ISO-BCMS-22301 practice question 5 of 35

____________________ manages the full spectrum of risks and their combined impact as an interrelated risk profile to the organization.

Full set: 100 questions
Answer options
A: Enterprise Planning Management (EPM)
B: Enterprise Continual Management (ECM)
C: Enterprise Strategy Management (ESM)
D: Enterprise Risk Management (ERM) Correct answer
Correct Answer:
D. Enterprise Risk Management (ERM)
Explanation

Enterprise Risk Management (ERM) is the correct discipline. ERM is a strategic, top-down process designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. It takes a holistic, portfolio view of risk across the entire organization, managing the "full spectrum of risks" and their "combined impact as an interrelated risk profile," rather than treating risks in isolated silos. This integrated approach is central to the definition of ERM and distinguishes it from traditional risk management.

Why Incorrect

A. Enterprise Planning Management (EPM) focuses on the processes of planning, budgeting, forecasting, and consolidating financial results, not the holistic management of risk.
B. Enterprise Continual Management (ECM) is not a standard, recognized management discipline; it appears to be a distractor term combining unrelated concepts.
C. Enterprise Strategy Management (ESM) is concerned with the formulation and execution of organizational strategy; risk is a critical input, but ESM's primary focus is strategy itself.

References

1. ISO 31000:2018, Risk management — Guidelines. Clause 4, "Principles," states that risk management must be "integrated" and "structured and comprehensive." This supports the ERM concept of managing a full, interrelated profile of risks across the entire organization.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. The Executive Summary defines ERM as the practices organizations rely on "to manage risk in creating, preserving, and realizing value." It emphasizes a portfolio view of risk (p. 5) which directly aligns with managing an "interrelated risk profile."

3. Hoyt, R. E., & Liebenberg, A. P. (2011). The Value of Enterprise Risk Management. The Journal of Risk and Insurance, 78(4), 795–822. This academic paper defines ERM as a process that manages "all risks... in a coordinated, portfolio fashion" (p. 796), which directly corresponds to the question's description of managing a full spectrum of risks and their combined impact. DOI: https://doi.org/10.1111/j.1539-6975.2011.01413.x

Scroll to Top