CQP Advanced Level

Enterprise Risk Management flashcards

Read the question, say the answer to yourself, then turn the card to check. The first 10 of 51 cards are free; the rest come with the subject.

Card 1 of 51

Jump to a card

Complete Flashcard Reference

Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 41 come with the subject.

How does ISO 31000 define risk, and what do its three key words mean?

The effect of uncertainty on objectives. Effect: a deviation from the expected, which may be positive or negative. Uncertainty: a deficiency of information about an event, its consequence or its likelihood. Objectives: without a stated objective there is no risk, because there is nothing to deviate from.

Can an organisation be certified to ISO 31000?

No. ISO 31000 is guidance, not a requirements standard, and no accredited certification body issues certificates to it. An organisation may align its framework with it and say so. Certifiable risk-related standards cover particular risk types: ISO 22301 (business continuity), ISO/IEC 27001 (information security) and ISO 37301 (compliance).

What are the six elements of the ISO 31000 risk management process?

Communication and consultation, which runs throughout. Establishing scope, context and criteria. Risk assessment: identification, analysis and evaluation. Risk treatment. Monitoring and review, which runs continuously. Recording and reporting.

What is the expected loss formula, and what does each term mean in its credit risk form?

Expected loss = Probability of event x Exposure at risk x Loss given event. Probability of default; exposure at default, the amount outstanding when the event occurs; loss given default, the proportion not recovered after security and collection. Example: KES 2,000,000 x 5 per cent x 50 per cent = KES 50,000.

Who sits in each of the three lines of defence, and what does each line do?

First line: operational management and staff. They own and manage risk directly, operate the controls and stay accountable for the outcome. Second line: risk management, compliance and specialist functions such as safety, quality and information security. They set the framework, provide expertise, monitor and challenge. Third line: internal audit. It gives independent, objective assurance to the board on both other lines.

Why is compliance risk managed by demonstrable process rather than by outcome?

The consequence can follow from the breach alone, with no accident, loss or complaint. Regulators increasingly assess the adequacy of arrangements, not results. Compliance must be evidenced to a third party after the event, and the only evidence is the record, which is why record-keeping is the substance of compliance, not overhead.

What is psychological safety, and why does it matter to a risk framework?

The shared belief that one can raise a concern, admit an error or challenge a decision without adverse personal consequence. It is the single strongest determinant of whether a risk framework receives real information, rather than what people are willing to write down.

What does an ERM audit assess, and what must it not do?

It assesses whether the process by which risks are identified, assessed, treated, monitored and reported is designed adequately and operating effectively. It does not re-perform the risk assessment or substitute its own ratings: an auditor who does so has taken over a first-line responsibility and forfeited independence over it.

Name the five failure patterns that recur in ERM cases.

The known and unowned risk: on record, but nobody with authority accountable. The aggregation failure: acceptable exposures combining into an unacceptable one. The suppressed signal: information that never reached the decision-maker. Control decay: a control that degraded while the register still called it effective. The concentrated change: a major change whose operational risk was never assessed.

Why does emerging risk need separate treatment in a risk framework, and what is that treatment?

Assessment rates likelihood from history and consequence from experience. Emerging risks have neither, so they are rated low and drop out of a register sorted by score. Hold them in a separate part of the framework, assess them by scenario and judgement rather than data, and review them on a shorter, separate cycle.

Distinguish risk appetite, risk tolerance and risk capacity.