Risk Management Principles
What the exam tests
The principles domain checks whether you can recognise the eight M_o_R principles in a scenario, judge whether an organisation's risk arrangements are consistent with them, and explain the consequence of a breach. Principles are not process steps; they are enduring tests of good risk management that apply at every perspective.
The eight principles
- Aligns with objectives - risk activity is driven by the objectives it protects and exploits.
- Fits the context - proportionate to the organisation's size, complexity, sector and external environment.
- Engages stakeholders - involves those who affect or are affected by risk, including partners and assurance.
- Provides clear guidance - policy, process and roles are documented and usable.
- Creates a supportive culture - leaders reward openness and challenge, not silent compliance.
- Makes informed decisions - risk information is used in decisions, not merely recorded.
- Is dynamic - responds to change, with timely identification and review.
- Continually improves - performance is measured and lessons are applied.
Worked example
A programme holds a risk workshop only before each gate. Its register is completed by the PMO, and the board never sees it. The team claims it follows the process. Reasoning: the process exists, but creates a supportive culture fails because risk discussion is a compliance ritual; is dynamic fails because change is not reviewed between gates; makes informed decisions fails because the board does not use the information. The corrective action is not a new template but a leadership-owned review cadence and explicit risk input to gate decisions.
Traps
Treating the principles as sequential process steps; assuming one principle can be traded against another; applying them only to projects; and confusing a principle breach with a process-step omission. In the exam, name the principle and explain its effect on objectives.