RISK-MANAGER Sample Questions & Answers

ISO 31000 advocates for assigning accountability and authority for risk management. A 'risk owner' is the person or entity with the accountability and authority to manage a risk. While the IT department manages cybersecurity controls, the consequences of a breach affect clinical operations, patient data privacy, and medical device functionality. Therefore, the owners of those business processes (e.g., Head of Clinical Services, Chief Medical Officer) are often better positioned as risk owners, with IT acting as a key partner in risk treatment.

Risk reduction involves taking actions to lessen the likelihood or consequences of a risk. Implementing MFA makes it harder for stolen credentials to be used, reducing the likelihood of a successful breach. Phishing training also reduces the likelihood of employees falling for attacks. Purchasing insurance is risk sharing/transfer, and accepting the risk is risk retention.

ISO 31000 emphasizes that the risk management framework and its components, including resource allocation, should be tailored to the organization's specific internal and external context. There is no prescribed percentage or amount. For a non-profit, this means focusing resources on the most significant risks to its objectives (e.g., funding stability, beneficiary welfare, reputation) in a cost-effective manner, rather than trying to match the spending of a different type of organization.

The 'Integrated' principle states that risk management is an integral part of all organizational activities, including decision-making, strategy, operations, and culture. The scenario describes a situation where risk management was treated as a separate, siloed activity ('technically robust processes') but was not integrated into the organization's incident response and communication structures. This lack of integration led to a systemic failure despite the management of individual technical risks.

ISO 31000 states that reporting should be tailored to different stakeholders. For the board, the primary purpose is not just to list risks, but to provide them with the necessary information to fulfill their governance and oversight responsibilities. This includes making strategic decisions, allocating resources, and gaining assurance that the organization's most significant risks are understood and managed in line with its objectives and risk appetite.

The 'Evaluation' component of the framework specifically involves assessing how well the risk management framework is achieving its objectives. This is a step beyond the day-to-day risk process. It requires periodically stepping back to ask: 'Is our framework, as a whole, fit for purpose? Is it supporting decision-making? Is it helping us achieve our organizational objectives?' This measurement then feeds into the 'Improvement' component.

ISO 31000 presents communication and consultation as a continuous activity that occurs throughout the entire risk management process. Starting it early is crucial because it helps to properly define the context by incorporating the knowledge, views, and perceptions of stakeholders. This leads to more comprehensive risk identification (e.g., the public may identify risks the engineers missed) and helps establish risk criteria (e.g., what level of noise disruption is 'acceptable') that are relevant and supported.

False. ISO 31000 recommends that the risk management policy should be a concise statement that articulates the organization's overall intention and direction for risk management. It sets the tone and demonstrates leadership commitment. The detailed procedures, methodologies, and tools are typically documented separately as part of the broader risk management process, not within the high-level policy statement itself.

A well-defined risk criterion provides a clear basis for evaluating the significance of a risk and for supporting decision-making. Option D is specific, measurable, and linked to clear consequences (consumer illness, Class I recall). It defines the level of acceptable risk ('unacceptable') and provides a clear principle for treatment (ALARP). The other options are too vague or absolute to be practically useful for decision-making.

The correct answers are B and D. Integration means risk management is not a separate activity but is part of how the organization operates. Making risk assessment a standard part of project approval (B) embeds risk-based thinking into decision-making. Including risk responsibilities in job descriptions and performance reviews (D) integrates risk management into the organization's governance and human resource structures, making it part of everyone's job. A separate department (A) encourages silos, and an annual workshop (C) is an event, not an integrated process.