I85PREP
⌘ K
ISO 31000 Lead Risk Manager study materials
ISO 31000 Lead Risk Manager study resources

ISO 31000 Lead Risk Manager practice questions

One question at a time. Build your ISO 31000 Lead Risk Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of risk management

In ISO 31000, what does the term 'risk' refer to?

  1. The total cost of realised losses
  2. The gap between planned and actual performance
  3. The probability that a project will fail
  4. The effect of uncertainty on objectives Correct answer.

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, where effects are deviations from what is expected and can be positive or negative. This definition deliberately avoids framing risk purely as the chance of harm, so both threats and opportunities fall within scope.

Question 2Fundamental principles and concepts of risk management

According to ISO 31000, which characteristic distinguishes risk management that is 'integrated'?

  1. It is embedded in all organisational activities and decision-making Correct answer.
  2. It is performed by a dedicated risk department
  3. It is reviewed only after incidents occur
  4. It is documented in a single corporate risk register

Explanation

Integration is one of the principles in ISO 31000 and means risk management is part of, not separate from, governance, strategy, planning and day-to-day operations. It is not an activity delegated to a specialist function.

Question 3Fundamental principles and concepts of risk management

Which statement best describes the relationship between ISO 31000 and ISO/IEC 31010?

  1. ISO 31000 mandates the techniques listed in ISO/IEC 31010
  2. ISO/IEC 31010 replaces the ISO 31000 framework for certain industries
  3. The two standards are unrelated and address different management systems
  4. ISO/IEC 31010 provides risk assessment techniques that support the ISO 31000 process Correct answer.

Explanation

ISO 31000 gives principles, a framework and a process, while ISO/IEC 31010 is a companion standard cataloguing risk assessment techniques used within that process. ISO 31000 does not require any specific technique.

Question 4Fundamental principles and concepts of risk management

A utility company states that it will not accept any risk that could cause a fatality, regardless of cost. In ISO 31000 terms, what has the company defined?

  1. Its risk criteria for unacceptable risk Correct answer.
  2. Its residual risk exposure
  3. Its risk appetite
  4. Its risk tolerance level for safety

Explanation

Risk criteria are the reference values against which significance of risk is evaluated, and a stated absolute limit such as 'no fatality risk' is a criterion defining unacceptable risk. Appetite and tolerance are related concepts, but the explicit decision rule is a criterion.

Question 5Fundamental principles and concepts of risk management

Which element belongs to the ISO 31000 risk management framework rather than to the risk management process?

  1. Risk identification
  2. Communication and consultation
  3. Leadership and commitment Correct answer.
  4. Risk analysis

Explanation

The framework components include leadership and commitment, integration, design, implementation, evaluation and improvement. Identification, analysis and communication are steps within the process that the framework supports.

Question 6Fundamental principles and concepts of risk management

In the ISO 31000 process, what is the primary purpose of establishing scope, context and criteria?

  1. To record the outcomes of previous risk reviews
  2. To allocate budget to the largest identified risks
  3. To define the boundaries and parameters within which risk is assessed and treated Correct answer.
  4. To decide which risks will be transferred to insurers

Explanation

This step sets the external and internal context, the scope of the exercise and the criteria against which risk will be evaluated. It precedes identification and analysis so that later steps have agreed boundaries and reference points.

Question 7Fundamental principles and concepts of risk management

An analyst estimates the likelihood and consequences of a supplier failure and combines them into a single severity rating. Which ISO 31000 process step is being performed?

  1. Risk analysis Correct answer.
  2. Risk identification
  3. Risk evaluation
  4. Risk treatment

Explanation

Risk analysis is the step that develops understanding of the nature, causes, likelihood and consequences of risk and may combine them into a level of risk. Evaluation then compares that result against criteria.

Question 8Fundamental principles and concepts of risk management

After analysis shows a risk falls within the organisation's risk criteria, what does ISO 31000 indicate about further treatment?

  1. Treatment may not be required, but the risk should still be monitored and reviewed Correct answer.
  2. Treatment is mandatory because all risks must be reduced
  3. The risk must be removed from the risk register
  4. The risk must be transferred to a third party

Explanation

Evaluation determines whether a risk is acceptable against criteria; if it is, treatment may be unnecessary, yet monitoring and review remain part of the process. The standard does not require reduction of every risk.

Question 9Fundamental principles and concepts of risk management

Which statement correctly reflects how ISO 31000 treats 'communication and consultation'?

  1. It replaces monitoring and review when resources are limited
  2. It is an iterative activity integrated into every step of the process Correct answer.
  3. It is a one-off activity at the start of the process
  4. It is performed only by external public relations staff

Explanation

Communication and consultation is a process element that runs throughout, informing stakeholders and gathering their views at each stage. It is explicitly iterative rather than a single upfront event.

Question 10Fundamental principles and concepts of risk management

What is the role of monitoring and review in the ISO 31000 process?

  1. It is performed once at project closure
  2. It provides assurance that the process is effective and that context and risks are changing Correct answer.
  3. It replaces risk evaluation when data are insufficient
  4. It applies only to financial risks

Explanation

Monitoring and review is a continuous element that assures the quality and effectiveness of the process and detects changes in context, risk and treatment performance. It does not substitute for evaluation and applies to all risk types.

Question 11Fundamental principles and concepts of risk management

A risk manager wants to record the outputs of the risk management process. According to ISO 31000, what does 'recording and reporting' primarily aim to do?

  1. Satisfy external auditors only
  2. Guarantee that no risk will be realised
  3. Communicate and document risk information to support decisions and accountability Correct answer.
  4. Replace the need for stakeholder consultation

Explanation

Recording and reporting is about capturing and communicating risk information across the organisation to support decision-making and accountability. It does not eliminate risk or substitute for consultation.

Question 12Fundamental principles and concepts of risk management

Which of the following best illustrates the ISO 31000 principle that risk management is 'customised'?

  1. Tailoring the risk framework to the organisation's external and internal context Correct answer.
  2. Using only quantitative assessment methods
  3. Applying an identical risk register template across every subsidiary
  4. Adopting the framework used by the largest competitor

Explanation

Customisation means the framework and process are proportionate to the organisation's context, objectives and complexity. Uniform templates or imitation of others conflict with this principle.

Question 13Fundamental principles and concepts of risk management

ISO 31000 emphasises that risk management should consider 'human and cultural factors'. Which practice best reflects this principle?

  1. Suppressing dissent to maintain consensus in workshops
  2. Treating risk culture as irrelevant to technical analysis
  3. Encouraging open reporting of near misses and rewarding early risk escalation Correct answer.
  4. Relying solely on automated controls to remove human judgement

Explanation

This principle recognises that human behaviour, culture and perceptions strongly influence risk, so open communication and psychological safety improve risk awareness. Suppressing dissent or ignoring culture undermines it.

Question 14Fundamental principles and concepts of risk management

Which pair of principles does ISO 31000 identify as supporting continual improvement of risk management?

  1. Dynamic and continual improvement Correct answer.
  2. Reactive and retrospective
  3. Centralised and confidential
  4. Mandatory and punitive

Explanation

The principles include that risk management is dynamic, iterative and responsive to change, and that it facilitates continual improvement of the organisation. These support ongoing adaptation rather than static compliance.

Question 15Fundamental principles and concepts of risk management

An organisation identifies a cyber risk, analyses it, evaluates it as exceeding criteria, and then selects additional controls. In ISO 31000 terms, what is the selected control called once implemented?

  1. A treatment measure Correct answer.
  2. A risk criterion
  3. A risk source
  4. A residual risk

Explanation

Treatment measures are the controls or actions chosen to modify risk. Once implemented, they may change the level of risk, with the remainder becoming residual risk.

Question 16Fundamental principles and concepts of risk management

A firm decides to enter a joint venture to share the exposure of a large infrastructure project. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk retention
  3. Risk removal of the source
  4. Risk sharing Correct answer.

Explanation

Sharing distributes risk with another party, for example through contracts, partnerships or joint ventures. Avoidance would mean not undertaking the activity at all.

Question 17Fundamental principles and concepts of risk management

Which statement about residual risk is consistent with ISO 31000?

  1. Residual risk is identified before any analysis occurs
  2. Residual risk can only be assessed by external auditors
  3. Residual risk is the level of risk remaining after treatment measures are applied Correct answer.
  4. Residual risk is always zero once controls are documented

Explanation

Residual risk is what remains after treatment, and it should be monitored and reviewed to confirm it meets criteria. Documented controls do not guarantee that risk is eliminated.

Question 18Fundamental principles and concepts of risk management

How does ISO 31000 describe the relationship between risk management and organisational objectives?

  1. Risk management supports the achievement of objectives and informs decision-making Correct answer.
  2. Risk management should be performed only during annual planning
  3. Risk management applies only to negative outcomes that threaten assets
  4. Risk management is a separate compliance activity unrelated to strategy

Explanation

Because risk is defined as the effect of uncertainty on objectives, risk management is directly tied to setting and achieving objectives and to decision-making. It is not a standalone compliance exercise.

Question 19Fundamental principles and concepts of risk management

In the ISO 31000 framework, what is the purpose of the 'evaluation' component of the framework (distinct from risk evaluation in the process)?

  1. To decide whether to accept or transfer a specific risk
  2. To calculate the financial value of each risk
  3. To compare individual risk levels against criteria
  4. To measure the performance and effectiveness of the risk management framework against its purpose Correct answer.

Explanation

Framework evaluation assesses how well the framework itself is performing, including its integration and effectiveness, to inform improvement. Comparing individual risks with criteria is the process step of risk evaluation.

Question 20Fundamental principles and concepts of risk management

A risk practitioner argues that because ISO 31000 is not a certifiable management system standard, an organisation cannot be audited against it. Which response is most accurate?

  1. Incorrect; although it provides guidelines rather than requirements, organisations can still assess alignment with its principles and framework Correct answer.
  2. Correct; only ISO 9001 can be used for auditing management practices
  3. Correct; ISO 31000 contains no requirements and therefore cannot inform any audit
  4. Incorrect; ISO 31000 mandates certification for all large organisations

Explanation

ISO 31000 provides guidelines, not requirements, and is not intended for certification, yet its principles, framework and process can still be used as a reference for self-assessment or audit of alignment. This differs from certifiable management system standards.

Question 21Fundamental principles and concepts of risk management

Which scenario best demonstrates the ISO 31000 principle of 'best available information'?

  1. Basing a decision on a single historical incident because it is memorable
  2. Ignoring expert opinion in favour of intuition alone
  3. Waiting for perfect data before assessing any risk
  4. Using historical data, expert judgement and stakeholder views while acknowledging data limitations Correct answer.

Explanation

The principle requires that inputs to risk management be based on the best available information from relevant sources, while recognising the limitations and uncertainty of that information. Perfect data are rarely available, so decisions must still proceed transparently.

Question 22Fundamental principles and concepts of risk management

An organisation defines separate risk criteria for its research portfolio (high appetite for innovation risk) and for patient safety (near-zero tolerance). What does this illustrate?

  1. That patient safety risks should be excluded from the risk process
  2. That risk criteria must be identical across all activities
  3. That appetite cannot be expressed in qualitative terms
  4. That risk criteria can vary by objective and context within one organisation Correct answer.

Explanation

Risk criteria are set in relation to objectives and context, so different activities can legitimately have different thresholds. This allows appetite to be expressed appropriately for innovation versus safety.

Question 23Fundamental principles and concepts of risk management

Which activity is part of establishing 'external context' in the ISO 31000 process?

  1. Analysing regulatory, market and stakeholder environments affecting objectives Correct answer.
  2. Selecting the software used for the risk register
  3. Defining internal audit reporting lines
  4. Reviewing the organisation's internal risk culture

Explanation

External context covers the environment in which the organisation operates, including legal, regulatory, market, social and stakeholder factors. Internal culture, tools and reporting lines belong to internal context.

Question 24Fundamental principles and concepts of risk management

A team lists a possible loss of key staff, describes its causes and potential consequences, but does not yet estimate likelihood. Which process step have they completed?

  1. Risk identification Correct answer.
  2. Risk analysis
  3. Risk evaluation
  4. Risk treatment

Explanation

Risk identification involves finding, recognising and describing risks, including their sources and potential consequences. Estimating likelihood and combining it with consequences belongs to risk analysis.

Question 25Fundamental principles and concepts of risk management

How does ISO 31000 position the relationship between risk management and decision-making?

  1. Risk management is embedded in decision-making at all levels Correct answer.
  2. Risk management applies only to strategic decisions
  3. Risk management replaces judgement with formulaic calculation
  4. Risk management informs decisions but is separate from them

Explanation

The standard states that risk management aids decision-making and is integrated into governance and all organisational processes. It supports rather than replaces human judgement and applies at every level.

Question 26Fundamental principles and concepts of risk management

According to ISO 31000, what is the essential nature of 'risk'?

  1. The effect of uncertainty on objectives, expressed as a combination of consequences and likelihood Correct answer.
  2. Any hazard that could cause physical harm to people or assets
  3. The probability that a planned project will fail to meet its schedule
  4. The financial loss an organisation records after an adverse event

Explanation

ISO 31000 defines risk as the effect of uncertainty on objectives, and notes that such an effect is a deviation from what is expected, positive or negative. Risk is characterised by reference to potential events and consequences, or a combination of these, and is often expressed in terms of a combination of the consequences of an event and the associated likelihood of occurrence.

Question 27Fundamental principles and concepts of risk management

ISO 31000 states that risk management is based on, and should be integrated with, which of the following?

  1. Insurance renewal cycles and claims history
  2. External audit findings and certification requirements
  3. The personal judgement of the most senior risk officer
  4. The organisation's governance and its strategic and operational planning Correct answer.

Explanation

A core principle of ISO 31000 is that risk management is an integral part of all organisational processes, not a stand-alone activity separate from the main activities of the organisation. It should be part of the governance, strategy and planning, management, reporting processes, policies, values and culture of the organisation.

Question 28Fundamental principles and concepts of risk management

In ISO 31000, which two terms describe the process of finding, recognising and describing risks?

  1. Risk identification Correct answer.
  2. Risk evaluation
  3. Risk treatment
  4. Risk analysis

Explanation

Risk identification is the process of finding, recognising and describing risks, and it involves identifying sources of risk, areas of impact, events and their causes and potential consequences. It is the first step of risk assessment, preceding analysis and evaluation.

Question 29Fundamental principles and concepts of risk management

An organisation states that it will accept risks up to a defined threshold, above which escalation to senior management is required. Which ISO 31000 concept does this statement primarily express?

  1. Risk appetite statement in a treatment plan
  2. Residual risk
  3. Risk criteria Correct answer.
  4. Risk aggregation

Explanation

Risk criteria are the terms of reference against which the significance of risk is evaluated, and they reflect the organisation's values, objectives and resources. Defining thresholds and escalation requirements is a classic expression of risk criteria established during scope, context and criteria.

Question 30Fundamental principles and concepts of risk management

A risk practitioner distinguishes between 'risk management' and 'managing risk' in an ISO 31000 discussion. Which distinction is correct?

  1. Risk management is an external audit function, while managing risk is an internal control function
  2. Risk management is the coordinated activities to direct and control the organisation with regard to risk, while managing risk refers to applying the process to specific risks Correct answer.
  3. Risk management refers to insurance purchasing, while managing risk refers to avoidance decisions
  4. Risk management applies only to strategic decisions, while managing risk applies only to operational hazards

Explanation

ISO 31000 treats risk management as the coordinated activities directed at controlling an organisation with regard to risk, encompassing the framework, principles and process. Managing risk is the narrower act of applying the risk management process, for example to a specific project, decision or risk.

Question 31Fundamental principles and concepts of risk management

A team identifies a risk, then examines its causes, sources, positive and negative consequences, and the likelihood of occurrence. Which step of the ISO 31000 risk assessment process are they performing?

  1. Risk analysis Correct answer.
  2. Risk identification
  3. Risk evaluation
  4. Risk treatment

Explanation

Risk analysis is the process to comprehend the nature of the risk and to determine the level of risk, and it provides the basis for risk evaluation and decisions about treatment. Considering causes, sources, consequences and likelihood is precisely the content of analysis once a risk has been identified.

Question 32Fundamental principles and concepts of risk management

Why does ISO 31000 place communication and consultation as a parallel activity running alongside every step of the risk management process?

  1. Because consultation is only needed at the identification stage to gather opinions
  2. Because relevant stakeholders must understand the basis for decisions and their own roles, and their views inform each step Correct answer.
  3. Because it replaces the need for monitoring and review once stakeholders are engaged
  4. Because regulators require written communication records before any risk may be treated

Explanation

Communication and consultation are intended to assist stakeholders in understanding risk, the basis for decisions and the reasons why particular actions are required, and to ensure that views and perceptions are considered at every stage. ISO 31000 therefore treats them as integral to each step rather than as a single event.

Question 33Fundamental principles and concepts of risk management

An organisation's risk register is updated only once a year, and new risks emerging between reviews go unnoticed. Which ISO 31000 principle is most directly violated?

  1. Risk management is dynamic, iterative and responsive to change Correct answer.
  2. Risk management is inclusive of stakeholders
  3. Risk management creates and protects value
  4. Risk management is best available information

Explanation

ISO 31000 expects risk management to anticipate, detect, acknowledge and respond to changes and events in an appropriate and timely manner. A static annual review fails to respond to changing internal and external context, so the dynamic and iterative principle is the one breached.

Question 34Fundamental principles and concepts of risk management

A programme manager asks how ISO 31000 structures risk treatment. Which description matches the standard?

  1. Transfer every risk to a contractor and remove it from the register
  2. Identify controls already in place and report residual risk without selecting new options
  3. Purchase insurance for all identified risks and record the premiums as the treatment plan
  4. Select treatment options, prepare and implement treatment plans, and assess whether residual risk is tolerable Correct answer.

Explanation

Risk treatment in ISO 31000 involves selecting options, determining and implementing the treatment, assessing the effectiveness of that treatment, and deciding whether residual risk is acceptable. Treatment plans specify how the chosen options will be implemented, including responsibilities and timing.

Question 35Fundamental principles and concepts of risk management

A risk owner is asked to explain the difference between risk analysis and risk evaluation. Which answer is consistent with ISO 31000?

  1. Analysis applies only to opportunities, while evaluation applies only to threats
  2. Analysis compares risk to criteria, while evaluation quantifies likelihood and consequences
  3. Analysis produces the treatment plan, while evaluation implements the controls
  4. Analysis determines the level of risk, while evaluation compares that level against criteria to decide whether action is needed Correct answer.

Explanation

Risk analysis develops an understanding of the risk and its level, considering causes, consequences and likelihood. Risk evaluation then uses those results to compare the risk against established criteria and decide whether further treatment is required.

Question 36Fundamental principles and concepts of risk management

In ISO 31000, what does the term 'risk owner' designate?

  1. The external auditor who verifies the risk assessment
  2. The insurer who indemnifies the organisation against the risk
  3. The staff member who first reported the risk to the register
  4. The person or entity with the accountability and authority to manage a risk Correct answer.

Explanation

A risk owner is defined as the person or entity with the accountability and authority to manage a risk. This accountability is central to the framework, because treatment and monitoring require a named party empowered to act.

Question 37Fundamental principles and concepts of risk management

An organisation decides to stop offering a particular product line because the associated risk exceeds its criteria and no treatment makes it acceptable. Which risk treatment option has been applied?

  1. Avoiding the risk Correct answer.
  2. Sharing the risk
  3. Accepting the risk
  4. Increasing the risk to pursue an opportunity

Explanation

Avoiding the risk means deciding not to start or continue with the activity that gives rise to the risk, which is appropriate when the risk exceeds criteria and cannot be treated to an acceptable level. Withdrawing the product line is a decision to exit the activity entirely.

Question 38Fundamental principles and concepts of risk management

A risk manager claims that because ISO 31000 is not a certifiable management system standard, an organisation cannot demonstrate conformity. Which response best reflects the standard?

  1. Organisations must be certified by an accredited body before claiming any alignment with ISO 31000
  2. Organisations may only reference ISO 31000 after adopting ISO 31000 as a national regulation
  3. Organisations can use ISO 31000 as a basis for benchmarking and self-assessment, and may state that their practices align with its principles Correct answer.
  4. Organisations cannot reference ISO 31000 at all unless they also implement ISO 9001

Explanation

ISO 31000 provides principles, a framework and a process and is intended for use by any organisation regardless of size, type or sector; it is not intended for certification purposes. Organisations can nonetheless use it for benchmarking, self-assessment and as a guide to developing their own risk management arrangements.

Question 39Fundamental principles and concepts of risk management

An analyst treats a supplier's financial failure as a single point estimate of 'high', ignoring the range of possible outcomes and the assumptions behind the estimate. Which aspect of effective risk analysis does this most undermine?

  1. Applying the correct risk treatment option before analysis is complete
  2. Ensuring communication with external stakeholders before analysis begins
  3. Accounting for uncertainty, the nature and extent of consequences, and the assumptions and limitations of the analysis Correct answer.
  4. Recording the risk in the register with a named owner

Explanation

ISO 31000 expects risk analysis to consider the causes and sources of risk, their positive and negative consequences, the likelihood of occurrence and the associated uncertainty. Analysis should also state the assumptions made and their limitations, so a single point estimate without those elements gives a misleading picture.

Question 40Fundamental principles and concepts of risk management

A board asks why ISO 31000 separates 'establishing context' from 'risk assessment'. Which rationale is most consistent with the standard?

  1. Context is a one-off documentation exercise that has no bearing on how risks are subsequently analysed
  2. Context replaces the need for risk identification because it lists all relevant risks
  3. Context defines the external and internal parameters and the criteria against which risks will later be evaluated, so it must be set before risks can be assessed meaningfully Correct answer.
  4. Context is only relevant to financial risks, while other risk types are assessed without criteria

Explanation

Establishing the context articulates the organisation's objectives and defines the external and internal parameters to be taken into account when managing risk, together with the scope and risk criteria for the remaining process. Without this, analysis and evaluation have no reference point for judging significance.

Question 41Establishment of the risk management framework

In ISO 31000, which element is primarily responsible for establishing the organization's risk management framework?

  1. Top management through leadership and commitment Correct answer.
  2. The external certification body
  3. Operational staff through informal consultation
  4. The internal audit function acting independently

Explanation

ISO 31000 assigns responsibility for establishing, integrating and maintaining the framework to top management, expressed through leadership and commitment. Leadership sets policy, allocates resources and assigns authority, which are prerequisites for the framework to function. Other parties support the framework but do not establish it.

Question 42Establishment of the risk management framework

A company drafts a risk management policy that does not state how risk criteria will be set. Which framework gap does this most directly create?

  1. The policy must be replaced by a risk register
  2. The policy lacks an essential element defining how significance is judged Correct answer.
  3. The policy must be approved by external stakeholders
  4. The policy is invalid because ISO 31000 requires a signed statement

Explanation

The risk management policy should articulate objectives, rationale and the approach to managing risk, including how risk criteria are determined and used. Without criteria, the organization cannot consistently judge which risks need treatment. The other requirements listed are not ISO 31000 obligations.

Question 43Establishment of the risk management framework

Which statement best describes how the risk management framework relates to the organization's overall governance?

  1. It is integrated into significant organizational processes and governance Correct answer.
  2. It replaces the organization's strategic planning cycle
  3. It applies only to projects with high financial exposure
  4. It is a standalone system operated only by the risk team

Explanation

ISO 31000 emphasizes that the framework is not a stand-alone system but is integrated into the organization's significant processes, including governance, strategy and planning. Integration helps risk management inform decisions rather than run in parallel. Isolation from governance is the failure mode the standard warns against.

Question 44Establishment of the risk management framework

An organization wants to demonstrate that its framework accounts for uncertainty in human behavior and culture. Which framework component most directly addresses this?

  1. An external audit schedule
  2. A document control procedure
  3. A financial hedging program
  4. Understanding the organization and its context Correct answer.

Explanation

Understanding the organization and its context includes internal factors such as culture, capabilities, governance and human behavior as well as external factors. This context analysis is what allows the framework to reflect uncertainty arising from people and culture. Hedging, document control and audit scheduling are narrower tools.

Question 45Establishment of the risk management framework

What is the primary purpose of the accountability and authority element within the risk management framework?

  1. To guarantee that no risk owner changes during a project
  2. To centralize all risk decisions in the risk function
  3. To ensure roles for managing risk are assigned and understood Correct answer.
  4. To remove the need for documented procedures

Explanation

The framework should establish accountability and authority for managing risk at relevant levels so that people know what they own and can act. Clear assignment supports decision-making and oversight. Centralizing all decisions or freezing ownership would undermine responsiveness.

Question 46Establishment of the risk management framework

Which activity is part of establishing the risk management framework rather than part of the risk assessment process itself?

  1. Identifying risks in a specific new product launch
  2. Evaluating whether a control reduces a specific risk
  3. Defining the organization's risk appetite and risk criteria Correct answer.
  4. Analyzing the likelihood of a supplier failure

Explanation

Establishing risk criteria, including appetite and tolerance, is a framework-level activity that shapes all subsequent assessments. Identifying, analyzing and evaluating particular risks are steps of the risk assessment process performed within that framework. This distinction separates the architecture from its application.

Question 47Establishment of the risk management framework

According to ISO 31000, what should happen to the risk management framework over time?

  1. It should be fixed once approved to preserve consistency
  2. It should be monitored and continually improved Correct answer.
  3. It should be rebuilt from scratch after each audit
  4. It should be updated only when regulations change

Explanation

The standard requires the framework to be monitored, reviewed and continually improved so it remains fit for purpose as the organization and its context change. A static framework loses relevance. Rebuilding after each audit or updating only for regulation is too narrow.

Question 48Establishment of the risk management framework

Which outcome indicates that the risk management framework has been effectively integrated into an organization?

  1. A separate risk management manual exists for each department
  2. Risk information routinely informs strategic and operational decisions Correct answer.
  3. Risk training is delivered once at induction only
  4. Risk registers are completed annually by the risk department

Explanation

Integration is demonstrated when risk information becomes an input to decisions at strategic and operational levels. Documentation and training support this but are not sufficient evidence by themselves. Fragmented manuals and one-off training suggest the framework is not embedded.

Question 49Establishment of the risk management framework

A multinational is designing its risk management framework. Its business units operate in very different regulatory environments. What does ISO 31000 suggest about the design of the framework?

  1. It should be identical across all units for consistency
  2. It should follow the regulatory regime of the head office only
  3. It should be tailored to the organization and its context, including external factors Correct answer.
  4. It should be delegated entirely to each unit without central guidance

Explanation

Framework design must be tailored to the organization's external and internal context, which includes legal and regulatory environments. A common core with appropriate adaptation is consistent with the standard. Uniformity without adaptation or uncoordinated delegation both weaken the framework.

Question 50Establishment of the risk management framework

An organization's risk policy states objectives but assigns no responsibility for maintaining the framework. Which framework element is missing?

  1. Accountability and authority for managing risk Correct answer.
  2. Communication and consultation planning
  3. Risk treatment options
  4. Monitoring and review of risks

Explanation

The framework must define accountability and authority, including who maintains and improves the framework itself. Stating objectives without assigning responsibility leaves the framework unowned. Treatment, communication and monitoring are processes that depend on this assignment.