Practice Test Geeks(GRC) Governance, Risk, and Compliance Certification Practice Test
← All GRC Flashcard Decks

Enterprise Risk Management Frameworks Flashcards

7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Enterprise Risk Management Frameworks flashcards as text

  1. Which COSO ERM component is responsible for setting the tone at the top and defining the organization's risk appetite?

    Answer: Governance and Culture

    Governance and Culture is the COSO ERM 2017 component that establishes tone at the top, risk culture, and risk appetite.

  2. In ISO 31000:2018, what is the term for the potential positive or negative consequence of a risk event?

    Answer: Consequence

    ISO 31000 defines 'consequence' as the outcome of an event affecting objectives, which can be positive or negative.

  3. A company maps risks on a heat map where the x-axis is likelihood and the y-axis is impact. Which quadrant demands immediate attention?

    Answer: High likelihood, high impact

    Risks with high likelihood and high impact fall in the critical quadrant requiring immediate treatment and senior management focus.

  4. What distinguishes 'inherent risk' from 'residual risk' in an ERM framework?

    Answer: Residual risk accounts for controls; inherent risk does not

    Inherent risk is the raw risk before controls are applied; residual risk is what remains after controls are in place.

  5. Under the COSO ERM framework, which element directly links risk strategy to business objectives?

    Answer: Strategy and Objective-Setting

    Strategy and Objective-Setting is the COSO ERM component where risk appetite is applied to align strategy with organizational objectives.

  6. Which risk response strategy involves sharing risk through insurance or outsourcing?

    Answer: Transfer

    Transfer (or Share) shifts some or all risk exposure to a third party, such as via insurance policies or contractual arrangements.

  7. What is the primary purpose of a Risk Appetite Statement in an ERM program?

    Answer: To set boundaries on how much risk the organization will accept in pursuit of its strategy

    A Risk Appetite Statement communicates the board-approved level of risk the organization is willing to accept while pursuing its strategic objectives.