Question 1

Which of the following consists of risk management principles, framework, and process that have been adopted as a national risk management standard by more than 60 countries?

Accepted Answer

C

Explanation: ISO 31000:2018, titled "Risk management — Guidelines," is the international standard that provides the core principles, a comprehensive framework, and a structured process for managing risk. It is designed to be generic and applicable to any organization, regardless of its size, activity, or sector. Its fundamental and universal approach has led to its widespread adoption by numerous countries as their national standard for risk management, facilitating a common global language and methodology for handling uncertainty and achieving objectives.

Question 2

Which of the following is described in terms of consequence and likelihood?

Accepted Answer

A

Explanation: According to the ISO 31000:2018 standard, risk analysis is the process used to comprehend the nature of risk and to determine the level of risk. This determination is a function of combining the potential consequences of an event and the likelihood of those consequences occurring. The "level of risk" is the magnitude of a risk, expressed as this combination of consequence and likelihood. This output is then used in the risk evaluation step to make decisions about risk treatment.

Question 3

Relying on historic analysis when assessing potential risks and possible impacts implies that

Accepted Answer

C

Explanation: Relying on historic analysis for risk assessment is predicated on the principle of stationarity—the assumption that the underlying conditions and processes that generated past risks will remain stable. This implies a core belief that past events, their frequencies, and their impacts are a reasonable proxy for what will happen in the future. While ISO 31000 acknowledges historical data as a valid input for risk analysis, it also stresses the importance of considering the limitations and confidence in that information, as this core assumption may not hold true in dynamic environments.

Question 4

Which of the following are Critical Elements of a Risk Management Framework? (choose four)

Accepted Answer

B, C, D, E

Explanation: The critical elements of a risk management framework, as aligned with the principles and guidelines of ISO 31000:2018, follow a continuous lifecycle. This cycle involves: 1. Strategize (C): Defining the risk management policy and articulating commitment, which aligns with the 'Leadership and Commitment' and 'Design' clauses of the standard. 2. Design (B): Creating the structure of the framework, including defining roles, responsibilities, and processes. This is a core component explicitly named in the standard. 3. Implement (D): Putting the designed framework and its processes into practice throughout the organization. 4. Assure (E): Continuously monitoring, reviewing, and improving the framework's effectiveness, which combines the 'Evaluation' and 'Improvement' components of the ISO 31000 framework. These four elements represent a complete and logical sequence for establishing and maintaining an effective risk management framework.

Question 5

Which of the following statements does not apply to ISO 31000?

Accepted Answer

C

Explanation: ISO 31000 provides principles and generic guidelines for risk management; it is not a requirements standard. The foreword of the standard explicitly states, "This document is not intended for certification purposes." Unlike other management system standards such as ISO 9001 or ISO 27001, an organization cannot be certified as "ISO 31000 compliant." The standard's value lies in providing a universally applicable framework to integrate risk management into an organization's governance, strategy, and operations, rather than serving as a basis for audit and certification.

Question 6

ISO 31000 is intended to be a family of standards relating to risk management codified by the ________.

Accepted Answer

B

Explanation: The acronym "ISO" stands for the International Organization for Standardization. This organization is an independent, non-governmental international body that develops and publishes a wide range of proprietary, industrial, and commercial standards. The ISO 31000 family of standards, which provides principles and generic guidelines on risk management, is one such set of standards developed, maintained, and codified by this organization. Its purpose is to provide a universally recognized framework for managing risks that any organization can apply, regardless of its size, industry, or sector.

Question 7

Risk management theory that considers an organization-wide approach to risk management is known as what type of approach?

Accepted Answer

D

Explanation: A holistic approach to risk management considers the entire organization as a single, interconnected entity. This perspective, often operationalized through Enterprise Risk Management (ERM) frameworks like ISO 31000, moves away from managing risks in isolated departmental "silos." Instead, it promotes an integrated, organization-wide strategy where risks are identified, assessed, and managed in the context of the organization's overall objectives. This ensures that the interdependencies and aggregate effects of risks across all functions are understood and addressed, providing a complete and unified view of the organization's risk landscape.

Question 8

Using the FIRM scorecard which of the following risks could a risk manager quantify? 1. Loss of income. 2. Financial gain. 3. Reputational damage.

Accepted Answer

A

Explanation: Risk quantification involves assigning numerical, typically monetary, values to the potential impact of a risk. Within risk management frameworks, financial impacts are the most straightforward to quantify. "Loss of income" (a negative financial impact) and "financial gain" (a positive financial impact or opportunity) are both direct, tangible monetary figures that can be calculated or estimated with a relatively high degree of certainty. In contrast, "reputational damage" is an intangible risk. While its secondary effects (e.g., reduced sales) can be translated into financial terms, the primary impact is non-monetary and is notoriously difficult to quantify directly. Therefore, a risk scorecard focused on quantification would most readily handle loss of income and financial gain.

Question 9

A large manufacturing organisation has renewed an insurance policy and has accepted a significant increase in the policy deductible. What is this most likely to indicate?

Accepted Answer

D

Explanation: An insurance policy is a form of risk treatment, specifically risk sharing or transfer. The deductible is the portion of the loss that the insured entity agrees to pay out-of-pocket. By accepting a significant increase in this deductible, the manufacturing organization is consciously choosing to absorb a larger portion of the potential financial loss itself, rather than transferring it to the insurer. This is a direct application of the risk treatment option known as "risk retention." The increase in the deductible directly corresponds to an increased level of retained risk.

Question 10

The accuracy and reliability of the risk assessment should be identified as clearly as possible.

Accepted Answer

A

Explanation: The statement is true. According to the ISO 31000:2018 standard, a core principle of risk management is using the "best available information." This principle explicitly requires that the process takes into account any limitations and uncertainties associated with the information used. During the risk analysis phase, the availability and reliability of information are key factors that determine the complexity and detail of the analysis. Therefore, clearly identifying and communicating the accuracy and reliability of the risk assessment is essential for ensuring transparency and enabling informed decision-making based on the assessment's outputs.

Question 11

Risk management is tailored.

Accepted Answer

A

Explanation: The statement is true. According to ISO 31000:2018, one of the core principles of effective risk management is that it must be "customized." This is synonymous with being "tailored." The risk management framework and its processes should be adapted and proportionate to the organization's specific external and internal context, including its objectives, culture, and complexity. A generic, one-size-fits-all approach is explicitly discouraged by the standard, as it would fail to address the unique risks and opportunities an organization faces.

Question 12

The organization’s resources and internal support are ________ the risk management strategy.

Accepted Answer

B

Explanation: According to the ISO 31000:2018 standard, the design of the risk management framework requires a comprehensive understanding of the organization's internal context. This context explicitly includes available resources (e.g., capital, time, people, technology) and the degree of internal support and commitment from leadership. These factors are fundamental inputs that determine the scope, objectives, and feasibility of the risk management strategy. A strategy must be tailored to the organization's specific capabilities and culture to be practical and effective. Therefore, resources and support are considered foundational inputs during the development phase.

Question 13

The Chief Risk Officer chairs the ERM/RM steering committee.

Accepted Answer

A

Explanation: ISO 31000 assigns top management the duty to establish risk-governance roles and permits them to appoint a “champion, e.g., a chief risk officer” to lead the risk-management infrastructure (ISO 31000:2018, Annex A.2-g). Best-practice governance texts (e.g., Lam 2003; IRM “Structured Approach to ERM”) state that the CRO usually heads and chairs the enterprise-wide risk (ERM/RM) steering committee so that risk policy, methodology and reporting are coordinated under a single point of accountability. Therefore, the statement is true. Why Incorrect Option is Wrong: B. False – ISO 31000 and widely accepted ERM governance literature explicitly recognise the CRO as the normal chair of the organisation’s risk committee; marking “False” would contradict that guidance.

Question 14

Which of the following significant risks of reporting are outside the risk appetite of the organization and can impact compliance, which may also be reportable to regulatory agencies? (Choose two)

Accepted Answer

A, C

Explanation: Significant risks related to reporting and compliance are categorized based on their origin. Standard risk management frameworks, including the principles within ISO 31000, identify sources as being either internal or external to the organization. Internal risks to reporting arise from within the organization, such as inadequate internal controls, employee fraud, or system errors. External risks originate from outside, such as changes in regulatory requirements, new accounting standards, or economic instability impacting financial disclosures. Both categories can produce risks significant enough to fall outside an organization's risk appetite and trigger mandatory reporting to regulatory agencies.

Question 15

Enhanced risk management emphasizes the continual improvement of risk management capabilities.

Accepted Answer

A

Explanation: The statement is true. A core principle of the ISO 31000 standard is "Continual improvement." This principle mandates that an organization's risk management framework, processes, and overall capabilities should be dynamically improved through learning and experience. "Enhanced risk management" is the direct outcome of applying this principle. It signifies a mature approach where risk management evolves beyond a static process into a continuously refined capability that adds value and supports the achievement of organizational objectives. This iterative enhancement ensures that risk management remains relevant and effective in a changing environment.

Free GAQM ISO-31000-CLA Actual Exam Questions