Risk Management Principles

In Management of Risk (M_o_R), which of the following best defines a 'risk'?

• A An event that has already caused harm to the organisation
• B An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives ✓
• C A definite future cost that must be budgeted for
• D A weakness in a control that auditors have identified

Answer: M_o_R defines risk as an uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. The uncertainty and link to objectives are central to the definition.

M_o_R recognises that risk has two types of effect on objectives. What are they?

• A Strategic and operational
• B Threats and opportunities ✓
• C Internal and external
• D Financial and reputational

Answer: M_o_R treats risk as having both a downside (threats) and an upside (opportunities). Effective risk management seeks to minimise threats and maximise opportunities.

How many principles underpin the M_o_R framework?

• A Eight ✓
• B Twelve
• C Five
• D Seven

Answer: M_o_R is built on eight principles that inform and support all other elements of the framework. They are derived from corporate governance principles.

Which M_o_R principle states that risk management should reflect the specific situation, culture and objectives of the organisation rather than a one-size-fits-all approach?

• A Tailored to the organisation ✓
• B Provides clear guidance
• C Supports decision making
• D Aligns with objectives

Answer: The principle 'Tailored to the organisation' requires that risk management activities be customised to suit the organisation's external and internal context, ensuring relevance and value.

The M_o_R principle 'Aligns with objectives' primarily means that risk management should:

• A Be carried out only by the risk management team
• B Replace the organisation's strategic planning process
• C Identify and manage risks in relation to the organisation's objectives ✓
• D Focus exclusively on financial objectives

Answer: The 'Aligns with objectives' principle ensures that risks are identified and managed in the context of the organisation's objectives, so risk effort is directed where it matters.

In M_o_R, the principle 'Creates a supportive culture' is concerned mainly with:

• A Buying the most advanced risk software
• B Ensuring only senior managers discuss risk
• C Reducing the number of meetings about risk
• D Embedding risk awareness and openness so that risk management becomes part of how people work ✓

Answer: A supportive risk culture encourages openness, learning and shared ownership, so that managing risk is seen as everyone's responsibility rather than a separate compliance task.