Embedding and Reviewing Risk Management
What the exam tests
This domain tests how risk management becomes routine and how its performance is reviewed. You need to distinguish embedding (culture, capability, integration) from compliance activity, and to select review and maturity approaches that produce improvement.
Core rules
- Embedding means risk thinking is used in everyday decisions, not just in registers. Evidence includes leadership behaviour, clear accountability, risk-based decision papers, induction and training, integration with planning and performance management, and open challenge.
- Reviewing covers process performance, the quality of risk information, assurance findings, incidents, and changes in context. It should be planned, proportionate and owned.
- Use maturity assessment to establish current capability and target improvements; use health checks and independent assurance for evidence.
- Feed review outputs into the approach, training, reporting and escalation. Embedding is continuous, not a project phase.
- Measure quality and use, not just volumes: are risks owned, are responses delivered, are decisions changed?
Worked example
An organisation reports that 100% of projects have risk registers, so concludes risk management is embedded. A review finds registers are completed after meetings by coordinators, and no decision log references risk. Reasoning: completion is compliance, not embedding. The principles creates a supportive culture and makes informed decisions are not evidenced. Actions: require risk sections in decision papers, have sponsors challenge top risks, train actionees, and replace the completion metric with an audit of response delivery and escalation quality.
Traps
Equating training attendance or register completion with embedding; measuring only counts; treating review as an annual audit owned by the risk function; ignoring culture and incentives; and making improvements without rechecking their effect. In scenario questions, look for who uses the information and what changes as a result.