When an operational area develops a treatment for a critical risk, the risk management professional MUST

According to the principles of ISO 31000, risk management must be integrated into all of an organization's activities. A risk treatment implemented in one operational area is not an isolated event. It can have cascading effects, creating new risks (often called secondary or consequential risks) or altering the nature of existing risks in other departments or processes. Therefore, a risk management professional has a mandatory duty to evaluate the broader impact of any proposed treatment to ensure it does not inadvertently introduce a more significant problem elsewhere. This holistic evaluation is fundamental to the selection and implementation of appropriate risk treatment options.

A. add the risk to the risk map.

This is incorrect because a "critical risk" would have already been identified, analyzed, and included in the risk register and corresponding risk map during prior stages of the risk management process.

B. communicate the treatment plan directly with internal audit.

While communication with stakeholders like internal audit is vital, the specific protocol is governed by the organization's established communication and consultation plan, not a universal, direct mandate for every treatment.

C. evaluate the dollar savings associated with the treatment.

This is too narrow. While a cost-benefit analysis is part of selecting a treatment, benefits are not always quantifiable in monetary terms (e.g., reputation, safety, compliance) and thus cannot be a mandatory requirement.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.5.2

"Selection of risk treatment options." This section explicitly states

"Risk treatment can create new risks that need to be managed." This directly implies that an evaluation of the wider impact (i.e.

the creation of new risks) is a necessary part of the treatment selection process.

2. ISO 31000:2018

Risk management — Guidelines

Clause 4

"Principles." The principle that risk management is "Integrated" states it is "part of all organizational activities." This supports the requirement to consider how an action in one part of the organization affects others.

3. Lalonde

C.

& Boiral

O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management

14(4)

272–300. This academic paper discusses the systemic perspective inherent in the ISO 31000 framework

noting that "risks are often interdependent" (p. 285). This interdependence necessitates evaluating the impact of treatments across organizational boundaries. https://doi.org/10.1057/rm.2012.9

4. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886. The article emphasizes that a key principle of the standard is its comprehensive and integrated nature

which requires considering the full context of the organization

including the interrelation of its various parts

when managing risk. https://doi.org/10.1111/j.1539-6924.2010.01442.x