ISO-31000-CLA Practice Questions

ISO 31000:2018, titled "Risk management — Guidelines," is the international standard that provides the core principles, a comprehensive framework, and a structured process for managing risk. It is designed to be generic and applicable to any organization, regardless of its size, activity, or sector. Its fundamental and universal approach has led to its widespread adoption by numerous countries as their national standard for risk management, facilitating a common global language and methodology for handling uncertainty and achieving objectives.

A. ISO 9001:2015: This standard specifies requirements for a quality management system (QMS). While it incorporates risk-based thinking, its primary focus is on quality, not general risk management.

B. ISO 27001:2013: This standard is specific to information security management systems (ISMS), detailing requirements for managing information security risks, not organizational risks in general.

D. ISO 14001:2018: This standard outlines the requirements for an environmental management system (EMS). It addresses environmental risks but is not the overarching standard for enterprise-wide risk management.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section: Introduction, Paragraph 1: "This document provides guidelines on managing risk faced by organizations. The application of these guidelines can be customized to any organization and its context." This confirms its role as the guideline for risk management.

Section: 1 Scope, Paragraph 1: "This document provides guidelines on managing risk faced by organizations... It can be used by any organization, regardless of its size, activity or sector." This highlights its universal applicability.

2. International Organization for Standardization (ISO). (n.d.). ISO 31000 Risk management. ISO.org.

Webpage Content: The official ISO promotional page for the standard states, "ISO 31000 has also been adopted as a national standard in more than 70 countries." This directly supports the premise in the question.

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Abstract & Introduction: The paper discusses the role and diffusion of ISO 31000 as a global benchmark for risk management practices, underscoring its function as a foundational standard intended for wide adoption. (DOI: https://doi.org/10.1057/rm.2012.9)

According to the ISO 31000:2018 standard, risk analysis is the process used to comprehend the nature of risk and to determine the level of risk. This determination is a function of combining the potential consequences of an event and the likelihood of those consequences occurring. The "level of risk" is the magnitude of a risk, expressed as this combination of consequence and likelihood. This output is then used in the risk evaluation step to make decisions about risk treatment.

B. Level of crisis: A crisis is an event that has materialized; its level is described by its severity and impact, not the pre-event combination of likelihood and consequence.

C. Level of uncertainty: Uncertainty is a state of incomplete knowledge. Its level relates to the confidence in available information, not a combination of consequence and likelihood.

D. Level of cohesiveness: This term is unrelated to risk management, typically used in social psychology or materials science to describe how well things bond together.

1. ISO 31000:2018 - Risk management — Guidelines.

Clause 6.4.3 (Risk analysis): States, "Risk analysis involves a detailed consideration of uncertainties, risk sources, consequences, likelihood, events, scenarios, controls and their effectiveness... The level of risk is determined by combining consequences and their likelihood."

Clause 3.8 (Level of risk): Defines level of risk as the "magnitude of a risk or combination of risks, expressed in terms of the combination of consequences (3.6) and their likelihood (3.7)."

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886.

Page 884, Section "The Process": The article explains that the risk analysis step in the ISO 31000 process involves determining the consequences and their likelihood to establish a level of risk. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. University of Queensland, Courseware for RISK3001 - Risk Management.

Module 3: Risk Assessment: The course materials, based on ISO 31000, explicitly teach that risk analysis involves identifying consequences and likelihoods, and that the "level of risk is determined by combining these two factors." This is a foundational concept presented in the module.

Relying on historic analysis for risk assessment is predicated on the principle of stationarity—the assumption that the underlying conditions and processes that generated past risks will remain stable. This implies a core belief that past events, their frequencies, and their impacts are a reasonable proxy for what will happen in the future. While ISO 31000 acknowledges historical data as a valid input for risk analysis, it also stresses the importance of considering the limitations and confidence in that information, as this core assumption may not hold true in dynamic environments.

A. Historical models cannot guarantee accuracy for future events, as unforeseen factors or systemic changes can render past data irrelevant for predicting the impact of new adverse events.

B. This method inherently cannot account for novel or emerging risks ("black swans") that have no historical precedent, meaning not all significant risks can be confidently analyzed.

1. ISO 31000:2018, Risk management — Guidelines. Clause 6.4.3, "Risk analysis," states that the analysis should be based on the "best available information" and that "assumptions and limitations" of this information should be considered. This directly addresses the fact that relying on historical data is an assumption about its continued relevance to the future.

2. Aven, T. (2011). Quantitative Risk Assessment: The Scientific Platform. Cambridge University Press. In Chapter 2, Section 2.3, Aven discusses that probability-based risk assessments using historical data are founded on the assumption of a stable system where past frequencies are representative of future likelihoods.

3. MIT OpenCourseWare. (2016). 15.450 Analytics of Finance, Lecture 1: Introduction to Quantitative Finance. The course materials discuss the use of historical data for financial modeling, explicitly stating the key assumption is "stationarity," meaning the statistical properties (like mean and variance) of the data are constant over time. This is analogous to believing the future will behave like the past.

The critical elements of a risk management framework, as aligned with the principles and guidelines of ISO 31000:2018, follow a continuous lifecycle. This cycle involves:

1. Strategize (C): Defining the risk management policy and articulating commitment, which aligns with the 'Leadership and Commitment' and 'Design' clauses of the standard.

2. Design (B): Creating the structure of the framework, including defining roles, responsibilities, and processes. This is a core component explicitly named in the standard.

3. Implement (D): Putting the designed framework and its processes into practice throughout the organization.

4. Assure (E): Continuously monitoring, reviewing, and improving the framework's effectiveness, which combines the 'Evaluation' and 'Improvement' components of the ISO 31000 framework.

These four elements represent a complete and logical sequence for establishing and maintaining an effective risk management framework.

A. Architect the system: While related to design, "Design" is the specific term used in the ISO 31000:2018 standard (Clause 5.4), making "Architect" a less precise choice.

F. Organize the system: This is a specific activity within the "Design" phase (e.g., assigning roles) rather than a distinct, top-level critical element of the entire framework.

1. ISO 31000:2018, Risk management — Guidelines.

Clause 5.4, Design: This clause details the process of designing the framework, which includes understanding the organization, articulating policy (related to Strategize), assigning roles (related to Organize), and allocating resources. This supports (B) Design.

Clause 5.5, Implementation: This clause directly covers the implementation of the risk management framework. This supports (D) Implement.

Clause 5.6, Evaluation, and Clause 5.7, Improvement: These clauses cover monitoring, reviewing, and adapting the framework to ensure its continued suitability and effectiveness. These activities collectively provide assurance. This supports (E) Assure.

Clause 5.4.2, Articulating risk management policy: This sub-clause directly relates to setting the overall direction and intent, which is the essence of (C) Strategize.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x

This academic review discusses the structure of the ISO 31000 framework, emphasizing the cycle of "design, implementation, monitoring and review, and continual improvement of the framework" (p. 884). This directly supports the selection of Design, Implement, and Assure (as a combination of monitoring, review, and improvement). The strategic component is inherent in the initial design and policy-setting phase.

3. The University of Queensland. (2023). Enterprise Risk Management Framework.

Section 3, "UQ's Enterprise Risk Management Framework," states, "The University's ERM Framework is based on the international standard for risk management (AS/NZS ISO 31000:2018) and comprises the following key elements: ... Framework design, implementation, monitoring and review, and continual improvement." This university document explicitly lists the core lifecycle elements that align with the chosen answers.

ISO 31000 provides principles and generic guidelines for risk management; it is not a requirements standard. The foreword of the standard explicitly states, "This document is not intended for certification purposes." Unlike other management system standards such as ISO 9001 or ISO 27001, an organization cannot be certified as "ISO 31000 compliant." The standard's value lies in providing a universally applicable framework to integrate risk management into an organization's governance, strategy, and operations, rather than serving as a basis for audit and certification.

A. While other risk-related guides existed, ISO 31000 is widely recognized as the first comprehensive, generic international standard for the practice of risk management issued by ISO.

B. The introduction of the ISO 31000 standard clearly states that its principles and guidelines are applicable to any organization, regardless of its size, type, activities, or sector.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018, Risk management — Guidelines.

Foreword, Page iv: "This document is not intended for certification purposes." (Supports the correct answer C).

Introduction, Page v: "This document is applicable to all organizations, regardless of type, size, activities and location..." (Supports the reasoning for option B).

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x

Page 881: The article discusses the development of ISO 31000 as a new, overarching standard intended to harmonize the numerous existing risk management standards and models, reinforcing its position as a foundational, primary standard in its domain. (Supports the reasoning for option A).

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. https://doi.org/10.1057/rm.2012.9

Page 273: The paper notes that ISO 31000 is a "non-certifiable standard" and describes its purpose as providing "principles and generic guidelines on risk management," which can be "used by any public, private or community enterprise, association, group or individual." (Supports the correct answer C and the reasoning for option B).

The acronym "ISO" stands for the International Organization for Standardization. This organization is an independent, non-governmental international body that develops and publishes a wide range of proprietary, industrial, and commercial standards. The ISO 31000 family of standards, which provides principles and generic guidelines on risk management, is one such set of standards developed, maintained, and codified by this organization. Its purpose is to provide a universally recognized framework for managing risks that any organization can apply, regardless of its size, industry, or sector.

A. OpenDocument is an open standard for electronic document file formats, such as for spreadsheets and word processing documents, not a standards-codifying body for risk management.

C. OpenSource refers to a software development model that encourages open collaboration and making source code publicly available. It is not an organization that creates standards.

D. GlobalDocument is not a recognized international standards organization and appears to be a distractor term. The correct body is the International Organization for Standardization.

1. International Organization for Standardization. (2018). ISO 31000:2018(en) Risk management — Guidelines. ISO.org. Retrieved from https://www.iso.org/obp/ui/#iso:std:iso:31000:ed-2:v1:en. The official page for the standard explicitly attributes its publication to the International Organization for Standardization.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. The introduction (p. 881) states, "In November 2009, the International Organization for Standardization (ISO) published a new standard on risk management..."

3. University of Twente. (n.d.). Course: Risk Management 201300113. The course syllabus and materials reference ISO 31000 as a key standard from the International Organization for Standardization for providing a generic approach to risk management. (See course description for module on risk management frameworks).

A holistic approach to risk management considers the entire organization as a single, interconnected entity. This perspective, often operationalized through Enterprise Risk Management (ERM) frameworks like ISO 31000, moves away from managing risks in isolated departmental "silos." Instead, it promotes an integrated, organization-wide strategy where risks are identified, assessed, and managed in the context of the organization's overall objectives. This ensures that the interdependencies and aggregate effects of risks across all functions are understood and addressed, providing a complete and unified view of the organization's risk landscape.

A. Cross-functional: This describes a method of working that involves multiple departments, which is a feature of a holistic approach, but not the name of the overarching theory itself.

B. Comprehensive: This is a general adjective meaning "all-encompassing." While a holistic approach is comprehensive, "holistic" is the specific term used in risk management theory for this organization-wide concept.

C. Interrelational: This term focuses on the connections between individual risks. While analyzing interrelationships is a key part of a holistic view, it does not describe the entire organization-wide scope of the approach.

1. Hopkin, P. (2018). Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page. In Chapter 1, "Introduction to risk management," the text explains the evolution from silo-based risk management to a more "holistic and integrated approach" known as enterprise risk management (ERM), which is central to the philosophy of ISO 31000. (Specifically, see section on "Development of enterprise risk management").

2. Gatzert, N., & Martin, M. (2015). The Impact of Enterprise Risk Management on Firm Performance. Journal of Risk and Financial Management, 8(1), 19-44. The paper defines ERM as "a holistic and integrated approach to manage a firm’s key risks with the aim of maximizing firm value." (Page 20, Section 2.1). https://doi.org/10.3390/jrfm8010019

3. Hoyt, R. E., & Liebenberg, A. P. (2011). The Value of Enterprise Risk Management. The Journal of Risk and Insurance, 78(4), 795–822. The authors describe ERM as a "holistic, portfolio-based view of risk" that contrasts with the traditional, siloed approach to risk management. (Page 796). https://doi.org/10.1111/j.1539-6975.2011.01413.x

Risk quantification involves assigning numerical, typically monetary, values to the potential impact of a risk. Within risk management frameworks, financial impacts are the most straightforward to quantify. "Loss of income" (a negative financial impact) and "financial gain" (a positive financial impact or opportunity) are both direct, tangible monetary figures that can be calculated or estimated with a relatively high degree of certainty. In contrast, "reputational damage" is an intangible risk. While its secondary effects (e.g., reduced sales) can be translated into financial terms, the primary impact is non-monetary and is notoriously difficult to quantify directly. Therefore, a risk scorecard focused on quantification would most readily handle loss of income and financial gain.

B. 1 and 3: This option is incorrect because reputational damage is an intangible risk that is primarily assessed qualitatively, unlike the directly quantifiable nature of income loss.

C. 2 and 3: This option is incorrect for the same reason as B; reputational damage is not as directly quantifiable as financial gain.

1. ISO 31000:2018, Risk management — Guidelines. Section 6.4.3, "Risk analysis," explains that the consequences of risk can be tangible or intangible and that the analysis can be qualitative, semi-quantitative, or quantitative. This supports the distinction between easily quantifiable financial impacts and harder-to-quantify intangible impacts like reputational damage.

2. FERMA (The Federation of European Risk Management Associations). (2003). A Risk Management Standard. In section 4.3.3, "Risk Estimation," the standard explicitly states, "The consequence of an event can be expressed in either quantitative (e.g. financial) or qualitative (e.g. reputational damage) terms." This directly contrasts the quantifiable nature of financial risks with the qualitative nature of reputational risks.

3. Eccles, R. G., Newquist, S. C., & Schatz, R. (2007). Reputation and Its Risks. Harvard Business Review, 85(2), 104–114. This article discusses the nature of reputational risk as a significant corporate asset that is inherently difficult to measure and manage with traditional quantitative risk tools. It highlights that while the financial consequences are real, the reputational asset itself is intangible.

An insurance policy is a form of risk treatment, specifically risk sharing or transfer. The deductible is the portion of the loss that the insured entity agrees to pay out-of-pocket. By accepting a significant increase in this deductible, the manufacturing organization is consciously choosing to absorb a larger portion of the potential financial loss itself, rather than transferring it to the insurer. This is a direct application of the risk treatment option known as "risk retention." The increase in the deductible directly corresponds to an increased level of retained risk.

A. Decreased risk avoidance: This action is a treatment for an existing risk within an ongoing operation; it is not related to a decision to avoid or cease avoiding an activity.

B. Decreased risk tolerance: Accepting a higher potential out-of-pocket loss (a higher deductible) indicates an increased readiness to bear risk, which signifies increased risk tolerance, not decreased.

C. Increased risk elimination: The underlying source of the risk (e.g., potential for fire, equipment failure) is not being removed or eliminated; only the financial strategy for managing its consequences is changing.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 6.5.2, "Selection of risk treatment options," lists "retaining the risk by informed decision" as a primary option. It also lists "sharing the risk" (e.g., via insurance). An increased deductible represents a deliberate shift from sharing a portion of the risk to retaining it.

2. Hopkin, P. (2018). Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page.

Chapter 13, "Risk Treatment," explains that risk retention (or risk acceptance) can be a deliberate strategy. Using deductibles or excesses on insurance policies is cited as a common example of partial risk retention, where the organization accepts the first part of any loss.

3. Leitch, M. (2010). ISO 31000:2009—The New International Standard on Risk Management. Risk Analysis: An International Journal, 30(6), 887-892.

DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

On page 890, the article discusses the risk treatment process as outlined in the standard, which includes the options to retain or share risk. The scenario described in the question is a practical application of adjusting the balance between these two specific treatment options.

The statement is true. According to the ISO 31000:2018 standard, a core principle of risk management is using the "best available information." This principle explicitly requires that the process takes into account any limitations and uncertainties associated with the information used. During the risk analysis phase, the availability and reliability of information are key factors that determine the complexity and detail of the analysis. Therefore, clearly identifying and communicating the accuracy and reliability of the risk assessment is essential for ensuring transparency and enabling informed decision-making based on the assessment's outputs.

B. False: This is incorrect. Neglecting to identify the accuracy and reliability of a risk assessment would violate the ISO 31000 principle of using the "best available information" and being transparent about its limitations and uncertainties.

1. ISO 31000:2018, Risk management — Guidelines, Clause 4, Principles. The principle of "Best available information" states: "The inputs to the risk management process are based on historical and current information, as well as on future expectations. Risk management explicitly takes into account any limitations and uncertainties associated with such information and expectations."

2. ISO 31000:2018, Risk management — Guidelines, Clause 6.4.3, Risk analysis. This clause notes: "Risk analysis can be undertaken with varying degrees of detail and complexity, depending on the purpose of the analysis, the availability and reliability of information, and the resources available."

3. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x). This article discusses how the standard emphasizes that the quality and availability of data directly influence the confidence in the risk assessment results.