GRC Enterprise Risk Management Frameworks 2 — Questions and Answers
Question 1: Which COSO ERM component is responsible for setting the tone at the top and defining the organization's risk appetite?
- Control Activities
- Governance and Culture (Correct answer)
- Information and Communication
- Review and Revision
Correct answer: Governance and Culture
Governance and Culture is the COSO ERM 2017 component that establishes tone at the top, risk culture, and risk appetite.
Question 2: In ISO 31000:2018, what is the term for the potential positive or negative consequence of a risk event?
- Likelihood
- Consequence (Correct answer)
- Risk owner
- Risk criterion
Correct answer: Consequence
ISO 31000 defines 'consequence' as the outcome of an event affecting objectives, which can be positive or negative.
Question 3: A company maps risks on a heat map where the x-axis is likelihood and the y-axis is impact. Which quadrant demands immediate attention?
- Low likelihood, low impact
- High likelihood, low impact
- Low likelihood, high impact
- High likelihood, high impact (Correct answer)
Correct answer: High likelihood, high impact
Risks with high likelihood and high impact fall in the critical quadrant requiring immediate treatment and senior management focus.
Question 4: What distinguishes 'inherent risk' from 'residual risk' in an ERM framework?
- Inherent risk accounts for controls; residual risk does not
- Residual risk accounts for controls; inherent risk does not (Correct answer)
- Inherent risk is quantitative; residual risk is qualitative
- Residual risk is always higher than inherent risk
Correct answer: Residual risk accounts for controls; inherent risk does not
Inherent risk is the raw risk before controls are applied; residual risk is what remains after controls are in place.
Question 5: Under the COSO ERM framework, which element directly links risk strategy to business objectives?
- Risk identification
- Strategy and Objective-Setting (Correct answer)
- Performance
- Risk appetite statement
Correct answer: Strategy and Objective-Setting
Strategy and Objective-Setting is the COSO ERM component where risk appetite is applied to align strategy with organizational objectives.
Question 6: Which risk response strategy involves sharing risk through insurance or outsourcing?
- Avoid
- Accept
- Transfer (Correct answer)
- Reduce
Correct answer: Transfer
Transfer (or Share) shifts some or all risk exposure to a third party, such as via insurance policies or contractual arrangements.
Question 7: What is the primary purpose of a Risk Appetite Statement in an ERM program?
- To enumerate every risk the organization faces
- To set boundaries on how much risk the organization will accept in pursuit of its strategy (Correct answer)
- To assign risk owners to each identified risk
- To document past risk events and their impacts
Correct answer: To set boundaries on how much risk the organization will accept in pursuit of its strategy
A Risk Appetite Statement communicates the board-approved level of risk the organization is willing to accept while pursuing its strategic objectives.
GRC Enterprise Risk Management Frameworks 2
Which COSO ERM component is responsible for setting the tone at the top and defining the organization's risk appetite?