Embedding & Reviewing

In M_o_R, what does it mean to 'embed' risk management within an organisation?

• A To store all risk documents in a single locked cabinet
• B To make risk management a natural, integral part of normal business activity and decision making ✓
• C To outsource risk management to an external firm
• D To carry out risk management only during annual audits

Answer: Embedding means integrating risk management into everyday processes, behaviours and decisions so it becomes a routine part of how the organisation works rather than a bolt-on activity.

Which of the following is a common barrier to successfully embedding risk management that M_o_R highlights?

• A Lack of senior management commitment and a blame culture ✓
• B Clear roles and responsibilities for risk
• C Regular, well-attended risk reviews
• D A supportive culture where staff openly discuss risk

Answer: Weak senior sponsorship and a blame culture discourage openness and ownership, undermining attempts to embed risk management; M_o_R stresses leadership and a supportive culture to overcome them.

Why does M_o_R place importance on 'reviewing' risk management as well as embedding it?

• A To remove the need for a Risk Register
• B To check that the approach remains effective, fit for purpose and continually improving ✓
• C To prove the framework never needs to change
• D To increase the volume of paperwork produced

Answer: Regular review confirms whether risk management is working as intended, identifies improvement opportunities and supports the 'continually improves' principle by feeding lessons back into the framework.

In M_o_R, what is a 'maturity model' typically used for when reviewing risk management?

• A To decide which employees should be promoted
• B To replace the Risk Management Policy
• C To calculate the exact financial value of each risk
• D To assess how well developed and capable the organisation's risk management is, and to plan improvement ✓

Answer: A risk maturity model assesses the current capability and consistency of risk management, providing a baseline to target improvements and track progress over time.

Which of the following best describes the role of leadership in embedding risk management, according to M_o_R?

• A Leaders delegate all responsibility and take no further interest
• B Leaders only become involved after a major loss occurs
• C Leaders should avoid discussing risk to prevent alarm
• D Leaders set the tone, sponsor the framework and model the desired risk behaviours ✓

Answer: Visible leadership commitment, sponsorship and role-modelling of good risk behaviours are critical to creating the supportive culture needed to embed risk management successfully.

In M_o_R, capturing and acting on 'lessons learned' from risk management activity primarily supports which principle?

• A Establishes clear governance
• B Achieves measurable value
• C Continually improves ✓
• D Tailored to the organisation

Answer: Recording lessons and feeding them back into the framework directly supports the 'Continually improves' principle, ensuring the organisation gets better at managing risk over time.