ISO-31000-Lead-Risk-Manager Practice Questions

The official definition of risk in ISO 31000:2018 is the "effect of uncertainty on objectives." While none of the options provided are a verbatim match, option D is the closest and most appropriate description. It correctly captures the essential components of the ISO definition: the link between an uncertain event (expressed as "probability of an event") and its consequences ("impact") in relation to an organization's goals ("objectives"). This focus on objectives is the cornerstone of the ISO 31000 approach, distinguishing it from older, more limited definitions that focus solely on negative outcomes or specific domains like finance or insurance.

A. This is a traditional, narrow definition focusing only on negative consequences. ISO 31000 defines "effect" as a deviation from the expected, which can be positive (opportunity), negative (threat), or both.

B. This definition is too specific to the financial sector. The ISO 31000 standard is generic and designed to be applicable to any organization, activity, or sector, not just investment.

C. This is a highly specialized definition from the insurance industry. ISO 31000 provides a universal framework for risk management that extends far beyond insurable losses.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 3.1: Explicitly defines risk as the "effect of uncertainty on objectives." The notes further clarify that "An effect is a deviation from the expected — positive

negative or both" and "Objectives can have different aspects and categories

and can be applied at different levels." This supports why options A

B

and C are too narrow and why D

by linking impact to objectives

is the best choice.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis

30(6)

881-886.

Page 882: The article discusses the definition of risk in the standard as "the effect of uncertainty on objectives." It emphasizes that this definition is a significant departure from previous ones by being neutral (not just negative) and by directly linking risk to the organization's objectives

which aligns with the reasoning for selecting option D. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. Leitch

M. (2010). ISO 31000:2009—The new international standard on risk management. Risk Analysis

30(6)

887-892.

Page 888: This paper highlights that the definition "effect of uncertainty on objectives" is a "keystone of the Standard." It explains that risk only exists in the context of objectives

reinforcing that any valid description of risk

like option D

must include this linkage. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01441.x)

The statement is correct. The ISO 31000:2018 standard is fundamentally built upon the concept of uncertainty. It explicitly defines risk as the "effect of uncertainty on objectives." This definition places uncertainty at the very core of risk, making it the primary driver and rationale for implementing a risk management framework. The entire purpose of the risk management process, as outlined in the standard, is to identify, analyze, evaluate, and treat the potential positive or negative deviations (effects) from what is expected, which arise from a state of incomplete knowledge or information (uncertainty).

The alternative, "False," is incorrect because it contradicts the foundational definition provided in Clause 3.1 of the ISO 31000:2018 standard. To claim that uncertainty is not the driver would be to ignore the explicit linkage the standard makes between "risk" and "uncertainty." While concepts like threats, hazards, or opportunities are inputs to the risk management process, they are all considered within the context of the uncertainty surrounding their potential impact on the organization's objectives.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 3.1

Terms and definitions: Defines risk as the "effect of uncertainty on objectives."

Note 2 to entry 3.1: Clarifies that "Uncertainty is the state

even partial

of deficiency of information related to

understanding or knowledge of

an event

its consequence

or likelihood." This directly establishes uncertainty as the basis for risk.

2. Leitch

M. (2010). ISO 31000:2009—The new international standard on risk management. Risk Analysis: An International Journal

30(6)

887-892.

Page 888: "The definition of risk as 'the effect of uncertainty on objectives' is arguably the most important sentence in the whole of ISO 31000. It is a clear statement that risk is not an object

but a consequence. It is also a clear statement that risk is related to uncertainty." This academic review emphasizes that the entire standard's philosophy is driven by this definition. (Note: While this refers to the 2009 version

the core definition and its centrality were maintained in the 2018 revision).

DOI: https://doi.org/10.1111/j.1539-6924.2010.01426.x

3. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886.

Page 882: The author discusses the significance of the definition

stating

"The definition of risk as the 'effect of uncertainty on objectives' is a significant element of the standard... It moves the focus of risk management away from the 'risk' itself and toward the reasons why organizations should manage risk—to achieve their objectives." This highlights that managing the effects of uncertainty is the core rationale.

DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

According to ISO 31000:2018, "residual risk" is the specific term for the risk that remains after risk treatment measures have been implemented. The risk management process involves identifying risks, analyzing them, and then applying treatments (controls) to modify them. However, it is rare for treatment to eliminate risk entirely. The level of risk that is left over after these controls are in effect is known as residual risk. This remaining risk must then be monitored, reviewed, and formally accepted by management.

A. Controlled risk: This is not a standard term defined in ISO 31000. While treatments are controls, "controlled risk" is not the formal name for the risk that remains.

C. Avoidance risk: Risk avoidance is a type of risk treatment option where an organization decides not to start or to exit an activity to prevent exposure to a risk. It is a strategy, not the remaining risk.

D. Accepted risk: Risk acceptance (or retention) is a decision to take on a particular risk. While residual risk is often the risk that is formally accepted, "accepted risk" refers to the decision itself, not the state of the risk after treatment.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Geneva

Switzerland: ISO.

Section 3.9: Defines residual risk as the "risk remaining after risk treatment."

Section 6.5.2: Lists "avoiding the risk" and "retaining the risk" (acceptance) as options for risk treatment

distinguishing them from the concept of residual risk.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal

30(6)

881-886.

Page 884: The article explains the ISO 31000 process

noting that after risk treatment

"the resulting level of risk is called 'residual risk'." This confirms that residual risk is the outcome of the treatment step. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch

M. (2010). ISO 31000:2009—The New International Standard on Risk Management. Risk Management

12(4)

180-181.

Page 181: In describing the risk treatment phase of the ISO 31000 process

the author states

"The intention of risk treatment is to produce a residual risk that is as low as reasonably practicable

" clearly identifying residual risk as the post-treatment state. DOI: https://doi.org/10.1057/rm.2010.9

The statement is correct. "Tailored" is one of the eight fundamental principles of effective risk management as defined in the ISO 31000:2018 standard. This principle mandates that an organization's risk management framework and its associated processes must be customized and proportionate to its specific external and internal context. A generic, one-size-fits-all approach is considered ineffective because every organization has unique objectives, culture, structure, operations, and resources, which directly influence its risks and how they should be managed.

The "False" option is incorrect because it directly contradicts the explicit guidance provided in ISO 31000:2018. The standard is built on the premise that for risk management to create and protect value, it must be integrated into the organization's specific governance and decision-making processes, which requires customization and tailoring.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 4

Principles

item (d): This section explicitly lists "Tailored" as a key principle. The standard states

"The risk management framework and process are customized and proportionate to the organization’s external and internal context related to its objectives." This directly supports the answer.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis

30(6)

881-886.

Page 883: The author discusses the principles of ISO 31000

highlighting that the framework must be "customized to the organization’s needs." The article explains that this tailoring ensures that risk management is relevant and effective within the specific operational environment of the organization. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch

M. (2010). ISO 31000:2009—The new international standard on risk management. Risk Analysis

30(6)

887-892.

Page 889: This academic review emphasizes the importance of the principles in ISO 31000. It notes that the principle of tailoring risk management to the "specific context of the organization" is crucial for its successful implementation and for ensuring that it supports the achievement of objectives rather than becoming a bureaucratic exercise. DOI: https://doi.org/10.1111/j.1539-6924.2010.01441.x

According to ISO 31000:2018, the risk management process includes "Recording and reporting" (Clause 6.7). This clause emphasizes that the process and its outcomes should be documented and reported through appropriate mechanisms. These documented outputs, such as risk registers, risk assessment reports, and meeting minutes, are formally considered "records." The primary purpose of reporting is to communicate risk management activities and outcomes to stakeholders and interested parties, providing a basis for decision-making and ensuring transparency. Therefore, records are the fundamental tools used for this communication.

A. Database: A database is a system for storing and organizing data. While it holds risk information, it is not the communication tool itself; reports generated from it are.

C. Bio-data: This is a document containing an individual's personal and biographical details, which is irrelevant to communicating organizational risk information.

D. Resume: A resume is a document used for job applications to summarize an individual's professional qualifications and is not used for stakeholder risk communication.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.7

"Recording and reporting." This section states

"The purpose of reporting is to communicate risk management activities and outcomes across the organization... Reporting is an integral part of the organization’s governance." This directly links the creation of documented information (records) to communication with stakeholders.

2. Lalonde

C.

& Boiral

O. (2012). "Managing risks and learning in organizations." Journal of Workplace Learning

24(4)

213-229. The paper discusses the implementation of risk management systems like ISO 31000

highlighting that formal documentation and reporting (i.e.

records) are essential for communicating risk culture and information to internal and external stakeholders. (DOI: https://doi.org/10.1108/13665621211223341)

3. University of Queensland. (2023). MINE7037 - Risk Management Course Profile. School of Mechanical and Mining Engineering. The course

based on ISO 31000 principles

outlines that a key component of the risk management process is reporting

which involves creating documented records to inform management and other stakeholders about the organization's risk profile and the effectiveness of controls.

The term "systematic" means doing something in a methodical, organized, and planned way. In the context of ISO 31000, the risk management process is explicitly defined as involving the "systematic application of policies, procedures and practices." This ensures that risk management is not an ad-hoc activity but a structured and repeatable process that follows a clear method to achieve consistent and comparable results. A systematic approach is fundamental to effectively integrating risk management into an organization's governance, strategy, and operations.

B. Comprehensive: This term refers to the scope or inclusiveness of the risk management approach, not the methodical way it is executed.

C. Formal: This relates to adherence to official rules or established conventions, which is distinct from following a methodical plan.

D. Informal: This implies a lack of structure or a pre-defined plan, which is the opposite of the described activity.

1. International Organization for Standardization. (2018). ISO 31000:2018 Risk management — Guidelines. Section 6.1

General. The standard states

"The risk management process involves the systematic application of policies

procedures and practices to the activities of communicating and consulting

establishing the context and assessing

treating

monitoring

reviewing

recording and reporting risk."

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis

30(6)

881–886. In discussing the principles of the standard

the author notes that a systematic approach ensures that the process is orderly and efficient (p. 883). https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. University of Queensland. (n.d.). Enterprise Risk Management Framework. Section 3.2

UQ Risk Management Process. The document

based on ISO 31000

describes the risk management process as a "systematic process" for making decisions to manage risk effectively.

The statement is correct. According to the ISO 31000:2018 standard, one of the fundamental principles of effective risk management is that it must take "Human and cultural factors" into account. The standard explicitly recognizes that human behavior, perceptions, and organizational culture significantly influence every aspect of the risk management process, from identifying risks to treating them. Failing to consider these factors can lead to an incomplete understanding of the risk landscape and ineffective risk management outcomes.

The option "False" is incorrect because it directly contradicts a core principle outlined in ISO 31000:2018. The standard is built on the premise that risk management is not merely a technical or mechanical process but is deeply intertwined with the people and culture of an organization. To suggest that risk management does not take these factors into account would be to ignore a foundational element of the internationally recognized guideline for risk management.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 4: Principles

item (d) explicitly lists "Human and cultural factors" as a principle. The text states

"Human behaviour and culture significantly influence all aspects of risk management at all levels and stages."

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal

30(6)

881-886.

Page 884

Section 3.1 Principles for Managing Risk: The article discusses the principles that form the foundation of the standard

noting that they "provide guidance on the characteristics of effective and efficient risk management." It lists and explains the principles from the standard

including the necessity of considering human and cultural factors for risk management to be effective. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch

M. (2010). ISO 31000:2009 - The new international standard for risk management. Risk Analysis: An International Journal

30(6)

887-892.

Page 889

Table I: This article presents a table summarizing the 11 principles of the original (2009) standard

which are carried forward into the 2018 version. Principle (g) is listed as "Human and cultural factors

" reinforcing its status as a foundational component of the ISO 31000 framework. DOI: https://doi.org/10.1111/j.1539-6924.2010.01441.x

4. University of Queensland. (n.d.). MINE4201 - Risk & Financial Management - Lecture 2: Risk Management Principles and Framework.

Course materials for this engineering program typically review the ISO 31000 standard. Lecture slides on the principles of risk management directly list the eight principles from ISO 31000:2018

including "Human and cultural factors

" and explain that these principles are the basis for managing risk effectively.

The fundamental and most significant difference of Enterprise Risk Management (ERM) is its holistic and integrated nature. Traditional risk management often operates in functional or departmental silos, addressing risks like finance, operations, or safety in isolation. ERM, by contrast, provides a comprehensive, top-down, portfolio view of all significant risks across the entire organization. This enterprise-wide perspective enables the identification of interconnected risks and aligns risk management activities with the organization's strategic objectives. The principle of integration is central to the ISO 31000 framework, which states that risk management should be an integral part of all organizational activities, functions, and processes.

A. Risk management increases the likelihood of achieving objectives by managing uncertainty; it cannot provide an absolute guarantee or ensure their achievement.

C. While ERM addresses strategic, tactical, and operational risks, this is a consequence of its holistic approach. The key differentiator is the integrated manner in which it does so, not merely the scope.

1. ISO 31000:2018

Risk management — Guidelines

Section 4

Principles. The first principle listed is "(a) Integrated

" stating: "Risk management is an integral part of all organizational activities." This highlights that integration is the foremost characteristic.

2. Antonucci

D. (2017). Risk Management

Internal Control

and Corporate Governance. In Intelligent Systems for Operations: A Guide to Data-Driven Applications (pp. 13-32). De Gruyter. On page 16

the text distinguishes ERM from traditional risk management by noting that ERM "is a holistic approach" and that traditional methods were "fragmented and managed in silos."

3. Hoyt

R. E.

& Liebenberg

A. P. (2011). The Value of Enterprise Risk Management. The Journal of Risk and Insurance

78(4)

795–822. The introduction (p. 796) explicitly contrasts ERM with traditional risk management (TRM)

stating

"Unlike TRM

which has typically involved the management of risks in silos

ERM calls for the coordinated management of all risks." (https://doi.org/10.1111/j.1539-6975.2011.01413.x)

4. Fraser

J. R.

& Simkins

B. J. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons

59(6)

689-698. The article discusses the evolution from "silo-based risk management" to the "holistic portfolio view of risk" that defines ERM (Section 2

"The Evolution of ERM"). (https://doi.org/10.1016/j.bushor.2016.06.005)

Within the ISO 31000 framework, supply-chain analysis is a fundamental activity in the risk identification process (Clause 6.4.2). The primary objective is to systematically examine the network of suppliers, manufacturers, distributors, and customers to identify and understand potential weaknesses, dependencies, and points of failure. These are the vulnerabilities that could be exploited by risk sources (e.g., natural disasters, geopolitical events, supplier failure), leading to disruptions that negatively impact the organization's objectives. The analysis provides the necessary input for assessing and treating supply-chain risks.

A. Contingent business interruption coverage is a form of risk treatment (specifically, risk financing), which may be chosen after vulnerabilities are identified and assessed, not the purpose of the analysis itself.

B. Customer technology needs are typically identified through market research or product development processes, not through a risk-focused supply-chain analysis.

C. International regulatory requirements are a potential source of risk, but the analysis is much broader, encompassing operational, financial, and strategic vulnerabilities across the entire supply chain.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.4.2

"Risk identification": This clause states the purpose of risk identification is to "find

recognize and describe risks that might help or prevent an organization achieving its objectives." Supply-chain analysis is a method to find and recognize such risks originating from external dependencies and vulnerabilities.

2. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. This article discusses how the ISO 31000 framework applies to various contexts. Applying its principles to a supply chain inherently involves identifying vulnerabilities (potential risks) to manage them effectively (p. 883).

3. MIT Center for Transportation & Logistics. (2014). Supply Chain Vulnerability. White Paper. The research from this center consistently frames supply chain risk management as the process of identifying vulnerabilities and building resilience. The initial step is always to "understand the sources of risk and where the supply chain is vulnerable" (p. 2).

According to the principles of ISO 31000, risk management must be integrated into all of an organization's activities. A risk treatment implemented in one operational area is not an isolated event. It can have cascading effects, creating new risks (often called secondary or consequential risks) or altering the nature of existing risks in other departments or processes. Therefore, a risk management professional has a mandatory duty to evaluate the broader impact of any proposed treatment to ensure it does not inadvertently introduce a more significant problem elsewhere. This holistic evaluation is fundamental to the selection and implementation of appropriate risk treatment options.

A. add the risk to the risk map.

This is incorrect because a "critical risk" would have already been identified, analyzed, and included in the risk register and corresponding risk map during prior stages of the risk management process.

B. communicate the treatment plan directly with internal audit.

While communication with stakeholders like internal audit is vital, the specific protocol is governed by the organization's established communication and consultation plan, not a universal, direct mandate for every treatment.

C. evaluate the dollar savings associated with the treatment.

This is too narrow. While a cost-benefit analysis is part of selecting a treatment, benefits are not always quantifiable in monetary terms (e.g., reputation, safety, compliance) and thus cannot be a mandatory requirement.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.5.2

"Selection of risk treatment options." This section explicitly states

"Risk treatment can create new risks that need to be managed." This directly implies that an evaluation of the wider impact (i.e.

the creation of new risks) is a necessary part of the treatment selection process.

2. ISO 31000:2018

Risk management — Guidelines

Clause 4

"Principles." The principle that risk management is "Integrated" states it is "part of all organizational activities." This supports the requirement to consider how an action in one part of the organization affects others.

3. Lalonde

C.

& Boiral

O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management

14(4)

272–300. This academic paper discusses the systemic perspective inherent in the ISO 31000 framework

noting that "risks are often interdependent" (p. 285). This interdependence necessitates evaluating the impact of treatments across organizational boundaries. https://doi.org/10.1057/rm.2012.9

4. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886. The article emphasizes that a key principle of the standard is its comprehensive and integrated nature

which requires considering the full context of the organization

including the interrelation of its various parts

when managing risk. https://doi.org/10.1111/j.1539-6924.2010.01442.x