The primary role of risk management in the strategic planning process is to identify and analyze the uncertainties that could affect the achievement of an organization's objectives. According to ISO 31000, risk is the "effect of uncertainty on objectives." This uncertainty can manifest as potential threats (negative effects) or opportunities (positive effects). By systematically identifying these factors during strategic planning, an organization can set more realistic objectives, develop robust strategies to manage threats, and create plans to capitalize on opportunities, thereby creating and protecting value. This integration ensures that the strategy is not developed in a vacuum but is informed by a clear understanding of the internal and external risk landscape.

A. Challenging decisions is a function of governance that risk management supports, but its core role in planning is to provide information for making decisions, not just to challenge them after the fact.

B. Developing risk treatment plans is a subsequent step in the risk management process (risk treatment) that occurs after risks have been identified, analyzed, and evaluated in relation to the strategy.

C. Drafting the decisions is the responsibility of senior management and the board. Risk management's role is to provide critical input and analysis to inform those decisions, not to draft them.

1. ISO 31000:2018, Risk management — Guidelines.

Clause 4, Principles: States that risk management "Creates and protects value" and should be an "integral part of all organizational processes," including "strategy and planning."

Clause 5.4.1, Integrating risk management into organizational processes: Emphasizes that risk management should be part of decision-making, including the setting of strategy and objectives.

Clause 6.4.2, Risk identification: This clause specifies the process of "finding, recognizing and describing risks." The purpose is to generate a comprehensive list of risks based on those events that might "create, enhance, prevent, degrade, accelerate or delay the achievement of objectives." This directly corresponds to identifying threats and opportunities.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Page 884, Section 4. Principles of Risk Management: The article explains that a key principle of ISO 31000 is its integration into organizational processes. It states, "Risk management is not a stand-alone activity... It is part of the responsibilities of management and an integral part of all organizational processes, including strategic planning..." This integration is achieved by providing the information needed to understand potential threats and opportunities related to strategic choices. (https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Page 280: The authors discuss how ISO 31000 positions risk management as a tool for decision-making and achieving objectives. They note that the standard's process begins with establishing the context, which includes defining strategic objectives, and then moves to risk assessment (identification, analysis, evaluation), which inherently involves considering events that could help or hinder those objectives (opportunities and threats). (https://doi.org/10.1057/rm.2012.9)

Systemic risk refers to the potential for an event to trigger a cascade of failures or major disruptions throughout an entire system, such as a financial market, an industry, or the economy. It is not about the failure of a single entity but the risk that the failure of one or more components will spread and cause the entire system to collapse or function improperly. This contagion effect threatens the stability and operation of the whole system, leading to severe and widespread consequences.

A. This describes interconnectedness risk or internal contagion within a single organization, not the failure of an entire market or system.

B. This is a specific type of supply chain risk for one organization, which is a component of operational risk, not the definition of systemic risk.

C. This defines a key-person or human capital risk, which is an internal operational risk confined to a specific organization.

1. Schwarcz, S. L. (2008). Systemic Risk. The Georgetown Law Journal, 97(1), 193-249. The introduction (p. 193) defines systemic risk as "a risk that an event will trigger a loss of economic value or confidence in, and collapse of, a substantial part of the financial system."

2. De Bandt, O., & Hartmann, P. (2000). Systemic Risk: A Survey. European Central Bank Working Paper No. 35. Section 2, "What is Systemic Risk?", discusses systemic risk as an event that triggers a chain reaction of failures affecting a large portion of the financial system.

3. International Monetary Fund (IMF). (2009). Global Financial Stability Report: Responding to the Financial Crisis and Measuring Systemic Risks. Chapter 3, "Measuring Systemic Risks," defines systemic risk as "a risk of disruption to financial services that is caused by an impairment of all or parts of the financial system and has the potential to have serious negative consequences for the real economy." (p. 103).

ISO 17776:2016 provides specific guidelines and a structured approach for hazard identification and risk assessment. While its primary application is for major accident hazards in offshore petroleum and natural gas production installations, it details a comprehensive set of tools and techniques (e.g., HAZID, HAZOP, FMECA) that are widely recognized and applied in various industries for these purposes. It serves as a practical guide for implementing the risk assessment component of the broader risk management framework described in ISO 31000.

A. ISO 15776: This standard specifies requirements for personal flotation devices and is unrelated to risk assessment methodologies.

B. ISO 16776: This standard details test methods for determining the effects of daylight on plastics, not hazard identification.

D. ISO 18776: This standard provides rules for the construction and installation of elevators in existing buildings, not risk management.

1. International Organization for Standardization. (2016). ISO 17776:2016: Petroleum and natural gas industries — Offshore production installations — Guidelines and tools for hazard identification and risk assessment of major accidents. ISO. The scope and introduction sections (Clauses 1 and 4) explicitly define the standard's purpose for hazard identification and risk assessment.

2. Vinnem, J. E. (2014). Offshore Risk Assessment: Principles, Modelling and Applications of QRA Studies (3rd ed.). Springer. Chapter 4, "Hazard Identification," extensively references ISO 17776 as the primary standard for HAZID studies in the offshore industry (pp. 85-87).

3. Rausand, M. (2011). Risk Assessment: Theory, Methods, and Applications. John Wiley & Sons. In Chapter 6, "Hazard Identification," ISO 17776 is cited as a key source for systematic hazard identification techniques (p. 189). https://doi.org/10.1002/9781118281117

The fundamental distinction between pure and speculative risk lies in their potential outcomes. A pure risk presents only the possibility of a loss or no loss, with no opportunity for financial gain. Examples include natural disasters, accidents, or property damage. Conversely, a speculative risk is undertaken voluntarily with the prospect of either a gain or a loss. Financial investments, business ventures, and gambling are classic examples of speculative risks where the outcome can be positive, negative, or neutral.

A. The cause is not the defining characteristic; a pure risk can be caused by human error (e.g., an accident), and a speculative risk can be influenced by environmental factors (e.g., weather affecting crop futures).

B. Both pure and speculative risks can often be analyzed and measured using probability. Actuarial science measures pure risks, while financial modeling assesses speculative risks.

C. Both types of risk can be subject to regulatory control. For example, workplace safety regulations address pure risks, while securities and exchange commissions regulate speculative financial risks.

1. Hopkin, P. (2018). Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page. In Chapter 1, "Introduction to risk management," the text distinguishes between pure risk (downside risk) and speculative risk (upside and downside risk), stating, "Pure risk is associated with the possibility of a loss or no loss... Speculative risk is associated with the possibility of a gain or a loss." (p. 12).

2. Redja, G. E., & McNamara, M. J. (2017). Principles of Risk Management and Insurance (13th ed.). Pearson. Chapter 1, "Risk and Its Treatment," defines pure risk as "a situation in which there are only the possibilities of loss or no loss" and speculative risk as "a situation in which either profit or loss is possible." (p. 6).

3. University of Texas at Austin, McCombs School of Business. (n.d.). Risk Management and Insurance: Module 1 - The Problem of Risk. In this courseware, pure risk is defined by the outcomes of loss/no loss, while speculative risk is defined by the outcomes of loss/gain. This distinction is presented as a foundational concept in risk classification. (Section: "Classification of Risk").

Modern internal auditing, particularly when aligned with risk management frameworks like ISO 31000, has shifted from a transactional or compliance-based focus to a risk-based, process-oriented approach. The primary objective is to provide assurance that an organization's governance, risk management, and internal control processes are effective. Auditors spend the majority of their time evaluating the design and operational effectiveness of business processes to determine if they are achieving strategic objectives and managing key risks. Audits of people, technology, and infrastructure are typically performed within the context of these overarching business processes.

A. People: Audits focus on the systems and processes people operate within, and the controls governing their actions, rather than auditing individuals directly.

C. Technology: While IT auditing is a critical and growing specialty, technology is fundamentally an enabler of business processes. IT audits are often conducted to support broader process-level reviews.

D. Infrastructure: This is too specific and narrow. Auditing physical or IT infrastructure is a component of a larger operational or IT audit, which falls under the umbrella of process auditing.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 2100 – Nature of Work. This standard explicitly states, "The internal audit activity must evaluate and contribute to the improvement of the organization’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach." This establishes "process" as the core subject of internal audit work.

2. International Organization for Standardization. (2018). ISO 31000:2018 Risk management — Guidelines. Clause 6, "Process". The standard itself is structured around the risk management process. The role of internal audit is to provide assurance over this process and its application to the organization's other business processes.

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. Chapter 1, "Introduction to Internal Auditing," describes the evolution of the profession toward a process-based, risk-oriented, and proactive model, moving away from a purely financial and compliance focus. The textbook frames the audit universe in terms of business processes.

The primary objective of conducting a supply-chain analysis from a risk management perspective is to systematically identify and assess potential vulnerabilities. These vulnerabilities are weaknesses or points of failure within the supply chain—such as over-reliance on a single supplier, geopolitical instability, logistical bottlenecks, or lack of visibility—that could be exploited by a threat or trigger a disruption. By identifying these vulnerabilities, an organization can understand its risk exposure and develop appropriate strategies to mitigate, transfer, or accept the risks, thereby enhancing its resilience and ability to achieve its objectives. This process is a core component of risk identification as outlined in the ISO 31000 framework.

A. contingent business interruption coverage. This is a form of risk treatment (insurance) that an organization might purchase after identifying a vulnerability; it is not the purpose of the analysis itself.

B. customer technology needs. Identifying customer needs is typically the function of market research, sales, or product development, not a supply-chain risk analysis, which focuses on operational continuity.

C. international regulatory requirements. While regulatory non-compliance is a potential risk, it is only one of many vulnerabilities a supply-chain analysis seeks to identify. This answer is too narrow.

1. ISO 31000:2018, Risk management — Guidelines. Clause 6.4.2, "Risk identification," states that the purpose is to "find, recognize and describe risks that might help or prevent an organization achieving its objectives." It further suggests that this process should consider a wide range of factors, including the organization's "relationships with, and perceptions and values of, external stakeholders," which directly encompasses the supply chain. The analysis of the supply chain is a method to fulfill this requirement by identifying potential disruptions (vulnerabilities).

2. Sheffi, Y. (2005). The Resilient Enterprise: Overcoming Vulnerability for Competitive Advantage. MIT Press. In Chapter 2, "The Nature of Disruptions," Sheffi emphasizes that the first step in building resilience is understanding and identifying vulnerabilities throughout the supply chain. The book, a foundational text from a leading academic institution, frames supply-chain analysis as a critical tool for discovering these hidden weaknesses before they lead to a crisis.

3. Jüttner, U., Peck, H., & Christopher, M. (2003). Supply chain vulnerability: An investigation of the sources and drivers. International Journal of Logistics Management, 14(1), 1-18. This peer-reviewed article defines supply chain vulnerability as an organization's exposure to serious disturbances. The authors argue that a key management task is to conduct analyses to identify the sources of risk and drivers of vulnerability within the supply network and its external environment (p. 12). DOI: https://doi.org/10.1108/09574090310806479

The scenario describes risk aggregation, which is the process of combining multiple individual risks or losses to understand the total, consolidated impact of an event or a set of circumstances. In this case, the numerous injury claims and the loss of revenue are distinct financial consequences stemming from the single event of the train crash. By considering them together, the train operator is aggregating these losses to determine the overall financial and operational impact, which is a core concept in risk analysis.

B. risk categorisation: This is the process of grouping risks based on their source or nature (e.g., financial, operational, strategic), not summing the consequences of an event that has already occurred.

C. risk probability: This refers to the likelihood of an event happening. The train crash has already occurred, so the focus is on its consequences, not its probability.

D. risk severity: This describes the magnitude of the impact of a risk. While the situation is severe, "aggregation" specifically refers to the act of combining multiple distinct losses.

1. ISO Guide 73:2009, Risk management — Vocabulary.

Reference: Definition 3.8.1.6.

Content: Defines "risk aggregation" as the "combination of a number of risks into a single risk." The scenario perfectly illustrates this by combining the numerous claims (a number of risks/losses) and the revenue loss into a single, overall impact of the crash.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Reference: Page 884, Section on "The Risk Management Process."

Content: The article discusses the ISO 31000 risk management process, which includes risk analysis. A key part of analysis is understanding the full scope of consequences. Aggregating various impacts (like injury claims and revenue loss) is essential to properly analyze the magnitude of the risk and inform the risk evaluation step, aligning with the principles of a comprehensive approach advocated by the standard. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch, M. (2010). ISO 31000:2009 - The new international standard on risk management. Risk Management, 12(4), 162-181.

Reference: Page 174.

Content: The paper explains that understanding the "causes and sources of risk, their positive and negative consequences, and the likelihood that those consequences can occur" is central to risk analysis under ISO 31000. Aggregating the various negative consequences from a single event is a practical application of this principle to determine the overall level of risk.

The statement is false. ISO 31000:2018 provides high-level principles and a framework for risk management, emphasizing its integration into an organization's overall governance, strategy, and decision-making. Its focus is fundamentally strategic, not tactical. The standard is intentionally non-prescriptive and does not dictate specific operational processes or tactical actions. Instead, it guides organizations on how to establish a strategic context for managing risk and empowers them to design and implement their own customized, tactical processes that fit their specific objectives and environment.

A. True: This is incorrect because the standard's core purpose is to provide a strategic framework and guiding principles, deliberately avoiding the prescription of specific tactical or process-level details.

1. ISO 31000:2018, Risk management — Guidelines. Introduction, p. v: "This document provides guidelines on managing risk faced by organizations... Applying these guidelines can be customized to any organization and its context." This highlights its non-prescriptive, high-level nature.

2. ISO 31000:2018, Risk management — Guidelines. Clause 4, Principles: The principles, such as being "Integrated" into all organizational activities and "Customized," confirm the standard's strategic and framework-oriented focus rather than a one-size-fits-all tactical approach.

3. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. While analyzing the 2009 version, this paper establishes the standard's foundational strategic nature, which was enhanced in the 2018 revision. It states, "It is not a 'how-to' book with detailed instructions... it is a high-level standard that sets out what should be achieved" (p. 882).

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. https://doi.org/10.1057/rm.2012.9. This analysis emphasizes the standard's "managerial and strategic orientation" and its goal to integrate risk management into "the overall governance, strategy and planning" (p. 274), contrasting it with more procedural or tactical approaches.

The OCEG (Open Compliance and Ethics Group) GRC Capability Model defines risk management as one of its core components. This definition emphasizes a proactive approach to dealing with uncertainty. Specifically, it is the capability to identify, assess, and address uncertainties and potential obstacles that could impact the achievement of an organization's objectives. This aligns directly with the principle that risk is the effect of uncertainty on objectives, a concept central to modern risk management frameworks like ISO 31000.

A. This describes the Governance component of the OCEG GRC model, which is concerned with directing and controlling the organization by setting objectives and monitoring performance.

C. This is the definition of the Compliance component within the OCEG GRC model, which focuses on adhering to mandatory requirements (laws, regulations) and voluntary obligations.

1. OCEG. (2015). GRC Capability Model, Version 3.0. Section 2.2, "The GRC Capability Model Components," p. 16. "Risk Management: The capability to proactively identify, assess, and address uncertainty and potential obstacles to achieving objectives."

2. Racz, N., Weippl, E., & Seufert, A. (2010). A frame of reference for research of integrated governance, risk, and compliance (GRC). Proceedings of the Annual Hawaii International Conference on System Sciences, 1-10. The paper explicitly references and builds upon the OCEG definitions, stating, "Risk management is the capability to address uncertainty and to identify and assess risks to the achievement of objectives." (Section 3.2). DOI: 10.1109/HICSS.2010.354

3. University of South Florida. (n.d.). Course ISM 6328: Information Security and Risk Management. Course materials often reference the OCEG model, defining its components. The course syllabus and lecture notes distinguish between Governance (setting objectives), Risk (addressing uncertainty), and Compliance (adhering to rules), consistent with the OCEG framework.

Inclusiveness is a fundamental principle of effective risk management as defined by the ISO 31000:2018 standard. This principle mandates the appropriate and timely involvement of stakeholders throughout the risk management process. By considering the diverse knowledge, perspectives, and perceptions of those involved or affected, an organization can achieve improved awareness and create a more robust and relevant risk management framework. This collaborative approach ensures that risks are comprehensively identified, analyzed, and treated, leading to better-informed decision-making and the successful achievement of objectives.

B. False: This is incorrect because ISO 31000:2018, the global guideline for risk management, explicitly lists "Inclusive" as one of the eight core principles for creating and protecting value.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4, "Principles". This section lists "Inclusive" as a key principle for effective risk management.

2. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4.5, "Inclusive". This sub-clause specifies that "Appropriate and timely involvement of stakeholders enables their knowledge, views and perceptions to be considered. This results in improved awareness and informed risk management."

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. The paper discusses the principles of ISO 31000, including inclusiveness, as foundational to the standard's approach to managing risk effectively (p. 276). https://doi.org/10.1057/rm.2012.9

4. University of Queensland. (n.d.). Enterprise Risk Management Framework. The framework, based on ISO 31000:2018, outlines the university's commitment to the principles of risk management, stating, "Our risk management approach is... Inclusive: We engage with our stakeholders to understand their perspectives and involve them in decision-making." (Section 3.2, Principles).