I85PREP
⌘ K
MoR Practitioner study materials
MoR Practitioner study resources

MoR Practitioner practice questions

One question at a time. Build your MoR Practitioner understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Management of risk principles and concepts

In the MoR framework, what does a 'risk' fundamentally represent?

  1. A confirmed issue that has already affected the organisation
  2. A planned activity scheduled to reduce exposure
  3. A control gap identified during an internal audit
  4. An uncertain event that, if it occurs, will have an effect on objectives Correct answer.

Explanation

A risk is defined by the combination of the probability of an uncertain event and its consequence, and it only matters because it can affect the achievement of objectives. Confirmed issues and audit findings are not risks because their impact has already materialised or been identified as a control weakness.

Question 2Management of risk principles and concepts

Which statement best describes the relationship between 'risk' and 'uncertainty' in MoR principles?

  1. Risk arises from uncertainty about outcomes and their consequences Correct answer.
  2. Uncertainty is the same as risk and the terms are interchangeable
  3. Uncertainty is managed only after risks have materialised
  4. Risk exists only when uncertainty has been eliminated

Explanation

Risk is created by uncertainty about whether and how objectives will be met, combined with the potential consequences. Uncertainty is the source; risk is the exposure that uncertainty creates for objectives.

Question 3Management of risk principles and concepts

In MoR terminology, what is the key difference between a 'risk' and an 'issue'?

  1. A risk is owned by the board whereas an issue is owned by a project manager
  2. A risk is always financial whereas an issue is always operational
  3. A risk is a future uncertainty whereas an issue is a problem that has already arisen Correct answer.
  4. A risk is certain to occur whereas an issue may not

Explanation

A risk is an uncertain future event that may affect objectives, while an issue is a problem or event that has already occurred and needs to be managed. This timing and certainty distinction is central to how MoR separates proactive and reactive management.

Question 4Management of risk principles and concepts

What is the primary purpose of the 'risk management process' in MoR?

  1. To eliminate all risk from the organisation
  2. To transfer every risk to a third party
  3. To ensure risks are identified, assessed, and responded to in a consistent, repeatable way Correct answer.
  4. To document risks for audit purposes only

Explanation

The risk management process provides a structured, repeatable sequence of activities that ensures risks are identified, assessed, planned for, and monitored consistently. It supports informed decision-making rather than the elimination or wholesale transfer of risk.

Question 5Management of risk principles and concepts

In MoR, what does the 'risk appetite' of an organisation describe?

  1. The total number of risks recorded in the risk register
  2. The amount and type of risk an organisation is willing to accept in pursuit of its objectives Correct answer.
  3. The process used to calculate risk probabilities
  4. The maximum financial loss the organisation can survive

Explanation

Risk appetite expresses the amount and type of risk an organisation is prepared to accept or pursue in order to meet its objectives. It provides the boundary within which risk-taking decisions are made.

Question 6Management of risk principles and concepts

Which MoR principle emphasises that risk management should be embedded in normal business activities rather than performed as a separate exercise?

  1. Risk management is an integral part of all organisational processes Correct answer.
  2. Risk management creates value
  3. Risk management is transparent and inclusive
  4. Risk management is tailored

Explanation

The principle that risk management is an integral part of all organisational processes means it should be built into day-to-day decision-making and governance rather than run as a standalone activity. This ensures risk information informs real decisions.

Question 7Management of risk principles and concepts

What distinguishes 'inherent risk' from 'residual risk' in MoR terminology?

  1. Inherent risk applies only to projects whereas residual risk applies only to programmes
  2. Inherent risk is measured in money whereas residual risk is measured in time
  3. Inherent risk is the exposure before controls, while residual risk is the exposure remaining after controls Correct answer.
  4. Inherent risk is owned by the board whereas residual risk is owned by the risk manager

Explanation

Inherent risk is the level of exposure that exists before any controls or responses are applied, while residual risk is what remains once existing controls and planned responses are taken into account. Comparing the two shows how much protection controls actually provide.

Question 8Management of risk principles and concepts

Which of the following best describes a 'risk owner' in MoR?

  1. The person who first noticed the risk
  2. The person accountable for managing a specific risk and its response Correct answer.
  3. The external auditor who reviews the risk process
  4. The person who records the risk in the register

Explanation

A risk owner is the individual accountable for managing a particular risk, including ensuring appropriate responses are implemented and monitoring changes in exposure. Recording and noticing are contributing activities, not ownership.

Question 9Management of risk principles and concepts

An organisation is deciding whether to enter a new market. Under MoR, which statement best reflects how risk management supports this decision?

  1. Risk management replaces the need for strategic judgement
  2. Risk management should be applied only after the decision is made
  3. Risk management provides information on uncertainty so the decision can be taken with appropriate awareness Correct answer.
  4. Risk management should block any decision where uncertainty exists

Explanation

Risk management informs decision-making by clarifying the uncertainties and consequences associated with options, enabling informed risk-taking. It does not remove uncertainty or substitute for judgement; it makes the exposure visible to decision-makers.

Question 10Management of risk principles and concepts

A risk has a high likelihood and high impact. According to typical MoR assessment logic, what is the most appropriate immediate action?

  1. Remove it from the register because it cannot be controlled
  2. Record it and review it only at the next annual audit
  3. Prioritise the risk for treatment and assign an owner to plan a response Correct answer.
  4. Accept the risk without further action because it is unavoidable

Explanation

High likelihood combined with high impact places a risk in the highest priority band, so it should be actively treated and owned. Prioritisation ensures management attention and resources are directed where exposure is greatest.

Question 11Management of risk principles and concepts

Which of the following is a valid 'risk response' option in MoR?

  1. Plan, do, check, and act
  2. Avoid, reduce, transfer, and accept Correct answer.
  3. Identify, assess, record, and report
  4. Measure, monitor, control, and audit

Explanation

The standard risk response options are to avoid, reduce (mitigate), transfer, or accept the risk, sometimes with the addition of exploit or share for opportunities. The other lists describe process or management cycles rather than response choices.

Question 12Management of risk principles and concepts

An organisation buys an insurance policy to cover a specific operational risk. Which risk response has been applied?

  1. Reduction
  2. Avoidance
  3. Transfer Correct answer.
  4. Acceptance

Explanation

Insurance transfers the financial consequence of a risk to a third party, although the underlying risk may remain. Transfer shifts the impact, not necessarily the probability of the event occurring.

Question 13Management of risk principles and concepts

In MoR, what is the purpose of 'risk tolerance'?

  1. To identify who should record risks
  2. To describe the techniques used to quantify risk
  3. To define the frequency of risk reporting meetings
  4. To state the maximum level of risk the organisation is prepared to bear Correct answer.

Explanation

Risk tolerance defines the boundaries of how much risk, often expressed in measurable terms, the organisation is willing to bear for a given objective. It translates appetite into practical thresholds that guide decisions.

Question 14Management of risk principles and concepts

A risk register entry shows a risk with low likelihood but potentially catastrophic impact. Why might this still require active management?

  1. Because the severity of impact may exceed the organisation's tolerance even if probability is low Correct answer.
  2. Because low likelihood risks are always acceptable
  3. Because catastrophic risks never occur
  4. Because low likelihood means the risk can be ignored

Explanation

Impact severity matters independently of likelihood; a low-probability event with catastrophic consequences can breach tolerance and threaten viability. Such risks often need contingency planning even though they are unlikely.

Question 15Management of risk principles and concepts

Which statement best captures the MoR principle that 'risk management is transparent and inclusive'?

  1. Risk reporting is limited to regulatory filings
  2. Only senior managers may know about risks
  3. Risk information is shared with relevant stakeholders and their views are considered Correct answer.
  4. Risk decisions are made privately by the risk function

Explanation

Transparency and inclusivity mean relevant stakeholders are informed about risks and involved in identifying and managing them, improving the quality of decisions. It does not mean unrestricted disclosure, but appropriate engagement and visibility.

Question 16Management of risk principles and concepts

A project team identifies a risk, assesses it, and decides to take no action beyond monitoring because the exposure sits within appetite. Which response has been chosen?

  1. Accept Correct answer.
  2. Avoid
  3. Transfer
  4. Exploit

Explanation

Acceptance means the organisation chooses to retain the risk and monitor it, typically because the exposure is within tolerance or treatment would cost more than the benefit. Monitoring keeps the acceptance decision valid over time.

Question 17Management of risk principles and concepts

Why does MoR emphasise that risk management should be 'tailored' to the organisation?

  1. Because tailoring is only relevant to financial institutions
  2. Because tailoring removes the need for any framework
  3. Because tailoring guarantees risks will not occur
  4. Because a one-size-fits-all framework may not fit the organisation's context and objectives Correct answer.

Explanation

Tailoring ensures the risk framework reflects the organisation's size, sector, objectives, and culture so that it is proportionate and usable. A framework that ignores context risks becoming a compliance exercise disconnected from decisions.

Question 18Management of risk principles and concepts

What role does 'risk reporting' play in the MoR framework?

  1. It exists solely to satisfy external regulators
  2. It replaces the need for risk assessment
  3. It is only required at the end of a project
  4. It provides decision-makers with timely information on exposure and the effectiveness of responses Correct answer.

Explanation

Risk reporting communicates the current risk position, trends, and the effectiveness of responses to decision-makers so they can act. It depends on assessment rather than replacing it and is a continuous governance activity.

Question 19Management of risk principles and concepts

A risk manager wants to compare the relative significance of many risks across a programme. Which approach best supports prioritisation?

  1. Assessing each risk for likelihood and impact against agreed scales and plotting them on a matrix Correct answer.
  2. Counting the number of words in each risk description
  3. Listing risks alphabetically in the register
  4. Ranking risks by the date they were identified

Explanation

Assessing likelihood and impact against consistent scales allows risks to be compared and prioritised, often visualised on a probability-impact matrix. Consistent criteria make prioritisation defensible and repeatable.

Question 20Management of risk principles and concepts

In MoR, what is the relationship between risk appetite and risk capacity?

  1. Appetite is always larger than capacity
  2. Capacity applies only to financial risks
  3. They are identical concepts
  4. Capacity is the maximum risk the organisation could bear, while appetite is the amount it chooses to accept Correct answer.

Explanation

Risk capacity is the maximum level of risk the organisation is able to bear before it breaches viability or objectives, whereas appetite is the amount it is willing to accept within that capacity. Appetite should not exceed capacity.

Question 21Management of risk principles and concepts

An organisation identifies a risk but cannot reduce its likelihood or impact affordably. It decides to proceed while monitoring closely. Which combination of concepts best explains this decision?

  1. The risk has been avoided and closed
  2. The risk has been transferred to a supplier
  3. The risk has been eliminated through controls
  4. The risk is within tolerance and is being accepted with monitoring Correct answer.

Explanation

Proceeding while monitoring indicates the residual exposure is within tolerance and has been consciously accepted. Monitoring ensures the acceptance remains valid if circumstances change.

Question 22Management of risk principles and concepts

Why is the distinction between risk appetite and risk tolerance important when setting escalation thresholds?

  1. Because tolerance is set by external auditors and appetite by shareholders
  2. Because the two terms are interchangeable and have no practical distinction
  3. Because appetite is measured only in currency while tolerance is measured only in time
  4. Because tolerance translates appetite into measurable limits that trigger escalation when breached Correct answer.

Explanation

Tolerance operationalises appetite by defining measurable boundaries; when exposure approaches or breaches these, escalation is triggered. This makes governance actionable rather than aspirational.

Question 23Management of risk principles and concepts

A programme has a risk with high impact and moderate likelihood. Controls reduce likelihood but not impact. What does this tell management about residual risk?

  1. Residual impact remains high, so contingency planning may still be required Correct answer.
  2. Residual risk is eliminated because controls were applied
  3. Residual likelihood is now irrelevant
  4. The risk can be removed from the register

Explanation

Controls that only reduce likelihood leave the impact unchanged, so residual risk may still be significant and require contingency arrangements. Management must assess residual exposure on both dimensions, not assume controls solve the whole problem.

Question 24Management of risk principles and concepts

How does the MoR principle that 'risk management creates and protects value' justify investment in risk activities?

  1. By proving that risk management is free
  2. By showing that risk management reduces uncertainty and supports better outcomes relative to its cost Correct answer.
  3. By guaranteeing that no losses will occur
  4. By replacing the need for strategic planning

Explanation

The principle holds that effective risk management improves the quality of decisions and protects value, so its benefits should be weighed against its cost. It is an enabler of value creation, not a guarantee against loss.

Question 25Management of risk principles and concepts

Two business units assess the same shared risk differently because they use different likelihood scales. What is the most significant consequence for enterprise-level risk management?

  1. The risk should be deleted from both registers
  2. Aggregated reporting becomes unreliable and comparison across units is compromised Correct answer.
  3. The risk automatically becomes a transfer opportunity
  4. The risk owner is no longer accountable

Explanation

Inconsistent scales undermine aggregation and comparability, so enterprise reporting may misstate overall exposure. Common definitions and scales are needed for reliable consolidation across units.

Question 26Management of risk principles and concepts

In MoR, the set of principles describes what risk management should be like in order to achieve what?

  1. A benchmark for designing and evaluating risk management practice Correct answer.
  2. A set of statutory reporting requirements for listed companies
  3. A catalogue of specific risks that every organisation faces
  4. A list of mandatory documentation templates for each project

Explanation

The MoR principles describe the characteristics that good risk management should display, so they function as a benchmark against which an organisation can design, review and improve its own arrangements. They are deliberately principle-based rather than prescriptive, so they do not mandate templates, laws or a fixed risk list.

Question 27Management of risk principles and concepts

A risk practitioner is explaining why MoR is described as a 'framework' rather than a prescriptive standard. Which statement best captures that distinction?

  1. It supplies a flexible structure of principles, processes and techniques that organisations adapt to their own context Correct answer.
  2. It must be applied identically in every organisation that adopts it
  3. It replaces the need for professional judgement with fixed decision rules
  4. It only applies to organisations operating in regulated financial sectors

Explanation

A framework provides an adaptable structure of principles, processes and techniques that the organisation tailors to its own size, sector and objectives. It deliberately relies on professional judgement rather than imposing identical rules on all adopters.

Question 28Management of risk principles and concepts

In MoR terminology, what does an 'uncertainty' represent when compared with a 'risk'?

  1. A state of incomplete knowledge where outcomes, including possible events, are not fully known Correct answer.
  2. A certain future event whose impact has already been quantified
  3. A financial provision set aside for known liabilities
  4. A risk that has been fully mitigated and closed in the register

Explanation

Uncertainty refers to incomplete knowledge about outcomes, so the organisation may not even be able to enumerate the possible events. Risk is the uncertainty of outcome, whether positive opportunity or negative threat, on objectives; uncertainty is the broader condition of not knowing.

Question 29Management of risk principles and concepts

MoR treats risk as 'the uncertainty of outcome'. Which statement follows directly from that definition?

  1. Risk exists only once a financial loss has been incurred
  2. Risk must always be eliminated before objectives are pursued
  3. Only threats with negative consequences count as risks
  4. Risk can include potential opportunities as well as threats Correct answer.

Explanation

Because risk is defined as uncertainty of outcome, it covers both the possibility of loss (threat) and the possibility of gain (opportunity) relative to objectives. Managing risk therefore includes exploiting upside uncertainty, not only defending against downside.

Question 30Management of risk principles and concepts

Which statement best describes the MoR 'risk process' as a whole?

  1. A technique used solely to calculate insurance premiums
  2. A one-off exercise performed only at project initiation
  3. A sequential set of activities that is repeated as circumstances change Correct answer.
  4. A financial audit carried out annually by external accountants

Explanation

The risk process comprises activities such as identifying, assessing, planning responses and implementing them, and it is iterative rather than one-off. It is repeated as objectives, context and information change, so it is often described as a cycle.

Question 31Management of risk principles and concepts

In the MoR process, what is the primary purpose of the 'identify' step?

  1. To calculate the exact monetary value of each exposure
  2. To decide which risks will be accepted without any further action
  3. To assign a numeric score that ranks risks for the board
  4. To find, recognise and record sources of risk and uncertainty that could affect objectives Correct answer.

Explanation

Identification is about recognising and recording the sources of risk and uncertainty, together with the events and their causes and consequences, that could affect the achievement of objectives. Quantification and ranking belong to assessment, and response decisions come later in the process.

Question 32Management of risk principles and concepts

A team records a risk as 'loss of a key supplier could halt production'. In MoR terms, which part of the entry describes the 'event'?

  1. Loss of a key supplier Correct answer.
  2. Could halt
  3. Production
  4. Key supplier

Explanation

In MoR risk descriptions the event is the uncertain occurrence that may happen, here the loss of a key supplier. The consequence is the effect that follows, such as production being halted, so cause, event and effect should be distinguished in a well-formed description.

Question 33Management of risk principles and concepts

In MoR, which statement best explains why risk management is described as 'part of normal business activity'?

  1. It should be performed only when a serious incident has occurred
  2. It should be integrated into everyday decision-making and management processes Correct answer.
  3. It should be conducted by a separate risk department in isolation from operations
  4. It should be documented once and then left unchanged

Explanation

The principle that risk management is part of normal business activity means it is embedded in day-to-day management and decision-making rather than bolted on as a separate exercise. Line managers own and manage risk as part of their ordinary responsibilities.

Question 34Management of risk principles and concepts

A firm sets a single likelihood scale ranging from 'rare' to 'almost certain' and requires all business units to use it when recording risks. Which MoR principle does this primarily support?

  1. Risk management creates and protects value
  2. Risk management is transparent and inclusive
  3. Risk management is tailored
  4. Risk management is consistent Correct answer.

Explanation

A common scale applied across units supports consistency, so that assessments can be compared and aggregated meaningfully. Consistency does not require identical treatment of every risk; tailoring still applies to how the framework is implemented in each context.

Question 35Management of risk principles and concepts

An organisation's risk framework has grown so complex that project managers avoid using it. Which MoR principle is most directly being violated?

  1. Risk management is part of normal business activity
  2. Risk management is proportionate Correct answer.
  3. Risk management creates and protects value
  4. Risk management is transparent and inclusive

Explanation

Proportionality requires the effort and complexity of risk management to be commensurate with the level of risk and the value at stake. A framework so burdensome that staff avoid it is disproportionate to the risks it addresses.

Question 36Management of risk principles and concepts

In MoR, what is meant by the 'three lines of defence' model in relation to risk management?

  1. Three types of risk response: avoid, transfer and reduce
  2. Three levels of risk severity: low, medium and high
  3. Three layers of assurance: operational management, a risk oversight function, and independent audit Correct answer.
  4. Three sequential stages of the risk process: identify, assess, respond

Explanation

The three lines of defence describe assurance arrangements: operational management owns and manages risk, a risk or compliance function provides oversight and guidance, and internal audit provides independent assurance. This is distinct from the stages of the risk process or from risk response categories.

Question 37Management of risk principles and concepts

A risk practitioner wants to express a risk description so that it distinguishes cause, event and effect. Why does MoR recommend this structure?

  1. It makes the risk easier to assess and to design an effective response Correct answer.
  2. It guarantees that the risk will be eliminated
  3. It removes the need for a named risk owner
  4. It allows the risk to be excluded from the register

Explanation

Separating cause, event and effect clarifies what could happen and why, which supports consistent assessment and helps identify where a response will be most effective. For example, controls can target causes to reduce likelihood or target effects to reduce impact.

Question 38Management of risk principles and concepts

Which statement best distinguishes 'hazard' from 'risk' in MoR usage?

  1. A hazard is a source of potential harm, whereas risk combines the uncertainty of an event with its effect on objectives Correct answer.
  2. A hazard has already occurred, whereas risk is always in the future
  3. A hazard is always a financial exposure, whereas risk is always an operational one
  4. A hazard is measured in currency, whereas risk is measured in time

Explanation

A hazard is a source of potential harm or a situation with potential to cause loss, while risk is the uncertainty of outcome and its effect on objectives. Several risks can arise from a single hazard depending on events and consequences.

Question 39Management of risk principles and concepts

A manager argues that because a risk has been transferred to an insurer, it no longer needs to be monitored. How should a MoR practitioner respond?

  1. Explain that transfer changes who bears some consequences but residual exposure and obligations remain, so monitoring continues Correct answer.
  2. Agree, provided the premium has been paid in full
  3. Explain that transfer is not a recognised risk response in MoR
  4. Agree, because transfer removes the risk entirely from the organisation

Explanation

Transfer shifts some of the financial consequences to another party, but the organisation usually retains residual exposure, such as deductibles, uninsured elements and reputational effects. Monitoring and review therefore continue after transfer, and the risk remains in the register.

Question 40Management of risk principles and concepts

In MoR, what does 'risk criteria' mean when an organisation decides whether a risk is acceptable?

  1. The set of software tools used to record risks
  2. The benchmarks, thresholds and terms of reference used to evaluate the significance of a risk Correct answer.
  3. The schedule of insurance policies held by the organisation
  4. The list of employees authorised to sign contracts

Explanation

Risk criteria are the terms of reference against which the significance of a risk is evaluated, including thresholds, scales and tolerances derived from objectives and context. They provide the basis for judging whether a risk is acceptable or requires escalation.

Question 41Management of risk principles and concepts

A risk owner is asked to decide how a particular risk should be treated. Which combination of factors should most directly inform that decision?

  1. The length of the risk register and the number of risks recorded
  2. The assessed level of the risk, the organisation's appetite and the cost-effectiveness of the options Correct answer.
  3. The seniority of the person who first identified the risk
  4. The date on which the risk was added to the register

Explanation

Response decisions should be grounded in the assessed significance of the risk, whether it falls within appetite, and whether the cost of treatment is justified by the reduction achieved. These factors keep the response proportionate and aligned with objectives.

Question 42Management of risk principles and concepts

An organisation wants to use a workshop to identify risks by imagining how an objective could fail and working backwards to causes. Which MoR identification technique does this most closely resemble?

  1. An insurance premium calculation
  2. A structured 'pre-mortem' or reverse brainstorming session Correct answer.
  3. A compliance audit of statutory returns
  4. A statistical regression of historical loss data

Explanation

Techniques that assume an objective has failed and then work backwards to identify causes are forms of reverse brainstorming, often called a pre-mortem. They surface risks that forward-looking discussion may overlook by making failure feel concrete.

Question 43Management of risk principles and concepts

Which statement best describes the role of 'risk architecture' in MoR?

  1. The roles, responsibilities, reporting lines and structures that support risk management Correct answer.
  2. The mathematical formula used to score each risk
  3. The physical layout of the organisation's offices
  4. The set of external laws that apply to the organisation

Explanation

Risk architecture covers the organisational arrangements that make risk management work, including roles, responsibilities, committees, reporting lines and escalation routes. It is distinct from the risk process, the protocols and the strategies that also form part of the overall framework.

Question 44Management of risk principles and concepts

A board wants assurance that the risk information it receives is reliable. Which arrangement best supports that assurance under MoR?

  1. Defining common risk terminology, reporting standards and an escalation route, with independent review where appropriate Correct answer.
  2. Reporting only risks that have already materialised
  3. Allowing each business unit to report in a different format with no defined definitions
  4. Restricting risk reporting to the chief executive only

Explanation

Reliable risk information depends on agreed terminology, consistent reporting standards and clear escalation, supported by independent challenge or assurance. These arrangements allow the board to compare, aggregate and trust what it receives.

Question 45Management of risk principles and concepts

In MoR, how does 'risk management policy' differ from a 'risk management strategy'?

  1. The policy states the organisation's overall intent and commitment, while the strategy sets out how that intent will be achieved Correct answer.
  2. The policy applies only to projects, while the strategy applies only to operations
  3. The policy is confidential, while the strategy is always published externally
  4. The policy is reviewed daily, while the strategy is never reviewed

Explanation

The policy expresses the organisation's overall intent, commitment and expectations for risk management, while the strategy describes the approach, plans and resources by which that intent will be delivered. Both form part of the wider framework and should be aligned.

Question 46Management of risk principles and concepts

A team lists twenty risks but has not recorded the causes or the potential effects for any of them. What is the most significant consequence for later stages of the risk process?

  1. The risks will no longer require an owner
  2. The risk register will be rejected by the insurer
  3. The risks cannot be meaningfully assessed or matched to effective responses Correct answer.
  4. The risks will automatically be classified as opportunities

Explanation

Without causes and effects, the team cannot judge likelihood or impact reliably, nor identify where controls and responses would be most effective. Poorly described risks tend to produce weak assessment and generic, untargeted responses.

Question 47Management of risk principles and concepts

An organisation applies its full quantitative modelling approach to every minor administrative risk as well as to major strategic ones. Which MoR principle is being misapplied?

  1. Risk management is consistent
  2. Risk management is transparent and inclusive
  3. Risk management is proportionate Correct answer.
  4. Risk management is part of normal business activity

Explanation

Proportionality means the effort, sophistication and cost of risk management should match the significance of the risk and the value at stake. Applying heavy modelling to trivial risks consumes resources without adding commensurate insight.

Question 48Management of risk principles and concepts

A risk owner reports that a control thought to reduce likelihood has been operating less effectively than assumed. What is the correct implication for the risk record?

  1. The risk appetite should be lowered to match the new control performance
  2. The residual risk assessment should be revisited because the assumed control effectiveness is no longer valid Correct answer.
  3. The risk should be removed from the register until the control is restored
  4. The inherent risk should be reduced to reflect the weaker control

Explanation

Residual risk depends on the assumed effectiveness of controls, so if a control degrades, the residual assessment must be updated to reflect the greater exposure. Inherent risk is unaffected because it is assessed before controls are taken into account, and appetite is a separate organisational setting.

Question 49Management of risk principles and concepts

Two departments record the same supplier failure risk, one scoring it as high and the other as low, because one used a five-point scale and the other a three-point scale without conversion. What is the most appropriate MoR remedy?

  1. Ask each department to keep its own scale but report separately to the board
  2. Discard the lower score as an outlier
  3. Average the two scores to produce a single figure
  4. Adopt a common assessment methodology and defined scales with clear criteria for each level Correct answer.

Explanation

Comparable assessment requires a common methodology with defined scales and explicit criteria describing what each level means. Without this, scores cannot be aggregated or compared, and averaging or discarding values merely conceals the inconsistency.

Question 50Management of risk principles and concepts

A risk has been assessed as within appetite but sits close to the boundary, and a planned change to the business model could push it beyond tolerance. What is the most appropriate MoR treatment of this risk?

  1. Close the risk because it is currently within appetite
  2. Transfer it immediately to an insurer regardless of cost
  3. Monitor it closely and reassess against the planned change, escalating if it approaches the tolerance boundary Correct answer.
  4. Increase the organisation's risk appetite so the risk remains acceptable

Explanation

A risk near the boundary of tolerance requires active monitoring and reassessment when circumstances change, with escalation if it is likely to breach the limit. Closing it, transferring it regardless of cost, or adjusting appetite to fit the risk all undermine the discipline of the framework.