Which of the following significant risks of reporting are outside the risk appetite of the organization and can impact compliance, which may also be reportable to regulatory agencies? (Choose two)

Significant risks related to reporting and compliance are categorized based on their origin. Standard risk management frameworks, including the principles within ISO 31000, identify sources as being either internal or external to the organization. Internal risks to reporting arise from within the organization, such as inadequate internal controls, employee fraud, or system errors. External risks originate from outside, such as changes in regulatory requirements, new accounting standards, or economic instability impacting financial disclosures. Both categories can produce risks significant enough to fall outside an organization's risk appetite and trigger mandatory reporting to regulatory agencies.

B. Vision is related to strategic objectives and direction, not a standard classification for reporting or compliance risks.
D. Dynamic describes a characteristic of a risk (i.e., its tendency to change), not its source or type.
E. Functional risks are a sub-category of internal risks; "Internal" is the broader and more appropriate classification.

1. ISO 31000:2018 - Risk management — Guidelines, Section 5.4.1, "Understanding the organization and its context." This section mandates that an organization must establish its external and internal context when designing its risk management framework, as these contexts are the sources from which risks emerge.

2. ISO 31000:2018 - Risk management — Guidelines, Section 6.4.2, "Risk identification." This clause specifies that the risk identification process should find and describe risks, which includes identifying their sources. The distinction between internal and external sources is fundamental to this process.

3. Committee of Sponsoring Organizations of the Treadway Commission (COSO), "Enterprise Risk Management—Integrating with Strategy and Performance" (June 2017). This foundational framework, widely taught in university risk management courses, explicitly discusses analyzing the business context, including the "External Environment" and "Internal Environment" (Component: Strategy & Objective-Setting, Principles 7 & 8), as the origin for risks affecting objectives. The framework's objectives categories directly include Reporting and Compliance.