The statement is true. According to ISO 31000:2018, one of the core principles of effective risk management is that it must be "customized." This is synonymous with being "tailored." The risk management framework and its processes should be adapted and proportionate to the organization's specific external and internal context, including its objectives, culture, and complexity. A generic, one-size-fits-all approach is explicitly discouraged by the standard, as it would fail to address the unique risks and opportunities an organization faces.

B. False: This is incorrect. The ISO 31000:2018 standard explicitly lists "Customized" as a key principle, meaning a non-tailored or generic approach contradicts the standard's guidance for effective risk management.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4, "Principles." The standard lists "Customized" as a principle, stating: "The risk management framework and process are customized and proportionate to the organization’s external and internal context related to its objectives."

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. In the discussion of the principles (which were carried over to the 2018 version), the article emphasizes that risk management must be tailored to the specific needs and context of the organization. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x, Page 883).

3. University of Queensland. (n.d.). Enterprise Risk Management Framework. This document, based on ISO 31000, outlines the university's risk management principles, including: "Tailored – our risk management framework and processes are customised and proportionate to the University’s internal and external context." (Section 3.1, "Principles").

The statement is true. A core principle of the ISO 31000 standard is "Continual improvement." This principle mandates that an organization's risk management framework, processes, and overall capabilities should be dynamically improved through learning and experience. "Enhanced risk management" is the direct outcome of applying this principle. It signifies a mature approach where risk management evolves beyond a static process into a continuously refined capability that adds value and supports the achievement of organizational objectives. This iterative enhancement ensures that risk management remains relevant and effective in a changing environment.

B. False: This is incorrect because it contradicts the fundamental principle of "Continual improvement" as explicitly stated in Clause 4 of the ISO 31000:2018 standard.

1. ISO 31000:2018, Risk management — Guidelines, Clause 4, Principles. Principle (h) states: "Continual improvement. Risk management is continually improved through learning and experience." This directly supports the premise that enhancing capabilities is a core emphasis.

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. In Section 3, "The Principles of Risk Management," the author discusses how the principle of continual improvement is essential for the framework's effectiveness, leading to enhanced organizational performance. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. University of Sydney. (n.d.). Risk Management Framework and Policy. In the section on "Risk Management Principles," the university's framework, based on ISO 31000, lists "Continual improvement" as a key principle, stating the University is committed to continually improving its risk management practices. This demonstrates the application of the principle to enhance capabilities.

The landscape of risk management has been fundamentally reshaped by advancements in technology, the expansion of globalization, and major shifts in finance. Technology introduced systemic risks like cybersecurity threats. Globalization created complex international supply chains and geopolitical exposures. The 2008 financial crisis was a major catalyst that elevated the importance and regulation of financial risk management globally.

While global warming and climate change are now recognized as critical, systemic risks, their widespread integration into mainstream corporate Enterprise Risk Management (ERM) frameworks is a more recent development compared to the other three factors. The dramatic changes driven by technology, globalization, and finance have been influencing the core practices of risk management for a longer period.

A. Technology: The digital revolution created entirely new and pervasive risk domains, such as cybersecurity and data privacy, which have fundamentally altered risk management practices.

B. Globalization: The creation of interconnected global markets and supply chains has made risk management significantly more complex, introducing new geopolitical and operational risks.

D. Finance: The 2008 global financial crisis and the increasing complexity of financial instruments were pivotal events that forced a dramatic evolution in risk management theory and practice.

1. COSO (Committee of Sponsoring Organizations of the Treadway Commission). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. The executive summary and subsequent chapters discuss the evolution of ERM in response to a changing business landscape. It explicitly notes drivers such as "The proliferation of data and technology" and "The increasing complexity of business" (related to globalization). While it introduces the importance of ESG, the framework's evolution is heavily rooted in the longer-standing technological, strategic, and financial shifts.

2. World Economic Forum. (2023). The Global Risks Report 2023. This report, and its preceding editions, illustrates the shifting risk landscape. While environmental risks like "Failure to mitigate climate change" now dominate the long-term outlook (p. 6, Figure 1), reports from a decade prior (e.g., 2013) were more focused on economic and financial risks like "Major systemic financial failure." This demonstrates the more recent ascent of climate change as a primary driver in the global risk discourse compared to established financial concerns.

3. ISO 31000:2018, Risk management — Guidelines. Clause 5.4.1, "Understanding the organization and its context," requires organizations to consider the external environment, which includes "financial, technological, economic, natural and competitive" factors. While the standard acknowledges the natural environment as a source of risk, academic and industry literature confirms that the dramatic, practice-altering changes from technology, globalization, and finance have a longer history in shaping modern ERM.

In the context of business process management, which is fundamental to integrating risk management per ISO 31000, organizational processes are broadly categorized into two types. 'Hard processes' are well-defined, repeatable, and often automated or technology-driven, such as manufacturing assembly lines or automated financial transactions. 'People processes' (also known as soft processes) are less structured and rely heavily on human skills, judgment, and interaction, such as strategic planning, research and development, or collaborative design. An effective integrated risk management framework must encompass both of these process types to be comprehensive.

B. Soft processes: This term is often used synonymously with 'people processes'. However, 'people processes' is a more descriptive and commonly used term in this dichotomy, making it the better choice.

D. Quality analysis: This is a specific task or a set of techniques applied within a process (e.g., a quality management process). It is not a fundamental category of process itself.

1. Checkland, P. (1999). Systems Thinking, Systems Practice: Includes a 30-Year Retrospective. John Wiley & Sons. In Part 2, Checkland extensively discusses the distinction between 'hard' systems thinking, applicable to well-defined, technical problems (aligning with hard processes), and 'soft' systems methodology, designed for complex, human-centric problem situations (aligning with people processes).

2. Harmon, P. (2014). Business Process Change: A Business Process Management Guide for Managers and Process Professionals (3rd ed.). Morgan Kaufmann. In Chapter 2, Harmon discusses the nature of business processes, distinguishing between highly structured, repeatable work and unstructured, knowledge-based work, which corresponds to the hard process vs. people process classification.

3. Ould, M. A. (2005). Business Process Management: A Rigorous Approach. British Computer Society. Chapter 3, "What is a Process?", differentiates between processes that are highly deterministic and automatable ('hard') and those that are dependent on the expertise and discretion of people ('soft' or 'people' processes).

Enhanced Risk Management (ERM) describes a mature and integrated approach where risk management is embedded into an organization's governance, strategy, and decision-making processes. Its primary goal is to proactively manage the "effect of uncertainty on objectives," which is the definition of risk according to ISO 31000. By enhancing risk management, an organization moves beyond simple compliance to use the framework as a strategic tool to improve performance, foster innovation, and ensure its objectives are met. This aligns directly with the purpose of risk management as defined in the ISO 31000 standard, which is to create and protect value.

A. Extended risk management: This is not a standard or formally recognized term within the ISO 31000 framework or mainstream risk management literature.

C. Evasive risk management: This is not a recognized term. The word "evasive" implies avoiding responsibility, which is contrary to the proactive and accountable principles of ISO 31000.

D. Avoidance risk management: Risk avoidance is a specific risk treatment option (i.e., deciding not to pursue an activity), not a comprehensive management system for achieving all organizational objectives.

1. ISO 31000:2018, Risk management — Guidelines, Clause 4, Principles. The standard states, "The purpose of risk management is the creation and protection of value. It improves performance, encourages innovation and supports the achievement of objectives." An "enhanced" system is one that successfully fulfills this purpose.

2. Leitch, M. (2010). "ISO 31000:2009—The new international standard on risk management". Risk Analysis: An International Journal, 30(6), 887-892. The paper discusses how the standard provides a basis for organizations to improve and enhance their risk management practices to better support the achievement of objectives (p. 888, Section 2). DOI: https://doi.org/10.1111/j.1539-6924.2010.01426.x

3. Purdy, G. (2010). "ISO 31000:2009—Setting a New Standard for Risk Management". Risk Analysis, 30(6), 881-886. This article explains that ISO 31000 is designed to help organizations enhance the likelihood of achieving objectives by managing uncertainty effectively (p. 882, Introduction). DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

A DBMS (Database Management System) and an RDBMS (Relational Database Management System) are software systems designed to create, store, retrieve, and manage data in a structured manner. The data stored within these systems constitute an organization's official records. The various outputs and system components, such as logs, reports, data dictionaries, and database schemas, are considered artifacts. These systems provide the technological foundation for the "recording and reporting" activities mandated by management system standards like ISO 31000, ensuring that evidence of processes and decisions is captured and maintained.

A. RBPS (Risk-Based Process Safety) and RBDM (Risk-Based Decision Making) are management processes or frameworks, not the technological systems that directly create and store records.

C. TDMS (Test Data Management System) and VSMS (Vendor Security Management System) are highly specialized systems; DBMS/RDBMS are the more fundamental and universal technologies for record-keeping.

D. MOS (Management Operating System) and SMOS (Safety Management Operating System) are conceptual frameworks for management, which would utilize other systems to generate their required artifacts and records.

1. Elmasri, R., & Navathe, S. B. (2017). Fundamentals of Database Systems (7th ed.). Pearson.

Page 5, Section 1.2: Defines a database as a collection of related data and a DBMS as a "computerized system that enables users to create and maintain a database." The data itself represents records, and the system's metadata (catalog/dictionary) and logs are artifacts of its operation.

2. ISO 15489-1:2016, Information and documentation — Records management — Part 1: Concepts and principles.

Section 3.15: Defines a record as "information created, received, and maintained as evidence and as an asset by an organization...".

Section 8.3.2: Discusses designing and implementing systems for records, stating that "Business systems, including business applications... should be designed... to create and manage authoritative records." DBMS and RDBMS are the core technologies for such business systems.

3. Stanford University, CS145: Introduction to Databases (Courseware).

Lecture 1 Notes: Typically describe a DBMS as a software package designed to store and manage databases. The course explains how these systems manage data (records) and generate logs, schemas, and other outputs (artifacts) essential for data integrity and auditing. The system's function is explicitly the management of records.

Pure risk is a category of risk where the only possible outcomes are loss or no loss; there is no opportunity for financial gain. A fire in a manufacturing line is a classic example of a pure risk. If the fire occurs, the organization suffers a loss (e.g., damaged equipment, business interruption). If the fire does not occur, the organization's state remains unchanged (no loss). The other options represent speculative risks, which are taken on voluntarily and involve three potential outcomes: loss, no loss, or gain. These are typically associated with business or financial decisions.

B. entering into a contract to purchase a new factory.

This is a speculative risk. The purchase is an investment made with the expectation of gain (profit), but it also carries the risk of financial loss.

C. making a strategic decision that affects the long-term future of the organisation.

This is inherently a speculative risk. Strategic decisions are undertaken to achieve positive outcomes (gain), but they always involve uncertainty and the possibility of negative consequences (loss).

D. the purchase of a currency derivative.

This is a financial or speculative risk. Derivatives are used to either speculate for a profit (gain) or to hedge against a potential loss, both of which involve possibilities beyond just loss/no loss.

1. Rejda, G. E., & McNamara, M. J. (2017). Principles of Risk Management and Insurance (13th ed.). Pearson. In Chapter 1, "Risk and Its Treatment," the text defines pure risk as "a situation in which there are only the possibilities of loss or no loss" (p. 6). It contrasts this with speculative risk, which involves the possibility of profit or loss.

2. Vaughan, E. J., & Vaughan, T. (2013). Fundamentals of Risk and Insurance (11th ed.). John Wiley & Sons. Chapter 1, "The Problem of Risk," distinguishes between pure and speculative risk, stating, "Pure risk involves the chance of loss or no loss only... Speculative risk describes a situation where there is a possibility of loss but also a possibility of gain" (p. 8).

3. University of Georgia, Terry College of Business. (n.d.). RMIN 4000: Risk Management and Insurance Courseware. The curriculum defines pure risks as those that are "loss or no loss" situations, typically related to accidental or unforeseen events like fires, floods, and accidents, which are often insurable. Speculative risks are defined as those involving a chance of gain, such as investment and strategic decisions.

Insurance is a classic example of the risk sharing (also known as risk transfer) technique. This risk treatment option involves contractually shifting the financial consequences of a potential loss from one party (the insured) to another (the insurer). In exchange for a premium, the insurer agrees to bear the specified risk, pooling it with the risks of other policyholders. This mechanism does not eliminate or reduce the likelihood of the risk event itself but reallocates the financial burden, which is the core principle of risk sharing as defined within the ISO 31000 framework.

B. Reduction: This technique, also called risk mitigation, involves actions to decrease the probability or negative impact of a risk event, such as installing a fire suppression system. Insurance does not reduce the event's likelihood.

C. Retention: This technique involves knowingly and willingly accepting the loss or financial impact if a risk event occurs. Insurance is the opposite; it is a method to transfer financial responsibility, not retain it.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Clause 6.5.2, "Selection of risk treatment options," explicitly lists "sharing the risk" as a primary option. The explanatory note for this option states that risk sharing involves "agreeing with another party or parties to bear or share the risk" and can be achieved through mechanisms including "contracts, insurance."

2. Leitch, M. (2010). ISO 31000:2009 The new international standard on risk management. Risk Management, 12(3), 162-181. In the section discussing risk treatment (p. 175), the paper outlines that risk sharing (or transfer) is a key strategy where a third party takes on the risk, with insurance being the most common form of this treatment.

3. University of Queensland. (n.d.). UQ Risk Management Framework. In its documentation aligning with ISO 31000, the university's risk treatment guidelines categorize "Transfer (Share)" as a control type, defining it as "transferring or sharing a risk with another party who is more willing or better equipped to manage it," and lists "insurance" as the primary example. (See Section: Risk Treatment and Controls).

In the ISO 31000:2018 framework, 'monitoring and review' is an integral activity that occurs continuously and concurrently throughout all stages of the risk management process. Its purpose is to assure and improve the quality and effectiveness of the process design, implementation, and outcomes. By checking for changes in context, validating assumptions, and assessing the effectiveness of risk treatments, it provides crucial information that is fed back into the system. This allows for dynamic adjustments and continuous improvement, making it function as a classic feedback loop rather than a discrete, final stage.

A. It is not an "extra" or sequential stage but an activity that is integrated and performed throughout the entire process.

C. It is a distinct activity that applies to the whole process, including risk assessment, not just a sub-component of it.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 6.6, "Monitoring and review," states: "Monitoring and review should take place at all stages of the risk management process... The results of monitoring and review should be recorded and reported... and should also be used as an input to the review of the risk management framework." This describes a feedback mechanism.

Figure 4, "Process," visually depicts "Monitoring and review" as a central activity that runs parallel to all other process steps (Scope, Context, Criteria; Risk Assessment; Risk Treatment), reinforcing that it is not a single stage but a continuous, overarching function.

2. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Page 280: The authors discuss the iterative nature of the ISO 31000 process, noting that "monitoring and review... make it possible to ensure that the controls are effective and efficient in practice... and to learn lessons from events." This learning and adjustment function is the essence of a feedback loop. DOI: https://doi.org/10.1057/rm.2012.9

3. University of Queensland. (n.d.). Enterprise Risk Management Framework.

Section 4.2, "Risk Management Process": In its implementation of ISO 31000, the university's framework document describes monitoring and review as a step to "review and monitor risks, controls and treatments; and learn from experience." This learning aspect, which informs future risk management activities, is characteristic of a feedback loop.

According to ISO 31000:2018, risk is defined as the "effect of uncertainty on objectives." This definition is central to the entire standard. Therefore, when managing and controlling risk, an organization must fundamentally address and take into account the various uncertainties it faces. The process of risk management is designed to identify, analyze, and evaluate these uncertainties to understand their potential impact on the organization's goals. Ignoring uncertainty would mean ignoring the very nature of risk itself, rendering any management effort ineffective.

A. Risk perception is a critical component of the "Human and cultural factors" principle in ISO 31000, which significantly influences how risk is identified and managed.

B. Effective risk management requires establishing both the internal and external context, making a focus on internal controls alone insufficient and incomplete.

D. This statement is the direct opposite of the ISO 31000 definition of risk, which is fundamentally centered on the concept of uncertainty.

1. ISO 31000:2018, Risk management — Guidelines, Clause 3.1, "Terms and definitions". This clause explicitly defines risk as the "effect of uncertainty on objectives."

2. ISO 31000:2018, Risk management — Guidelines, Clause 4, "Principles". This section lists "Human and cultural factors" as a key principle, and Clause 6.3, "Establishing the context," mandates consideration of both external and internal environments.

3. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. On page 882, the author states, "The most important feature of the new definition is that risk is defined in relation to uncertainty..." This peer-reviewed article confirms that uncertainty is the core concept. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. The paper discusses how the standard frames risk management as a process to deal with uncertainty, stating, "the ISO 31000 standard defines risk as the 'effect of uncertainty on objectives'" (p. 275). DOI: https://doi.org/10.1057/rm.2012.9