ISO-31000-CLA ISO 31000 - Certified Lead Risk Manager Question and Answers

According to 1, page 15-16, external risks are “those arising from events outside the organization” and marketplace risks are “those arising from changes in market conditions such as customer demand, competition, regulation”. Economic changes in different countries can affect the market conditions for an international bank’s operations.

According to 3, a captive insurance company is “a wholly owned subsidiary insurer that provides risk mitigation services for its parent company or related entities”. It can act as a reinsurer by accepting risks from other insurers or captives 1. It can also access reinsurance markets to transfer some of its own risks 1. It can sometimes offer greater cover than is available in the insurance market by tailoring its policies to suit its parent’s needs 3. It does not have to be located in the same country as its parent company; in fact, many captives are domiciled offshore for tax or regulatory reasons 4.

According to 3, clause 6.5., monitoring and review “is intended as a feedback loop for checking whether any change has occurred either internally or externally that may affect performance against objectives”. It helps to ensure that the risk management process remains relevant and effective over time.

Monitoring and review is a critical part of risk assurance5. This step involves checking whether the risk management framework, policy, and plan are implemented, whether they remain suitable, and whether they need improvement.

According to ISO 31000:2018, a risk management framework consists of four critical elements: design (B), implement (D), evaluate (E) and improve (F)5. These elements guide an organization in integrating risk management into all functions and processes.

KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) are measured extensively throughout the organization and into the supply chain1. These indicators help to monitor and evaluate the performance and effectiveness of risk management.

Risk management is systematic, structured, and timely4. Systematic means that risk management follows a logical and consistent approach. Structured means that risk management has clear steps, roles, and responsibilities. Timely means that risk management provides information in time for decision making.

A pure risk only leads to the possibility of a loss, whereas a speculative risk may lead to a gain12. For example, entering into a contract to purchase a new factory is a speculative risk, as it could result in either profit or loss depending on market conditions.

According to , page 23, after validating the training curricula, a risk management professional schedules and conducts training sessions based on the target audience’s needs and availability.

Inclusiveness is another critical attribute of good risk management. Inclusiveness helps to ensure that different perspectives, knowledge, and values are considered in risk management.

 ISO uses the concept of uncertainty as the driver and rationale for risk management. Uncertainty refers to the state of having incomplete knowledge or understanding about something that can affect an organization’s objectives.

Treatment plan provides a roadmap on how the treatment options will be deployed3. Treatment plan helps to define the objectives, scope, responsibilities, resources, timeframe, and monitoring mechanisms for implementing risk treatment actions.