I85PREP
⌘ K
MoR Foundation study materials
MoR Foundation study resources

MoR Foundation practice questions

One question at a time. Build your MoR Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to risk management and the MoR framework

In Management of Risk (MoR), which statement best defines a 'risk'?

  1. A scheduled activity that must be completed before a gateway review
  2. A documented issue that has already happened and needs resolution
  3. A guaranteed cost overrun already recorded in the business case
  4. An uncertain event that, if it occurs, will have an effect on objectives Correct answer.

Explanation

MoR treats risk as an uncertain event that, if it occurs, affects the achievement of objectives. Because it is uncertain, it has not yet happened, which distinguishes it from an issue. The effect may be either a threat or an opportunity.

Question 2Introduction to risk management and the MoR framework

In MoR terminology, what is the difference between a 'risk' and an 'issue'?

  1. A risk is always negative; an issue is always positive
  2. A risk has already occurred; an issue may occur in future
  3. A risk may occur in future; an issue has already occurred Correct answer.
  4. A risk belongs to the programme; an issue belongs to the project

Explanation

MoR distinguishes risk as something that may happen in the future from an issue as something that has already happened and now requires management attention. Both can be threats or opportunities. The distinction drives whether you use the risk process or issue resolution.

Question 3Introduction to risk management and the MoR framework

Which pair correctly describes the two types of risk outcome recognised in MoR?

  1. Drivers and dependencies
  2. Threats and opportunities Correct answer.
  3. Strengths and weaknesses
  4. Hazards and incidents

Explanation

MoR explicitly recognises that uncertainty can produce either a threat (a negative effect on objectives) or an opportunity (a positive effect). Managing risk therefore includes exploiting opportunities as well as defending against threats. The other pairs come from unrelated analysis techniques.

Question 4Introduction to risk management and the MoR framework

What does the 'risk appetite' of an organisation express in MoR?

  1. The maximum financial loss that insurance will cover
  2. The total number of risks recorded in the risk register
  3. The amount and type of risk an organisation is willing to accept in pursuit of its objectives Correct answer.
  4. The frequency with which the risk register is reviewed

Explanation

Risk appetite describes the amount and type of risk an organisation is prepared to take on or retain while pursuing its objectives. It provides the benchmark against which exposures are judged as acceptable or excessive. It is a statement of willingness, not a count, an insurance limit or a review cycle.

Question 5Introduction to risk management and the MoR framework

Which statement describes the purpose of the MoR 'risk management framework'?

  1. It calculates the exact financial value of every identified risk
  2. It provides the structures, processes and roles that embed risk management into an organisation Correct answer.
  3. It guarantees that no risk will materialise during a project
  4. It replaces the need for governance boards and assurance reviews

Explanation

The framework supplies the principles, processes, roles and supporting structures that make risk management a routine part of how the organisation works. It is an enabling infrastructure rather than a guarantee or a calculation engine. Embedding it lets risk management become consistent and repeatable.

Question 6Introduction to risk management and the MoR framework

In MoR, what is meant by 'risk tolerance' or 'risk limits'?

  1. The list of risks that have been closed during the project
  2. The personal preference of the project manager for risk-taking
  3. The thresholds that define how much variation from objectives is acceptable Correct answer.
  4. The number of risk workshops held each year

Explanation

Tolerance or limits set the boundaries within which variation from objectives is acceptable, translating appetite into practical thresholds. They allow managers to judge when an exposure needs escalation. They are quantitative or qualitative boundaries, not personal preferences or activity counts.

Question 7Introduction to risk management and the MoR framework

A programme manager identifies that a supplier may deliver a component late, which would delay a key milestone. Using MoR concepts, how should this be classified and handled?

  1. As an assumption, because all suppliers are expected to deliver on time
  2. As a risk, because delivery delay is uncertain and would affect the milestone Correct answer.
  3. As a dependency, because it requires no further management action
  4. As an issue, because the supplier has already failed to deliver

Explanation

The delay is uncertain and, if it occurs, would affect an objective, so it meets the MoR definition of a risk. It should enter the risk process for assessment and response planning. An issue would only apply once the delay had actually occurred.

Question 8Introduction to risk management and the MoR framework

An organisation states that it will accept low-impact risks without escalation but must escalate any risk above a defined financial threshold. Which MoR concept does this illustrate?

  1. Risk transference
  2. Risk tolerance expressed as limits Correct answer.
  3. Risk aggregation
  4. Risk reporting frequency

Explanation

Defining thresholds above which risks must be escalated is a practical expression of risk tolerance as limits. It converts appetite into an operational rule that staff can apply consistently. Aggregation, transference and reporting frequency are different concepts.

Question 9Introduction to risk management and the MoR framework

Why does MoR emphasise that risk management should be 'proportionate'?

  1. Because proportionality removes the need for documented risk responses
  2. Because all risks must be treated with identical effort regardless of size
  3. Because effort spent on risk management should match the significance of the risk and the value at stake Correct answer.
  4. Because risk management should only be performed at board level

Explanation

Proportionality means the effort and rigour applied to a risk should reflect its potential impact and the value at stake. Spending as much on a trivial risk as on a critical one wastes resources. It does not mean uniform effort, board-only activity, or abandoning documentation.

Question 10Introduction to risk management and the MoR framework

What is the role of a 'risk owner' in MoR?

  1. The supplier who bears all financial consequences of the risk
  2. The person accountable for managing a specific risk and its response Correct answer.
  3. The auditor who independently verifies the risk register
  4. The person who first noticed the risk during a workshop

Explanation

A risk owner is the named individual accountable for managing a particular risk, including selecting and implementing the response. Ownership is about accountability, not about who spotted the risk. It is distinct from assurance and from contractual transfer.

Question 11Introduction to risk management and the MoR framework

In MoR, what distinguishes 'risk response' from 'risk monitoring'?

  1. Response is performed once; monitoring is performed only at closure
  2. Response decides and implements action; monitoring tracks changes in exposure over time Correct answer.
  3. Response identifies risks; monitoring records them in the register
  4. Response applies to opportunities; monitoring applies to threats

Explanation

Response is about deciding and carrying out actions to address a risk, while monitoring is the ongoing activity of tracking whether exposure is changing and whether responses are working. Monitoring continues throughout the lifecycle. Both apply to threats and opportunities alike.

Question 12Introduction to risk management and the MoR framework

A project team transfers the risk of equipment failure to a third party through a maintenance contract. What has the team primarily changed?

  1. The accountability for the risk within the organisation
  2. The organisation's overall risk appetite
  3. The likelihood that the equipment will fail
  4. The allocation of the financial consequence of the risk Correct answer.

Explanation

Transference shifts the financial or contractual consequence of a risk to another party, but it rarely changes the underlying likelihood. The organisation may still suffer operational impact, and accountability usually remains with the risk owner. Risk appetite is an organisational characteristic unaffected by a single contract.

Question 13Introduction to risk management and the MoR framework

Why does MoR treat risk management as an iterative process rather than a one-off activity?

  1. Because regulations require exactly one review per project phase
  2. Because the risk register must be recreated at every meeting
  3. Because risks change as circumstances change and new risks emerge over time Correct answer.
  4. Because iteration eliminates the need for a risk owner

Explanation

Contexts, objectives and exposures change continuously, so risks must be re-identified, reassessed and re-responded to throughout the lifecycle. Iteration keeps the risk picture current and relevant. It is not a regulatory count, does not require recreating the register, and does not remove ownership.

Question 14Introduction to risk management and the MoR framework

Which statement best captures the relationship between the MoR principles and the MoR processes?

  1. Processes replace principles once an organisation matures
  2. Principles describe the underlying values and behaviours; processes describe the steps that apply them Correct answer.
  3. Processes are optional; principles are mandatory
  4. Principles apply only to threats; processes apply only to opportunities

Explanation

Principles articulate the underlying values and behaviours that should guide risk management, while processes provide the structured steps through which those principles are applied. They are complementary: good processes without the principles become mechanical. Neither replaces the other as maturity grows.

Question 15Introduction to risk management and the MoR framework

During a review, a manager argues that because a risk has a low probability it can be removed from the register. Which MoR-based response is most appropriate?

  1. Agree, because low-probability risks are not real risks
  2. Agree, provided the risk owner also agrees to forget it
  3. Disagree, because probability alone does not determine whether a risk needs managing; impact and proximity also matter Correct answer.
  4. Disagree, because all risks must be reviewed by the board personally

Explanation

Risk significance depends on a combination of factors including probability, impact and proximity, so a low-probability risk with severe impact may still require active management. Removing it on probability alone would be unsound. Board-level review of every risk is neither practical nor required.

Question 16Introduction to risk management and the MoR framework

An organisation has a high risk appetite for innovation but a low appetite for regulatory breach. How should this shape risk management in MoR terms?

  1. All risks should be treated identically because appetite is organisation-wide
  2. Responses should be calibrated so innovation risks can be accepted while compliance risks are tightly controlled Correct answer.
  3. Compliance risks should be ignored because innovation is the priority
  4. The organisation should adopt a single numeric limit for every risk category

Explanation

Appetite can differ by category, so responses should be calibrated accordingly: accept more exposure where appetite is high and control tightly where it is low. This is the practical purpose of differentiated appetite statements. Uniform treatment or a single limit would misrepresent the organisation's actual willingness to bear risk.

Question 17Introduction to risk management and the MoR framework

A portfolio contains many individually small risks that share a common cause. Why does MoR highlight aggregation in such a case?

  1. Because aggregation removes the need to record individual risks
  2. Because aggregation converts threats into opportunities automatically
  3. Because aggregation guarantees that the common cause will not occur
  4. Because individually small risks can combine into a material exposure that warrants a coordinated response Correct answer.

Explanation

Aggregation recognises that a set of small, correlated risks can collectively represent a significant exposure that deserves coordinated management. It supplements, rather than replaces, the recording of individual risks. It neither changes polarity nor prevents the cause from occurring.

Question 18Introduction to risk management and the MoR framework

Why does MoR stress that risk management should be aligned with the organisation's objectives?

  1. Because objectives eliminate the need to identify risks
  2. Because alignment allows the risk register to be closed earlier
  3. Because objectives are always financial in nature
  4. Because risks are only meaningful in relation to the objectives they might affect Correct answer.

Explanation

A risk is defined by its potential effect on objectives, so without clear objectives there is no basis for judging whether an uncertainty matters. Alignment ensures effort focuses on what the organisation is trying to achieve. Objectives do not remove risk, shorten the register's life, or have to be purely financial.

Question 19Introduction to risk management and the MoR framework

Which statement describes how MoR views the culture needed for effective risk management?

  1. An open culture where bad news travels quickly and risk discussion is encouraged supports effective risk management Correct answer.
  2. Risk management works best when only senior managers discuss risk
  3. A culture that punishes anyone associated with a materialised risk is essential
  4. Culture is irrelevant because processes alone determine outcomes

Explanation

Effective risk management depends on an open culture in which people feel able to raise concerns and share bad news promptly. Hiding or delaying information undermines early response. Blame-oriented cultures suppress reporting, and processes alone cannot compensate for poor culture.

Question 20Introduction to risk management and the MoR framework

In MoR, why are 'early warning indicators' used?

  1. To replace the risk register once a risk is identified
  2. To calculate the exact date on which a risk will occur
  3. To confirm that a risk has been permanently eliminated
  4. To provide advance signals that a risk is becoming more likely or its impact is increasing Correct answer.

Explanation

Early warning indicators are monitored signals that give advance notice that a risk's probability or impact is changing, allowing timely response. They support proactive management rather than prediction of exact dates. They complement the register and do not prove permanent elimination.

Question 21Principles of risk management

In the MoR Foundation vocabulary, which statement best defines a risk?

  1. A guaranteed loss that has already been recorded in the accounts
  2. A planned activity that must be completed to deliver a product
  3. An uncertain event that, if it occurs, will have an effect on objectives Correct answer.
  4. A deviation from budget that is reported after the year end

Explanation

Risk is defined by uncertainty and effect on objectives: it may or may not happen, and its consequence can be positive or negative. Recorded losses and completed activities are facts, not uncertain future events.

Question 22Principles of risk management

An organisation states that it will not accept any risk that could cause injury to staff. What type of risk response does this represent?

  1. Treat
  2. Terminate Correct answer.
  3. Tolerate
  4. Transfer

Explanation

Terminate (avoid) means removing the activity or exposure that creates the risk so the risk no longer exists. Tolerate keeps the exposure, transfer moves the financial consequence, and treat reduces likelihood or impact but leaves the risk in place.

Question 23Principles of risk management

What does a risk appetite statement primarily describe?

  1. The maximum number of risks a register may hold
  2. The amount and type of risk an organisation is willing to seek or accept Correct answer.
  3. The list of risks that have already materialised during the year
  4. The insurance policies purchased to cover residual risk

Explanation

Risk appetite expresses the amount and type of risk an organisation is willing to pursue or retain in order to meet objectives. It is a forward-looking boundary, not a record of past events or a capacity limit on registers.

Question 24Principles of risk management

Which pairing of risk management principle to purpose is correct?

  1. Proportionate: risk processes are tailored to the level of risk and size of the organisation Correct answer.
  2. Comprehensive: only financial risks are recorded
  3. Systematic: risk is reviewed only when an auditor requests it
  4. Dynamic: the register is frozen once approved

Explanation

The principle of proportionality requires that risk management effort and formality match the significance of the risk and the context of the organisation. The other pairings describe practices that contradict the principles of being systematic, comprehensive and dynamic.

Question 25Principles of risk management

A team records a risk as 'supplier may fail to deliver components'. Which improvement best raises the quality of this risk description?

  1. Add a cause, the uncertain event and the effect on objectives Correct answer.
  2. Shorten it to a single word so it fits the register column
  3. Record it only after the supplier has already failed
  4. Replace it with the name of the supplier's account manager

Explanation

A well-formed risk statement links cause, uncertain event and consequence so that likelihood and impact can be assessed and responses designed. Naming people or waiting for failure provides no basis for analysis.

Question 26Principles of risk management

Which statement correctly distinguishes a risk from an issue?

  1. A risk is always financial; an issue is always operational
  2. A risk is owned by the board; an issue is owned by the project team
  3. A risk may occur in future; an issue has already occurred and needs managing now Correct answer.
  4. A risk has occurred and needs immediate resolution; an issue may occur in future

Explanation

The distinction is about certainty and timing: risk is uncertain and forward-looking, while an issue is a realised event or certain problem requiring current action. Ownership and risk type do not define the difference.

Question 27Principles of risk management

A project team scores a risk as high likelihood and low impact. Under a typical probability-impact matrix, what is the most defensible next action?

  1. Ignore it because impact is low
  2. Reclassify it as an issue to avoid scoring it
  3. Assess the combined rating and apply the response appropriate to that rating Correct answer.
  4. Escalate it automatically to the regulator

Explanation

A matrix combines likelihood and impact into an overall rating, and the response should follow that combined rating and the organisation's appetite. Neither dimension alone justifies ignoring or escalating a risk.

Question 28Principles of risk management

In a heat map used for risk reporting, what do the two axes normally represent?

  1. Likelihood and impact Correct answer.
  2. Owner and due date
  3. Cause and control
  4. Cost and duration

Explanation

A heat map plots risks by likelihood against impact so that clusters and outliers are visible at a glance. Cost, duration, owners and dates are attributes, not the standard axes.

Question 29Principles of risk management

An organisation buys insurance against fire damage to a warehouse. Which statement about this response is most accurate?

  1. It is a form of risk termination
  2. It removes the need to record the risk in the register
  3. It eliminates the risk of fire occurring
  4. It transfers some financial consequence while the physical risk remains Correct answer.

Explanation

Insurance transfers defined financial consequences to an insurer, but the event can still occur and operational disruption remains. The risk therefore stays on the register with a residual rating.

Question 30Principles of risk management

A risk register entry shows inherent rating high and residual rating low. What does this most likely indicate?

  1. Controls have been applied that reduce the risk to a lower level Correct answer.
  2. The initial assessment was recorded incorrectly
  3. The risk owner has changed department
  4. The risk has been deleted from the register

Explanation

Inherent rating reflects exposure before controls and residual rating reflects exposure after controls operate. A large drop therefore indicates effective controls, which should still be monitored for continued operation.

Question 31Principles of risk management

What is the main purpose of a risk owner in the MoR approach?

  1. To insure the organisation against all recorded risks
  2. To audit the risk register independently each quarter
  3. To hold accountability for managing a specific risk and its response Correct answer.
  4. To approve the organisation's overall risk appetite

Explanation

A risk owner is accountable for a particular risk, including ensuring the response is implemented and the risk is monitored and reported. Appetite setting and independent assurance sit at different levels.

Question 32Principles of risk management

A team lists forty risks, but three account for most of the potential impact. Which reporting approach best supports decision makers?

  1. Report the risks in alphabetical order of their titles
  2. Report all forty with equal prominence in a long appendix
  3. Report only the three largest and omit the rest permanently
  4. Prioritise the significant risks while retaining the full register for reference Correct answer.

Explanation

Effective risk reporting highlights the most significant exposures for decision makers while keeping the complete register available for completeness and audit. Hiding the remainder or treating all equally undermines both focus and transparency.

Question 33Principles of risk management

Which action best demonstrates the risk management principle of being dynamic?

  1. Reassessing risks when scope, environment or assumptions change Correct answer.
  2. Removing risks once their owner leaves the organisation
  3. Reviewing risks only at the annual audit
  4. Freezing the risk register at project initiation

Explanation

Being dynamic means risk management responds to change, so assessments are revisited when context, scope or assumptions shift. Static review cycles or deleting risks contradict this principle.

Question 34Principles of risk management

A risk has a low likelihood but a potentially catastrophic impact. Which assessment approach is most appropriate?

  1. Dismiss it because likelihood is low
  2. Assess it as high priority and consider contingency or transfer responses Correct answer.
  3. Wait for the first occurrence before recording it
  4. Average likelihood and impact to produce a middling score

Explanation

Low-likelihood, high-impact risks can be the most damaging and are often addressed through contingency planning, transfer or avoidance rather than simple averaging. Averaging can mask catastrophic tail exposure.

Question 35Principles of risk management

Which set of elements is normally found in a well-structured risk register entry?

  1. Supplier address, invoice number and payment terms
  2. Employee names, salaries and appraisal dates
  3. Marketing copy, brand colours and slogans
  4. Risk description, cause, effect, owner, assessment, response and status Correct answer.

Explanation

A register entry captures what could happen, why, the consequence, who is accountable, how it is rated, what is being done and its current status. Administrative or unrelated data does not support risk management decisions.

Question 36Principles of risk management

An organisation sets a quantitative appetite stating that it will accept no more than a stated maximum loss from a single operational failure. A new risk assessment shows the potential loss exceeds that limit. What does this most directly indicate?

  1. The risk should be reclassified as an opportunity
  2. The appetite statement must be ignored for this risk
  3. The risk sits outside appetite and requires an escalated response decision Correct answer.
  4. The assessment is automatically wrong

Explanation

Where assessed exposure exceeds the defined appetite, the risk is outside tolerance and must be escalated for a decision on treatment, transfer or termination. Appetite is the benchmark against which the assessment is judged.

Question 37Principles of risk management

Two risks each rate as medium, but they share the same supplier and would materialise together. Why does this matter for risk analysis?

  1. Shared suppliers always reduce total risk through economies of scale
  2. Correlated risks can aggregate into a larger combined exposure than individual ratings suggest Correct answer.
  3. Medium ratings cannot be aggregated under any method
  4. Correlation only matters for financial risks

Explanation

Individually moderate risks that are correlated can crystallise simultaneously, producing a combined impact greater than any single rating implies. Aggregation and dependency analysis are therefore needed alongside individual scoring.

Question 38Principles of risk management

A control is described as a 'key control'. What does this designation most properly mean?

  1. It is a control on which the achievement of an objective critically depends Correct answer.
  2. It is a control owned by the internal audit function
  3. It is a control that has never failed in testing
  4. It is the cheapest control available in the budget

Explanation

A key control is one whose failure would materially undermine the management of a significant risk or the achievement of an objective. Cost, historical test results and audit ownership do not define key status.

Question 39Principles of risk management

An organisation wants to pursue an opportunity but only within defined boundaries. Which combination best reflects this intent?

  1. An unlimited tolerance so that opportunities are never blocked
  2. A requirement that all opportunities be transferred to a third party
  3. A stated risk appetite with delegated authority limits for accepting risk Correct answer.
  4. A ban on recording opportunities in the risk register

Explanation

Pursuing upside within boundaries requires a declared appetite plus delegated limits that determine who may accept which level of risk. Unlimited tolerance removes control, while bans or mandatory transfer prevent opportunistic action.

Question 40Principles of risk management

A risk review finds that a mitigation has been in place for a year and the risk has not materialised. What is the most defensible conclusion?

  1. The risk no longer exists and should be deleted
  2. The mitigation may be effective, but the assessment should be reviewed and the residual rating confirmed Correct answer.
  3. The original assessment was certainly wrong
  4. Further monitoring is unnecessary because no incident occurred

Explanation

Absence of an incident is consistent with effective controls but is not proof, since the event may simply not have been triggered. The assessment and residual rating should be reviewed and monitoring continued.

Question 41Approach to risk management

In the MoR approach, risk is best defined as which of the following?

  1. A list of threats recorded in a corporate risk register
  2. Any event that has already caused a financial loss
  3. The effect of uncertainty on the achievement of objectives Correct answer.
  4. The process of buying insurance against operational failures

Explanation

MoR treats risk as the effect of uncertainty on objectives, so risk can be positive (opportunity) as well as negative (threat). This definition ties risk directly to objectives rather than to events or losses alone, which is why identifying objectives comes first.

Question 42Approach to risk management

Which statement best captures the MoR principle of proportionate risk management?

  1. All risks must be quantified in monetary terms before any response is chosen
  2. Every risk must be escalated to the board regardless of size
  3. Risk management should be applied only to projects above a fixed budget threshold
  4. Risk activity should be scaled to the level of risk and the effort justified by the benefit Correct answer.

Explanation

Proportionate risk management means the effort and formality applied to a risk should match its significance and the value of managing it. Over-engineering small risks wastes resources, while under-managing major ones exposes the organisation.

Question 43Approach to risk management

In MoR terminology, what is a 'risk appetite'?

  1. The schedule of risk reviews agreed with the audit committee
  2. The total number of risks an organisation can record in its register
  3. The amount and type of risk an organisation is willing to pursue or retain Correct answer.
  4. The maximum amount a single risk can cost before insurance responds

Explanation

Risk appetite expresses the amount and type of risk an organisation is willing to seek or accept in pursuit of its objectives. It differs from risk capacity, which is the maximum risk the organisation can actually bear. Appetite guides decisions about which risks to take and which to avoid.

Question 44Approach to risk management

A project team identifies a supplier failure as a risk, then decides to hold buffer stock and qualify a second supplier. Which MoR response type does this best illustrate?

  1. Take
  2. Transfer
  3. Reduce Correct answer.
  4. Tolerate

Explanation

Reducing (or mitigating) risk lowers the likelihood or impact of the risk occurring, which is what buffer stock and a second supplier achieve. Transfer would move the exposure to a third party, tolerate would mean accepting it unchanged, and take would mean pursuing the opportunity.

Question 45Approach to risk management

Which pair correctly distinguishes a risk from an issue in MoR?

  1. Both terms are interchangeable in MoR practice
  2. A risk may happen in future; an issue has already happened Correct answer.
  3. A risk applies only to projects; an issue applies only to programmes
  4. A risk has already happened; an issue may happen in future

Explanation

MoR separates future uncertainty from current reality: risks are uncertain future events, while issues are problems that have already materialised and need management now. Keeping the two distinct ensures the risk process is not clogged with problems requiring a different response route.

Question 46Approach to risk management

An organisation sets a tolerance for cost overrun on a programme. What does this tolerance represent in MoR terms?

  1. The level of risk exposure that can be accepted before escalation is triggered Correct answer.
  2. The predicted cost of implementing all planned risk responses
  3. The amount of contingency already spent in the current financial year
  4. The confidence interval used when estimating the programme budget

Explanation

Tolerances define the acceptable range of variation from objectives; breaching a tolerance triggers escalation to the next governance level. They are agreed in advance and link risk thresholds to accountability. Contingency and estimation methods are separate concepts.

Question 47Approach to risk management

Which of the following is the primary purpose of the 'identify risks' step in the MoR process?

  1. To recognise, describe and record uncertainties that could affect objectives Correct answer.
  2. To calculate the exact financial impact of each risk
  3. To assign an owner to every risk before assessment
  4. To approve the risk budget for the coming year

Explanation

Identification is about finding and articulating uncertainties that could affect objectives, then capturing them in a consistent way so they can be assessed. Quantifying impact and assigning owners come later in the process.

Question 48Approach to risk management

A risk is assessed as having high probability but low impact. Which approach does MoR most support for such a risk?

  1. Manage it at a local level with monitoring proportionate to its low impact Correct answer.
  2. Escalate immediately to the board as a critical risk
  3. Ignore it because the impact falls below the tolerance threshold
  4. Transfer it to a third party regardless of cost

Explanation

Proportionality means a high-probability, low-impact risk is usually best handled locally with light-touch monitoring. Escalation and costly transfer should be reserved for exposures that threaten objectives or exceed tolerances.

Question 49Approach to risk management

In MoR, what is the role of a risk owner?

  1. To audit the risk process across the whole organisation
  2. To maintain the central risk register on behalf of the board
  3. To hold accountability for managing a specific risk and its response Correct answer.
  4. To approve the organisation's overall risk appetite statement

Explanation

A risk owner is accountable for a particular risk, including selecting and implementing the response and monitoring changes. This assigns clear accountability so risks are actively managed rather than merely recorded.

Question 50Approach to risk management

Which statement best describes the MoR 'framework' concept?

  1. A template for writing the annual risk report
  2. A single software tool used to store risk data
  3. The list of legal regulations the organisation must comply with
  4. The set of principles, processes and structures that embed risk management in the organisation Correct answer.

Explanation

The MoR framework comprises the principles, approach, process and supporting structures that together embed risk management into how the organisation works. It is broader than any tool, template or compliance list, and it must be tailored to context.