An organization is beginning to implement an enterprise risk management program. One of the first steps is to develop a common risk language. Which…

Question breakdown

Tests

Understand the purpose of a common risk language in ERM

Difficulty

Easy

Key idea: A common risk language makes sure risks are defined, described, and rated the same way across the organization, so assessments are consistent and comparable.

How to reach the answer

1. Ask what a shared vocabulary and taxonomy actually change.
2. A common risk language standardizes how risks are described and rated, so assessments from different units can be compared and combined.
3. It does not change inherent risk, the effectiveness of controls, or audit sample sizes.
4. The clue is consistency, which points to stakeholders getting more assurance that risks are assessed uniformly.

Each option

• AIncorrect. Inherent risk exists before any response, so understanding risk better through common terms does not lower it.
• BIncorrect. Shared terminology does not make controls more consistent or effective, so it gives no basis for smaller samples.
• CCorrect. Shared definitions and rating scales lead to consistent risk assessments across the organization, which gives stakeholders more assurance.
• DIncorrect. A common vocabulary improves communication but does not itself reduce the likelihood of missing or ineffective controls.

Common trap: Option A sounds reasonable because better understanding seems to lead to lower risk, but inherent risk is measured before responses and does not change with terminology.

In practice: When organizations build an ERM framework, they publish a risk taxonomy and standard likelihood and impact scales so business-unit risk registers can be combined into one enterprise view.

Remember: A common risk language delivers consistency and comparability in risk assessment, not a direct reduction in risk.

Drafted with AI assistance and checked against the answer key.