MoR Practitioner common mistakes
MoR Practitioner · Understand the traps and how to avoid them.
Treating the Management of Risk (M_o_R) principles as a numbered procedure that must be applied in a fixed sequence, and answering questions as if step 4 always follows step 3.
Candidates confuse the principles (which are enduring, universal, and applied according to context) with the processes (which are sequenced). The exam deliberately tests whether you understand that principles are not a checklist.
What to do instead
Learn the principles as statements of good practice that apply continuously and proportionally. When a question asks about sequencing, check whether it is about a process (identify, assess, plan, implement) rather than a principle. If the stem says 'must be applied in order', treat it as a distractor unless a process is named.
Selecting 'avoid the risk' as the answer whenever a risk is serious, without checking whether the activity is essential or whether the response is proportionate.
Avoidance feels safest, so candidates pick it reflexively. In practice, avoidance can mean losing a strategic opportunity or simply relocating the risk, and the exam rewards matching the response to the risk appetite and the objective.
What to do instead
Before choosing a response, ask three questions: does the response meet the stated risk appetite, is the activity essential to the objective, and does the response create a new risk? Eliminate 'avoid' when the stem says the activity is core to strategy or when residual risk after another response is already within tolerance.
Writing that risk management is 'done by the risk manager' or 'owned by the risk function', rather than by the person accountable for the activity.
Candidates import an organisational-chart view of risk. The exam tests the principle that risk management is everyone's responsibility, with ownership sitting with whoever is accountable for the outcome, and the risk function enabling rather than owning.
What to do instead
Anchor every ownership answer to the accountable role for the activity or objective, not to a central team. Remember the risk function's role is to set the framework, provide guidance, and challenge, not to accept risk on others' behalf.
Describing the risk management approach as a document to be written once, rather than as the organisation's overall way of doing risk management that must align with strategy, culture, and other management frameworks.
Candidates reduce 'approach' to 'policy document'. The exam distinguishes the approach (the organisation-wide intent and how it fits together) from individual policies, processes, and tools.
What to do instead
When a question mentions 'approach', check whether the answer addresses alignment with objectives and other frameworks, proportionality to the organisation, and how it will be communicated and embedded. Reject answers that only describe producing a document.
Confusing the risk management framework with the risk register or the risk process, and answering framework questions with process steps.
The terms overlap in everyday speech. Candidates who have only seen a register or a process diagram map 'framework' onto what they know, missing the structural elements of principles, approach, process, and embedding/review.
What to do instead
Memorise the four components and what each answers: principles (why and what good looks like), approach (how the organisation intends to do it), process (the steps applied to risks), and embedding and review (how it becomes business as usual and stays fit for purpose). Match the stem's wording to the component before reading the options.
Assuming a single framework design fits every part of the organisation, and rejecting answers that propose tailoring by business unit, project, or scale.
Candidates look for one 'correct' universal design. The exam expects proportionality, so a framework should be applied in a way that suits the level, size, and complexity of the activity.
What to do instead
Treat 'tailored', 'proportionate', and 'scaled to context' as signals of a correct answer unless the stem explicitly demands uniformity. Be ready to explain how the same framework can be applied differently at strategic, programme, project, and operational levels.
Skipping the 'communicate and consult' and 'monitor and review' activities when describing the risk process, and jumping straight from assessment to treatment.
These activities are often drawn as peripheral in diagrams, so candidates treat them as optional. The exam tests them as continuous activities that run alongside every step, not as a final stage.
What to do instead
When asked to describe the process, include communication and consultation as ongoing throughout, and monitoring and review as continuous, not a closing step. Link them to stakeholders and to changes in context so the answer shows why they are not optional.
Assessing likelihood and impact without first establishing the context, and treating the risk description as a single phrase such as 'risk of supplier failure'.
Candidates rush to scoring because it feels like the measurable part. The exam rewards establishing context (objectives, scope, stakeholders, criteria) and writing structured risk descriptions covering cause, event, and effect.
What to do instead
Always check whether the stem has given objectives and scope before asking for assessment. When writing or selecting a risk description, require a cause ('because...'), an uncertain event ('which may result in...'), and an effect on objectives ('leading to...'). Reject one-line labels as incomplete.
Confusing inherent, current, and residual risk, and reporting residual risk as if it were the risk before any controls.
The terms are used loosely in practice and candidates carry that looseness into the exam. Marks are lost where the stem specifies which measure is being asked for.
What to do instead
Fix the definitions: inherent is before controls, current is with controls in place today, residual is after planned additional treatment. Read the stem for the phrase 'after treatment' or 'with existing controls' and select accordingly; if the stem does not specify, state your assumption explicitly in a written answer.
Treating embedding as a one-off launch activity such as a training session or a policy sign-off, and omitting review of whether risk management remains fit for purpose.
Candidates equate embedding with communication. The exam expects sustained mechanisms: leadership behaviour, performance indicators, integration into decision-making and reporting, and periodic review that can change the framework.
What to do instead
For embedding questions, look for answers that combine visible leadership, integration with existing management and reporting cycles, capability building, and incentives. For review questions, look for triggers such as changes in strategy or context, assurance findings, and scheduled review, and for evidence that the framework is actually used in decisions.