relevant people can see how risk is managed and can contribute their knowledge and concerns. Publishing the policy and opening defined channels to all levels puts both elements into practice. Restricting access or limiting participation to a narrow group undermines the principle.

Question 29Risk management principles

Which statement correctly distinguishes the M_o_R principles from the M_o_R framework?

  1. Principles are the enduring values that guide behaviour; the framework comprises the approach, processes, techniques and supporting structures used to apply them. Correct answer.
  2. Principles describe the software tools used, while the framework describes the people involved.
  3. Principles are optional guidance, while the framework is the only mandatory element.
  4. Principles change with each project, while the framework remains fixed for the life of the organization.

Explanation

M_o_R treats the principles as enduring values that shape how risk management is conducted, while the framework provides the practical means of applying them, including the approach, processes, techniques and roles. The framework is tailored to context; the principles are not. This distinction is central to applying M_o_R sensibly.

Question 30Risk management principles

A programme manager proposes to skip risk identification because the project is 'going well' and the team is busy. Which M_o_R principle does this most directly conflict with?

  1. Risk management is transparent and inclusive.
  2. Risk management is aligned with objectives.
  3. Risk management is applied at all levels and throughout the lifecycle, not only when problems appear. Correct answer.
  4. Risk management is continually improved.

Explanation

M_o_R expects risk management to be a continuous activity embedded throughout the lifecycle, not something triggered only when difficulties arise. Abandoning identification because things currently look favourable removes the organization's ability to detect emerging risk. The other principles are relevant to risk management but are not the one most directly breached here.

Question 31Risk management principles

Senior leaders want risk information that supports a major investment decision, but the risk register only contains operational incident logs. Which principle is most directly undermined?

  1. Risk management is transparent and inclusive.
  2. Risk management informs decision-making. Correct answer.
  3. Risk management is aligned with objectives.
  4. Risk management is proportionate.

Explanation

The principle that risk management informs decision-making requires risk information to be relevant, timely and presented in a form that supports the decision at hand. An incident log does not give leaders the forward-looking view of uncertainty and opportunity needed for an investment decision. The failure is therefore about the decision-support purpose of risk work.

Question 32Risk management principles

An organization's risk process is heavily bureaucratic at every level, requiring full quantitative analysis even for trivial operational tasks. Which principle is being most clearly misapplied?

  1. Risk management is proportionate to the level of risk and the value at stake. Correct answer.
  2. Risk management is transparent and inclusive.
  3. Risk management is aligned with objectives.
  4. Risk management is continually improved.

Explanation

Proportionality requires the effort and formality of risk management to be matched to the significance of the risk. Applying full quantitative analysis to trivial tasks is disproportionate and diverts effort from where it adds value. The other principles are not the primary issue in this scenario.

Question 33Risk management principles

A risk practitioner wants to embed the principle that risk management is aligned with objectives. Which action is most appropriate?

  1. Set appetite thresholds once at the start of the year and avoid revisiting them.
  2. Derive risk categories and appetite thresholds from the organization's strategic objectives and review them when objectives change. Correct answer.
  3. Keep risk reporting separate from performance reporting to avoid confusing the two.
  4. Adopt a standard industry risk taxonomy unchanged so that categories are consistent with peers.

Explanation

Alignment with objectives means risk management is shaped by what the organization is trying to achieve, including its risk appetite. Deriving categories and thresholds from objectives, and revisiting them as objectives change, keeps risk work relevant. A borrowed taxonomy or fixed thresholds may drift away from the organization's actual aims.

Question 34Risk management principles

What is the most accurate description of how the M_o_R principle of continual improvement should be applied to a risk management framework?

  1. Improvement applies only to the risk register content, not to how risk management is performed.
  2. Improvement is achieved by adding more documentation and approval steps to the process.
  3. The framework is reviewed and refined using feedback, performance information and lessons learned, while the principles remain constant. Correct answer.
  4. The framework is replaced with a new methodology each year to demonstrate improvement.

Explanation

Continual improvement means using feedback, performance measures and lessons learned to refine how risk management is carried out, while the underlying principles stay the same. Improvement is purposeful, not churn for its own sake, and it covers the whole way of working rather than only register entries. Adding bureaucracy is not evidence of improvement.

Question 35Risk management principles

A risk manager argues that because the organization has a formal risk policy, risk management is automatically embedded. Which principle does this reasoning overlook most directly?

  1. Risk management must be embedded in decision-making and behaviour, not merely documented in policy. Correct answer.
  2. Risk management must be continually improved.
  3. Risk management must be transparent and inclusive.
  4. Risk management must be proportionate to the value at stake.

Explanation

M_o_R stresses that risk management delivers value when it is actually used to inform decisions and shape behaviour, not when it exists only as written policy. A policy is an enabler, but embedding is demonstrated through practice. The other principles are relevant to good risk management but do not address the gap between documentation and use.

Question 36Risk management principles

A practitioner is designing risk reporting for a board that is accountable for strategic objectives. Which design choice best reflects the principle that risk management informs decision-making?

  1. Report risks in terms of their potential effect on the strategic objectives and the decisions the board must take. Correct answer.
  2. Report every risk in the register with equal prominence so that nothing is hidden.
  3. Report risk scores without any commentary so that the board can interpret them freely.
  4. Report only risks that have already materialized as incidents.

Explanation

To inform decision-making, risk reporting should connect risks to the objectives the board is accountable for and make clear what decisions or actions are needed. This gives leaders a basis for choice rather than a data dump. Equal prominence for all risks and reporting only realized incidents do not support strategic decisions.

Question 37Risk management principles

An organization states that risk management is 'everyone's responsibility' but provides no training, no defined roles and no channels for staff to raise concerns. Which principle is most clearly not being upheld in practice?

  1. Risk management is aligned with objectives.
  2. Risk management is continually improved.
  3. Risk management is transparent and inclusive. Correct answer.
  4. Risk management is proportionate.

Explanation

Transparency and inclusivity require that people can see how risk is managed and can contribute, which depends on defined roles, communication and accessible channels. Declaring shared responsibility without enabling it is rhetoric rather than practice. The scenario does not primarily concern proportionality, improvement or alignment.

Question 38Risk management principles

A practitioner must persuade a sceptical executive that M_o_R principles add value beyond a set of procedures. Which argument is strongest?

  1. Principles remove the need for tailoring because they prescribe one best process.
  2. Principles provide a legal defence if a risk later materializes.
  3. Principles guarantee that no risk will be missed if they are followed exactly.
  4. Principles shape judgement in situations the procedures do not cover, so behaviour remains sound when circumstances are novel. Correct answer.

Explanation

Principles are enduring values that guide judgement where documented procedures cannot anticipate every situation. They therefore complement procedures by shaping behaviour in novel or ambiguous circumstances. They do not guarantee completeness, prescribe a single process, or provide legal protection.

Question 39Risk management principles

Two business units apply the same M_o_R principles but use very different processes: one uses a detailed quantitative model, the other a simple qualitative workshop approach. Which interpretation is most consistent with M_o_R?

  1. Both can be consistent with the principles because the principles endure while processes are tailored to context. Correct answer.
  2. Only the qualitative unit is compliant because simplicity is always preferred in M_o_R.
  3. Neither is compliant because consistency requires identical processes across the organization.
  4. Only the quantitative unit is compliant because measurement demonstrates rigour.

Explanation

M_o_R separates enduring principles from adaptable processes, so different units may apply the same principles through processes suited to their scale, complexity and risk profile. Consistency is required at the level of principle and intent, not identical technique. Neither quantitative nor qualitative methods are inherently required.

Question 40Risk management principles

A risk function measures its success by the number of risks on the register and the timeliness of updates. Which principle is most at risk of being neglected by this approach?

  1. Risk management is transparent, because register counts are inherently secret.
  2. Risk management is proportionate, because counting risks always overstates effort.
  3. Risk management informs decision-making, because activity metrics do not show whether risk work changes decisions or outcomes. Correct answer.
  4. Risk management is inclusive, because only the risk function can count.

Explanation

Counting risks and update timeliness are activity measures; they do not reveal whether risk information influences decisions or improves outcomes. Emphasizing them risks managing the register rather than supporting decisions, which is the purpose the principle describes. The other options misstate the principles or invent problems not implied by the scenario.

Question 41Risk management approach

In the M_o_R approach document, which component defines the sequence of activities used to implement risk management across the organization?

  1. The risk management policy
  2. The risk management process guide Correct answer.
  3. The risk appetite statement
  4. The risk register template

Explanation

The process guide describes the steps, inputs and outputs of the risk management process and how it is applied at each perspective. The policy sets direction and mandate rather than describing activity flow.

Question 42Risk management approach

An organization is drafting its risk management policy. Which content is most appropriate to include in that document?

  1. The timetable of health and safety inspections
  2. The detailed scoring scales for likelihood and impact
  3. The mandate for managing risk and the assignment of accountability Correct answer.
  4. The list of current risks with their owners

Explanation

A risk management policy establishes the mandate, principles and accountability for risk management across the organization. Detailed scales, live risk entries and operational schedules belong to other documents.

Question 43Risk management approach

Which statement best describes the purpose of the risk management approach document in M_o_R?

  1. It explains how risk management will be embedded and applied across the organization Correct answer.
  2. It records the outcome of each risk assessment carried out by projects
  3. It provides the audit trail of risk decisions taken by the board
  4. It authorizes expenditure for risk responses above a set threshold

Explanation

The approach describes how risk management is implemented, covering the process, the perspectives and the supporting techniques and roles. It is not a record of individual assessments or a financial authority.

Question 44Risk management approach

M_o_R describes risk management at several perspectives. Which list correctly identifies strategic, programme, project and operational as perspectives?

  1. They are the four types of risk response available
  2. They are the levels at which risk management is applied within the organization Correct answer.
  3. They are the four principles of the M_o_R framework
  4. They are the four phases of the risk management process

Explanation

In M_o_R the perspectives are the organizational levels at which risk management is applied, each with its own objectives and context. The process phases and response options are separate concepts.

Question 45Risk management approach

A programme manager needs guidance on how risk information flows between the programme and the strategic level. Which element of the approach should they consult?

  1. The description of how the perspectives interact and escalate risk information Correct answer.
  2. The risk appetite statement of the organization
  3. The list of risk techniques in the technique guide
  4. The health and safety policy

Explanation

The approach explains how risk information is aggregated and escalated between perspectives, which is exactly the integration question being asked. Appetite, techniques and separate policies do not describe these interfaces.

Question 46Risk management approach

Which pair of documents is most likely to sit within the M_o_R approach, alongside the policy and process guide?

  1. The project schedule and the resource plan
  2. The audit committee minutes and the training calendar
  3. The risk management strategy and the risk register structure Correct answer.
  4. The annual accounts and the marketing plan

Explanation

The approach comprises documents such as the policy, process guide, strategy and supporting structures including the register. Operational plans and financial statements belong to other management disciplines.

Question 47Risk management approach

An organization wants its risk management approach to reflect the principle of aligning risk management with objectives. Which action best demonstrates this?

  1. Requiring every risk to be logged in a single central spreadsheet
  2. Appointing a risk champion in each department
  3. Defining risk criteria that are derived from the organization's stated objectives Correct answer.
  4. Holding an annual risk workshop for all staff

Explanation

Alignment with objectives means risk management is directed by and measured against what the organization is trying to achieve, so criteria should derive from objectives. Logging, workshops and champions are supporting activities that do not by themselves demonstrate alignment.

Question 48Risk management approach

In the M_o_R approach, what is the main role of the risk management strategy?

  1. To record the results of internal audits
  2. To define the organization's accounting conventions
  3. To set out how risk management will be implemented in a specific part of the organization Correct answer.
  4. To list every risk currently faced by the organization

Explanation

The strategy translates the approach into a tailored plan for a particular perspective or area, describing how the process will be applied there. It is not a risk listing, an accounting document or an audit record.

Question 49Risk management approach

A newly appointed head of risk is reviewing whether the approach is embedded. Which evidence would best show that risk management is embedded rather than merely documented?

  1. The approach document has been approved by the board
  2. A risk software tool has been purchased
  3. Staff have attended a one-day risk awareness course
  4. Risk considerations routinely influence decisions recorded in management meetings Correct answer.

Explanation

Embedding is demonstrated when risk thinking changes actual decisions and behavior, not when documents exist or training has occurred. Approval, tools and training are enablers but not proof of embedding.

Question 50Risk management approach

Which statement correctly distinguishes the risk management process guide from the risk management policy?

  1. Both documents are records of assessed risks and their responses
  2. Both documents are issued only for individual projects
  3. The guide describes how the process works; the policy states the requirement to apply it Correct answer.
  4. The guide states the requirement; the policy describes how the process works

Explanation

The policy provides the mandate and principles, while the process guide explains the activities and their sequence. The two are complementary but have distinct purposes.