I85PREP
⌘ K
PECB ISO 31000 Foundation study materials
PECB ISO 31000 Foundation study resources

PECB ISO 31000 Foundation practice questions

One question at a time. Build your PECB ISO 31000 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of risk management

In ISO 31000, risk is defined as the effect of uncertainty on objectives. What does this definition imply about the nature of risk?

  1. Risk is limited to the potential for financial loss recorded in accounting statements
  2. Risk is any event that has already occurred and produced a measurable deviation
  3. Risk is the probability that an activity will fail to meet a legal requirement only
  4. Risk is expressed as a combination of consequences and likelihood, with objectives as the reference point Correct answer.

Explanation

ISO 31000 frames risk as the effect of uncertainty on objectives, and that effect is characterised by reference to consequences and their likelihood. Because objectives provide the reference point, the same uncertainty can be a threat to one objective and an opportunity to another. This is why risk is described as having both negative and positive potential.

Question 2Fundamental principles and concepts of risk management

According to ISO 31000, which statement best describes the relationship between risk management and the organization's objectives?

  1. Risk management is a stand-alone compliance activity conducted separately from strategic planning
  2. Risk management is delegated exclusively to a dedicated risk function that owns all risk decisions
  3. Risk management is integrated into all organizational processes and informs decision-making at every level Correct answer.
  4. Risk management is an ancillary activity performed only after objectives have been achieved

Explanation

ISO 31000 positions risk management as integral to all organizational activities and to governance, not as a separate silo. It supports decision-making throughout the organization and is aligned with objectives and strategy. Integration into processes is one of the principles that makes risk management effective.

Question 3Fundamental principles and concepts of risk management

A risk practitioner argues that because ISO 31000 is not a certifiable management system standard, its principles cannot be used for assurance. Which response is most consistent with ISO 31000?

  1. Assurance requires adopting a certifiable standard, so ISO 31000 should be replaced entirely
  2. Assurance can only be provided by external auditors using quantitative risk models
  3. Assurance is impossible because the standard contains no requirements and therefore no criteria of any kind
  4. The principles can still support assurance by providing a benchmark against which an organization's risk management framework and processes are assessed Correct answer.

Explanation

ISO 31000 provides principles, a framework and a process that organizations can use as a reference for comparing and evaluating their risk management. Although it is not intended for certification, its content can still serve as criteria for self-assessment and assurance activities. The absence of certification does not remove its value as a benchmark.

Question 4Fundamental principles and concepts of risk management

Which statement reflects the ISO 31000 principle that risk management is tailored?

  1. The risk management framework and process are proportionate to the organization's external and internal context Correct answer.
  2. Tailoring means selecting only the risks that are convenient to manage
  3. The same risk framework must be applied identically by every organization in a sector
  4. Tailoring is achieved by copying the framework of a larger competitor

Explanation

Tailoring means aligning the risk management framework and process with the organization's context, objectives and complexity. The standard explicitly links the appropriateness of the framework to the organization's external and internal context. Copying another organization's approach does not achieve that alignment.

Question 5Fundamental principles and concepts of risk management

ISO 31000 states that risk management is based on the best available information. Which practice best demonstrates this principle?

  1. Relying on a single expert opinion because it is the fastest input available
  2. Deferring all risk decisions until information is complete and uncertainty has been eliminated
  3. Using only historical loss data and ignoring forward-looking information
  4. Considering the limitations of data and the potential for divergence among experts when making risk-informed decisions Correct answer.

Explanation

The principle recognises that information is based on historical and current data plus expectations for the future, and always carries limitations and associated uncertainty. Practitioners should therefore make explicit the assumptions and divergence of opinion behind their inputs. Waiting for perfect information is neither realistic nor required.

Question 6Fundamental principles and concepts of risk management

What does ISO 31000 identify as the primary purpose of risk management?

  1. Assigning blame when adverse events occur
  2. Eliminating all uncertainty from organizational activities
  3. Creating and protecting value Correct answer.
  4. Guaranteeing that no objective will be missed

Explanation

ISO 31000 states that the purpose of risk management is the creation and protection of value. It improves performance, encourages innovation and supports the achievement of objectives. Elimination of all uncertainty is neither achievable nor the stated aim.

Question 7Fundamental principles and concepts of risk management

A company adopts ISO 31000 and wants to demonstrate that its risk management is effective. According to the standard, what should the company do?

  1. Continually monitor and review the risk management framework and its processes Correct answer.
  2. Assume effectiveness once the framework document is published
  3. Obtain a certification certificate issued against ISO 31000
  4. Replace the framework whenever a new manager is appointed

Explanation

Effectiveness in ISO 31000 is supported through continual monitoring and review of the framework and processes, and by recording and reporting on risk management activities. Monitoring provides the evidence needed to judge whether the arrangements remain fit for purpose. Certification is not available against this standard.

Question 8Fundamental principles and concepts of risk management

Which element belongs to the ISO 31000 risk management process as a distinct step?

  1. Procurement planning
  2. Recording and reporting Correct answer.
  3. Employee recruitment
  4. Product design

Explanation

Recording and reporting is an explicit element of the ISO 31000 risk management process, alongside communication and consultation, scope and context, assessment, and treatment. It makes risk information available to decision-makers and stakeholders. Procurement, design and recruitment are organizational activities, not process steps of the standard.

Question 9Fundamental principles and concepts of risk management

During a risk assessment workshop, participants identify uncertainty but fail to establish what the organization is trying to achieve. Which ISO 31000 process element has been overlooked?

  1. Establishing the scope, context and criteria Correct answer.
  2. Risk treatment
  3. Monitoring and review
  4. Communication and consultation

Explanation

Establishing scope, context and criteria articulates the objectives of the risk management activity and defines the external and internal parameters to be considered. Without agreed objectives and criteria, the assessment has no reference point for evaluating significance. The other process elements depend on this foundation being set first.

Question 10Fundamental principles and concepts of risk management

In the ISO 31000 process, which activity follows risk analysis?

  1. Communication and consultation
  2. Risk treatment
  3. Risk evaluation Correct answer.
  4. Risk identification

Explanation

Within risk assessment, the sequence is risk identification, then risk analysis, then risk evaluation. Risk evaluation uses the results of analysis to decide whether treatment is required. Treatment follows only after evaluation has determined that action is needed.

Question 11Fundamental principles and concepts of risk management

An organization uses ISO 31000 to decide whether a proposed expansion should proceed. Which statement describes the role of risk evaluation in this decision?

  1. It implements selected controls and measures their residual effect
  2. It lists every conceivable uncertainty without judging significance
  3. It communicates results to external stakeholders only
  4. It compares analysis results against agreed criteria to determine whether treatment is needed Correct answer.

Explanation

Risk evaluation compares the outputs of risk analysis with the risk criteria established in the scope and context step. The purpose is to decide whether the level of risk is acceptable and whether treatment is required. It therefore directly supports go or no-go decisions.

Question 12Fundamental principles and concepts of risk management

According to ISO 31000, what is the purpose of communication and consultation in the risk management process?

  1. To satisfy public relations requirements after a crisis
  2. To transfer all responsibility for risk to external parties
  3. To replace the need for risk analysis with stakeholder voting
  4. To provide agreed, relevant and accurate information and to involve stakeholders in understanding risk Correct answer.

Explanation

Communication and consultation promotes awareness and understanding of risk and ensures that stakeholders' views are considered when criteria are defined and risks are assessed. It is a continuous activity that supports informed decisions rather than substituting for analysis. It also helps build trust and ownership of risk management.

Question 13Fundamental principles and concepts of risk management

A manager says that once a risk register is completed, the risk management process is finished. How does ISO 31000 describe the process?

  1. A linear sequence performed once per financial year
  2. A static document controlled only by the risk function
  3. A one-off project with a defined end date
  4. An iterative process that responds to changes in context and knowledge Correct answer.

Explanation

The ISO 31000 process is iterative and supports continual improvement, so it is repeated and adjusted as context, knowledge and objectives change. Monitoring and review are built in precisely to detect such changes. Treating the process as a one-off exercise contradicts this design.

Question 14Fundamental principles and concepts of risk management

Which of the following best illustrates the ISO 31000 principle that risk management takes human and cultural factors into account?

  1. Recognising that behaviour, perceptions and culture influence how risks are identified and managed Correct answer.
  2. Removing all human input from risk decisions to increase objectivity
  3. Assuming every employee interprets risk criteria in the same way
  4. Relying solely on automated models because human judgement is always biased

Explanation

The principle acknowledges that human behaviour, culture and perceptions contribute to uncertainty and shape how risk is managed. Effective risk management therefore considers capabilities, perceptions and the intentions of people inside and outside the organization. It does not mean removing human input.

Question 15Fundamental principles and concepts of risk management

Which pair of activities does ISO 31000 identify as supporting the risk management framework and requiring clear roles and responsibilities?

  1. Recruitment and payroll
  2. Auditing and tax filing
  3. Leadership and commitment, and implementation Correct answer.
  4. Sales and marketing

Explanation

The ISO 31000 framework includes leadership and commitment, integration, design, implementation, evaluation and improvement. Leadership and commitment, together with implementation, are framework elements that require defined roles, authority and accountability. The other pairs are organizational functions outside the framework.

Question 16Fundamental principles and concepts of risk management

An organization reviews its risk criteria after a major regulatory change. Which ISO 31000 concept explains why this review is appropriate?

  1. Criteria reflect the organization's values, objectives and context, which evolve over time Correct answer.
  2. Criteria are set by external regulators and cannot be adapted
  3. Criteria are fixed at the start of a project and should never change
  4. Criteria apply only to financial risks and must be revised annually

Explanation

Risk criteria are derived from the organization's objectives, values and external and internal context, all of which change. ISO 31000 therefore expects criteria to be reviewed and updated as part of monitoring and review. This keeps the assessment aligned with current circumstances.

Question 17Fundamental principles and concepts of risk management

In ISO 31000 terminology, what is a 'risk source'?

  1. An element which alone or in combination has the potential to give rise to risk Correct answer.
  2. The documented decision to accept a risk
  3. A person appointed to sign off the risk register
  4. The residual level of risk after controls

Explanation

A risk source is an element that, alone or in combination with others, has the intrinsic potential to give rise to risk. It may be tangible or intangible, such as a process, a market condition or a behaviour. Identifying sources helps structure risk identification.

Question 18Fundamental principles and concepts of risk management

A team records the outcome of a risk as 'loss of customer trust' and separately notes how likely it is to occur. Which two dimensions of risk is the team describing?

  1. Controls and residual risk
  2. Consequences and likelihood Correct answer.
  3. Opportunities and objectives
  4. Sources and indicators

Explanation

ISO 31000 characterises risk by reference to potential events and their consequences, together with the likelihood of occurrence. The description of the outcome is the consequence, and the estimate of how likely it is is the likelihood. Together they allow the level of risk to be expressed.

Question 19Fundamental principles and concepts of risk management

How does ISO 31000 distinguish risk management from risk assessment?

  1. Risk assessment includes treatment, while risk management excludes treatment
  2. Risk management is the overall coordinated activities to direct and control risk, while risk assessment is the identification, analysis and evaluation of risk Correct answer.
  3. The two terms are synonyms in ISO 31000
  4. Risk management applies only to strategic decisions, while risk assessment applies only to projects

Explanation

Risk management covers the coordinated activities that direct and control an organization with regard to risk, including framework, process and treatment. Risk assessment is the narrower process comprising identification, analysis and evaluation. Keeping the terms distinct prevents confusion between governance arrangements and analytical steps.

Question 20Fundamental principles and concepts of risk management

An organization wants its risk management to be dynamic. Which behaviour best reflects this ISO 31000 principle?

  1. Detecting and responding to changes in the external and internal context in a timely manner Correct answer.
  2. Freezing the risk register until the next annual audit
  3. Applying the same controls regardless of changes in circumstances
  4. Waiting for a loss event before updating the risk profile

Explanation

The principle that risk management is dynamic, iterative and responsive to change requires the organization to anticipate, detect and respond to changes in context and knowledge. This is supported by monitoring and review throughout the process. Static practices such as freezing the register undermine the principle.

Question 21Fundamental principles and concepts of risk management

Which statement correctly describes the relationship between the ISO 31000 framework and the risk management process?

  1. The framework provides the foundations and arrangements that support the process, which is applied within it Correct answer.
  2. The framework replaces the process once an organization is mature
  3. The framework and process are unrelated concepts with no interaction
  4. The process is applied only at board level while the framework operates at operational level

Explanation

The ISO 31000 framework consists of the arrangements, such as leadership, integration, design and improvement, that support risk management throughout the organization. The process, comprising scope, assessment, treatment and monitoring, is applied within that framework. The two are complementary rather than alternatives.

Question 22Fundamental principles and concepts of risk management

A risk owner is assigned in line with ISO 31000. What is the risk owner accountable for?

  1. Preparing meeting minutes for the risk committee
  2. Managing a particular risk, including implementing treatment and monitoring its status Correct answer.
  3. Approving the organization's annual financial statements
  4. Independently auditing the entire risk management framework

Explanation

ISO 31000 defines a risk owner as the person with the accountability and authority to manage a risk. That includes selecting and implementing treatment and monitoring the risk over time. The role is specific to a risk rather than to general governance or finance duties.

Question 23Fundamental principles and concepts of risk management

Within the ISO 31000 process, risk treatment involves selecting and implementing options. Which statement best describes how treatment options should be chosen?

  1. The first option proposed should always be adopted to save time
  2. Treatment options should be selected without considering cost or benefit
  3. Options should be evaluated and the preferred option selected based on the results of risk evaluation Correct answer.
  4. Treatment should always aim to eliminate the risk entirely

Explanation

Risk treatment follows evaluation, and the selection of options should consider the results of that evaluation along with the balance of potential benefit and cost. The chosen treatment is then planned and implemented, with residual risk assessed. Choosing the first option or ignoring cost is inconsistent with this approach.

Question 24Fundamental principles and concepts of risk management

Which statement about the principle of continual improvement in ISO 31000 is correct?

  1. Improvement is limited to correcting errors found by external auditors
  2. Improvement means replacing the framework with a new one each year
  3. Improvement applies only to the risk register format
  4. Improvement is a planned and ongoing activity that develops risk management maturity Correct answer.

Explanation

Continual improvement is a framework element in ISO 31000 and an ongoing activity that develops the organization's risk management over time. It draws on monitoring and review and on identifying opportunities to enhance the framework and process. It is not limited to audit findings or cosmetic document changes.

Question 25Fundamental principles and concepts of risk management

According to ISO 31000, what does 'establishing the context' include?

  1. The external and internal parameters relevant to the organization and to the scope of the risk management activity Correct answer.
  2. Only the financial budget available for risk treatment
  3. Only the legal jurisdiction in which the organization operates
  4. Only the internal culture of the organization

Explanation

Establishing the context considers the external and internal parameters relevant to the organization and to the specific scope of the risk management activity. This includes factors such as objectives, governance, stakeholders and environment. Considering only one dimension would give an incomplete picture.

Question 26Fundamental principles and concepts of risk management

In ISO 31000, what is the relationship between uncertainty and risk?

  1. Risk is the same as uncertainty, and the terms are used interchangeably in the standard.
  2. Risk is the effect of uncertainty on objectives, and uncertainty is a state of deficient information related to an event. Correct answer.
  3. Risk is the absence of uncertainty, and uncertainty is the presence of complete information.
  4. Risk is the probability of an event occurring, and uncertainty is the consequence of that event.

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, where uncertainty is the state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood. This definition links risk directly to objectives and clarifies that uncertainty is about information deficiency, not simply probability. The other options either confuse risk with probability or misstate the relationship.

Question 27Fundamental principles and concepts of risk management

According to ISO 31000, which statement best describes the purpose of risk management?

  1. To ensure compliance with legal and regulatory requirements only.
  2. To eliminate all risks so that objectives are guaranteed to be achieved.
  3. To create and protect value by improving performance and encouraging innovation. Correct answer.
  4. To transfer all risks to third parties through insurance.

Explanation

ISO 31000 states that risk management is about creating and protecting value; it supports the achievement of objectives and encourages innovation. It is not limited to compliance or insurance transfer, and it does not aim to eliminate all risk. The standard emphasizes value creation as the primary purpose.

Question 28Fundamental principles and concepts of risk management

Which ISO 31000 principle emphasizes that risk management is an integral part of all organizational processes?

  1. Risk management is structured and comprehensive.
  2. Risk management is customized.
  3. Risk management is dynamic, iterative, and responsive to change.
  4. Risk management is an integral part of all organizational processes. Correct answer.

Explanation

The principle 'risk management is an integral part of all organizational processes' states that risk management is not a stand-alone activity separate from the main activities and processes of the organization. It should be woven into governance, strategy, planning, and operations. The other options are separate principles.

Question 29Fundamental principles and concepts of risk management

What is the primary role of the risk management framework in ISO 31000?

  1. To prescribe specific risk treatment options for common risks.
  2. To assist organizations in integrating risk management into all significant activities and functions. Correct answer.
  3. To provide a step-by-step procedure for conducting risk assessments.
  4. To replace the need for a risk management process.

Explanation

The framework's purpose is to assist the organization in integrating risk management into its overall management system, including policies, objectives, and processes. It provides the foundations and arrangements for embedding risk management, not a prescriptive procedure. The process, not the framework, provides the steps for assessing and treating risk.

Question 30Fundamental principles and concepts of risk management

What is the role of leadership and commitment in the ISO 31000 framework?

  1. It is only required during the initial implementation of the framework.
  2. It is essential for the framework's effectiveness and should be demonstrated by top management. Correct answer.
  3. It is limited to approving the risk management policy.
  4. It is optional and can be delegated to the risk management function.

Explanation

ISO 31000 emphasizes that top management should ensure leadership and commitment, which is critical for the framework to be effective. Leadership involves integrating risk management into governance, strategy, and culture, and is not a one-time or purely delegated activity. It goes beyond just approving a policy.

Question 31Fundamental principles and concepts of risk management

Which statement best describes the principle 'risk management is transparent and inclusive'?

  1. Risk management should only include internal stakeholders, not external parties.
  2. Risk management should be limited to senior management to ensure control.
  3. Risk management should be kept confidential to avoid alarming stakeholders.
  4. Risk management should involve stakeholders and ensure timely and appropriate communication. Correct answer.

Explanation

The principle 'risk management is transparent and inclusive' means that appropriate and timely involvement of stakeholders and communication are essential. It ensures that stakeholders are aware of the risk management process and their roles, and that their views are considered. It does not mean keeping risk information secret or limiting participation.

Question 32Fundamental principles and concepts of risk management

In ISO 31000, what is the definition of 'risk criteria'?

  1. The amount and type of risk that an organization is willing to pursue or retain.
  2. Terms of reference against which the significance of risk is evaluated. Correct answer.
  3. The combination of the probability of an event and its consequence.
  4. The process of determining the level of risk.

Explanation

ISO 31000 defines risk criteria as the terms of reference against which the significance of risk is evaluated. They include factors such as likelihood, consequence, and risk appetite, and are used to decide whether a risk is acceptable or requires treatment. The other options define risk appetite, risk analysis, and risk respectively.

Question 33Fundamental principles and concepts of risk management

Which activity is part of 'establishing the context' in the ISO 31000 risk management process?

  1. Defining the external and internal parameters to be taken into account when managing risk. Correct answer.
  2. Monitoring and reviewing the risk management process.
  3. Selecting and implementing risk treatment options.
  4. Identifying, analyzing, and evaluating risks.

Explanation

Establishing the context involves defining the external and internal parameters to be taken into account when managing risk, and setting the scope and risk criteria for the remaining process. It is a distinct step from risk assessment (identification, analysis, evaluation) and treatment. Monitoring and review is a separate ongoing activity.

Question 34Fundamental principles and concepts of risk management

Which statement best reflects the ISO 31000 principle that risk management is dynamic, iterative, and responsive to change?

  1. Risk management is a one-time exercise conducted annually.
  2. Risk management should only be reviewed when a major incident occurs.
  3. Risk management should follow a fixed, unchanging procedure.
  4. Risk management should be updated as the organization's external and internal context changes. Correct answer.

Explanation

The principle 'risk management is dynamic, iterative, and responsive to change' means that risk management should be continuously updated as the organization's context changes. It is not a one-time or static exercise, and it should respond to changes in the external and internal environment. Regular monitoring and review are essential.

Question 35Fundamental principles and concepts of risk management

A risk manager argues that because ISO 31000 is not certifiable, the organization cannot demonstrate that its risk management aligns with the standard. How should this be addressed?

  1. The organization must use a certifiable standard instead, such as ISO 9001.
  2. The organization should seek certification against ISO 31000 from an accredited body.
  3. The organization cannot claim alignment with ISO 31000 without certification.
  4. The organization can demonstrate alignment through self-assessment, internal audits, and other forms of assurance. Correct answer.

Explanation

ISO 31000 provides guidelines, not requirements, and is therefore not intended for certification. However, organizations can still demonstrate alignment through self-assessment, internal audits, and other assurance activities. Certification is not available for ISO 31000, and alignment can be shown without it.

Question 36Fundamental principles and concepts of risk management

During a risk assessment, a team uses a matrix that combines likelihood and consequence to rank risks. Which ISO 31000 concept does this matrix primarily support?

  1. Monitoring and review
  2. Communication and consultation
  3. Risk treatment
  4. Risk analysis Correct answer.

Explanation

The likelihood-consequence matrix is a tool used in risk analysis to determine the level of risk by combining likelihood and consequence. It helps in understanding the nature of the risk and its magnitude. It is not a treatment, communication, or monitoring tool, although its outputs may inform those activities.

Question 37Fundamental principles and concepts of risk management

An organization's risk management policy states that risk management applies only to operational risks. Which ISO 31000 principle does this violate?

  1. Risk management is customized.
  2. Risk management is structured and comprehensive. Correct answer.
  3. Risk management is dynamic, iterative, and responsive to change.
  4. Risk management is transparent and inclusive.

Explanation

The principle 'risk management is structured and comprehensive' means that a structured and comprehensive approach to risk management contributes to consistent and comparable results. Limiting risk management to only operational risks is not comprehensive; it should cover all types of risks across the organization. Customization and transparency are separate principles.

Question 38Fundamental principles and concepts of risk management

A company wants to integrate risk management into its existing quality management system. According to ISO 31000, what is the best approach?

  1. Outsource risk management to a third-party specialist.
  2. Create a separate, standalone risk management system to avoid conflicts.
  3. Limit risk management to the quality department.
  4. Embed risk management into existing processes, such as quality planning and improvement. Correct answer.

Explanation

ISO 31000 emphasizes that risk management should be an integral part of all organizational processes. Integrating it into existing systems, such as quality management, ensures it becomes part of everyday activities rather than a separate silo. A standalone system or outsourcing would not achieve this integration.

Question 39Fundamental principles and concepts of risk management

Which statement correctly describes the relationship between risk appetite and risk criteria in ISO 31000?

  1. Risk appetite and risk criteria are identical concepts.
  2. Risk appetite is only relevant to financial risks, while risk criteria apply to all risks.
  3. Risk appetite is the amount and type of risk an organization is willing to pursue or retain, and it informs the setting of risk criteria. Correct answer.
  4. Risk criteria are the amount and type of risk an organization is willing to pursue, and they inform risk appetite.

Explanation

ISO 31000 defines risk appetite as the amount and type of risk that an organization is willing to pursue or retain. Risk criteria are the terms of reference against which the significance of risk is evaluated, and they are influenced by risk appetite. Thus, risk appetite informs the development of risk criteria, not the other way around.

Question 40Fundamental principles and concepts of risk management

In the ISO 31000 risk management process, what is the primary purpose of communication and consultation?

  1. To provide a one-way flow of information from management to employees.
  2. To assist stakeholders in understanding risk, its basis for decisions, and the reasons for actions required. Correct answer.
  3. To replace the need for monitoring and review.
  4. To ensure that all stakeholders have a complete understanding of every risk.

Explanation

ISO 31000 states that communication and consultation aims to assist stakeholders in understanding risk, the basis for decisions, and the reasons for actions required. It is a two-way process that involves dialogue with stakeholders, not just one-way information flow. It supports, but does not replace, monitoring and review.

Question 41Fundamental principles and concepts of risk management

A risk owner is assigned to a specific risk. According to ISO 31000, what is the risk owner accountable for?

  1. Conducting internal audits of the risk management process.
  2. Developing the risk management framework.
  3. Managing the risk and ensuring that risk treatment is effective. Correct answer.
  4. Approving the organization's risk appetite.

Explanation

ISO 31000 defines a risk owner as the person or entity with the accountability and authority to manage a risk. This includes ensuring that risk treatment is implemented and effective. Approving risk appetite, auditing, and developing the framework are typically responsibilities of top management or other functions, not the risk owner.

Question 42Fundamental principles and concepts of risk management

Which of the following best describes 'risk source' in ISO 31000?

  1. The process of determining the level of risk.
  2. The measure of the likelihood and consequence of a risk.
  3. The outcome of an event affecting objectives.
  4. An element which alone or in combination has the potential to give rise to risk. Correct answer.

Explanation

ISO 31000 defines a risk source as an element which alone or in combination has the potential to give rise to risk. It is the origin or cause of a risk, not the risk itself or its measurement. The other options describe consequence, risk level, and risk analysis.

Question 43Fundamental principles and concepts of risk management

In ISO 31000, what is the difference between 'risk management' and 'risk assessment'?

  1. Risk management is the overall process of managing risk, while risk assessment is a subset comprising identification, analysis, and evaluation. Correct answer.
  2. Risk management and risk assessment are synonymous terms in the standard.
  3. Risk management is a subset of risk assessment.
  4. Risk assessment is the overall process of managing risk, while risk management is a part of it.

Explanation

Risk management is the overall process of managing risk, encompassing establishing context, risk assessment, treatment, communication, monitoring, and review. Risk assessment is a subset of risk management that includes risk identification, risk analysis, and risk evaluation. They are not synonymous, and risk assessment is not the broader term.

Question 44Fundamental principles and concepts of risk management

An organization identifies a risk and decides to accept it without further action. According to ISO 31000, what should be done next?

  1. The risk should be ignored until it materializes.
  2. The risk should be monitored and reviewed to ensure it remains acceptable. Correct answer.
  3. The risk should be immediately transferred to a third party.
  4. The risk should be removed from the risk register.

Explanation

Even when a risk is accepted, ISO 31000 requires that it be monitored and reviewed to ensure that it remains within the organization's risk criteria and that the acceptance decision remains valid. Removing it from the register or ignoring it would violate the ongoing monitoring principle. Transfer is a separate treatment option that may or may not be appropriate.

Question 45Fundamental principles and concepts of risk management

Which statement best describes how ISO 31000 treats the human and cultural factors in risk management?

  1. Human and cultural factors are only relevant in the communication step.
  2. Human and cultural factors are irrelevant to risk management, which should be purely quantitative.
  3. Human and cultural factors should be considered because they influence how risks are perceived and managed. Correct answer.
  4. Human and cultural factors should be ignored to maintain objectivity.

Explanation

ISO 31000 recognizes that human and cultural factors significantly influence risk management at all levels. The principle 'risk management takes human and cultural factors into account' means these factors should be considered throughout the process, not ignored or limited to one step. A purely quantitative approach may miss important aspects.

Question 46Fundamental principles and concepts of risk management

In the ISO 31000 process, what is the primary purpose of monitoring and review?

  1. To evaluate the performance of risk owners only.
  2. To ensure that risk treatment is implemented and that the risk management process remains effective. Correct answer.
  3. To replace the need for communication and consultation.
  4. To identify new risks only.

Explanation

Monitoring and review in ISO 31000 is an ongoing activity that ensures risk treatment is implemented and effective, and that the risk management process remains relevant and appropriate. It also involves identifying new risks and changes in existing risks, but its primary purpose is broader than just identifying new risks or evaluating individuals. It does not replace communication and consultation.

Question 47Fundamental principles and concepts of risk management

A risk manager claims that because ISO 31000 is generic, it cannot be applied to a small business. How should this be evaluated?

  1. The claim is incorrect; ISO 31000 is intended to be applicable to all organizations, regardless of size, type, or sector. Correct answer.
  2. The claim is correct; ISO 31000 is designed only for large enterprises.
  3. The claim is correct; small businesses must use a different standard.
  4. The claim is incorrect only if the small business operates internationally.

Explanation

ISO 31000 is a generic standard that provides principles and guidelines for risk management applicable to any organization, regardless of size, type, or sector. Its principles are scalable and can be adapted to small businesses as well as large enterprises. No separate standard is required for small businesses.

Question 48Fundamental principles and concepts of risk management

Which statement best describes the ISO 31000 principle 'risk management is part of decision making'?

  1. Risk management should replace all decision making.
  2. Risk management is only relevant to strategic decisions.
  3. Risk management helps decision makers make informed choices, prioritize actions, and distinguish among alternative courses of action. Correct answer.
  4. Risk management should be conducted only after decisions are made.

Explanation

The principle 'risk management is part of decision making' means that risk management assists decision makers in making informed choices, prioritizing actions, and distinguishing among alternative courses of action. It is integrated into decision making at all levels, not conducted only after decisions or limited to strategic decisions. It does not replace decision making.

Question 49Fundamental principles and concepts of risk management

An organization wants to ensure its risk management is based on the best available information. Which ISO 31000 principle does this reflect?

  1. Risk management is customized.
  2. Risk management is based on the best available information. Correct answer.
  3. Risk management is transparent and inclusive.
  4. Risk management is dynamic, iterative, and responsive to change.

Explanation

The principle 'risk management is based on the best available information' states that the inputs to risk management should be based on historical data, experience, stakeholder feedback, observation, forecasts, and expert judgment. This principle emphasizes the importance of using reliable and relevant information. The other options are separate principles.

Question 50Fundamental principles and concepts of risk management

In ISO 31000, what is the relationship between the risk management framework and the risk management process?

  1. The framework and process are the same thing.
  2. The framework is used only for risk assessment, while the process is used for treatment.
  3. The process provides the foundations, while the framework describes the activities.
  4. The framework provides the foundations and arrangements, while the process describes the activities for managing risk. Correct answer.

Explanation

ISO 31000 distinguishes the framework as the set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management throughout the organization. The process is the systematic application of policies, procedures, and practices to the activities of communicating and consulting, establishing the context, and assessing, treating, monitoring, and reviewing risk. They are complementary but distinct.