Free ISO-31000-CLA Practice Test Questions and Answers (2026)

The primary role of risk management in the strategic planning process is to identify and analyze the uncertainties that could affect the achievement of an organization's objectives. According to ISO 31000, risk is the "effect of uncertainty on objectives." This uncertainty can manifest as potential threats (negative effects) or opportunities (positive effects). By systematically identifying these factors during strategic planning, an organization can set more realistic objectives, develop robust strategies to manage threats, and create plans to capitalize on opportunities, thereby creating and protecting value. This integration ensures that the strategy is not developed in a vacuum but is informed by a clear understanding of the internal and external risk landscape.

A. Challenging decisions is a function of governance that risk management supports, but its core role in planning is to provide information for making decisions, not just to challenge them after the fact.

B. Developing risk treatment plans is a subsequent step in the risk management process (risk treatment) that occurs after risks have been identified, analyzed, and evaluated in relation to the strategy.

C. Drafting the decisions is the responsibility of senior management and the board. Risk management's role is to provide critical input and analysis to inform those decisions, not to draft them.

1. ISO 31000:2018, Risk management — Guidelines.

Clause 4, Principles: States that risk management "Creates and protects value" and should be an "integral part of all organizational processes," including "strategy and planning."

Clause 5.4.1, Integrating risk management into organizational processes: Emphasizes that risk management should be part of decision-making, including the setting of strategy and objectives.

Clause 6.4.2, Risk identification: This clause specifies the process of "finding, recognizing and describing risks." The purpose is to generate a comprehensive list of risks based on those events that might "create, enhance, prevent, degrade, accelerate or delay the achievement of objectives." This directly corresponds to identifying threats and opportunities.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Page 884, Section 4. Principles of Risk Management: The article explains that a key principle of ISO 31000 is its integration into organizational processes. It states, "Risk management is not a stand-alone activity... It is part of the responsibilities of management and an integral part of all organizational processes, including strategic planning..." This integration is achieved by providing the information needed to understand potential threats and opportunities related to strategic choices. (https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Page 280: The authors discuss how ISO 31000 positions risk management as a tool for decision-making and achieving objectives. They note that the standard's process begins with establishing the context, which includes defining strategic objectives, and then moves to risk assessment (identification, analysis, evaluation), which inherently involves considering events that could help or hinder those objectives (opportunities and threats). (https://doi.org/10.1057/rm.2012.9)

Systemic risk refers to the potential for an event to trigger a cascade of failures or major disruptions throughout an entire system, such as a financial market, an industry, or the economy. It is not about the failure of a single entity but the risk that the failure of one or more components will spread and cause the entire system to collapse or function improperly. This contagion effect threatens the stability and operation of the whole system, leading to severe and widespread consequences.

A. This describes interconnectedness risk or internal contagion within a single organization, not the failure of an entire market or system.

B. This is a specific type of supply chain risk for one organization, which is a component of operational risk, not the definition of systemic risk.

C. This defines a key-person or human capital risk, which is an internal operational risk confined to a specific organization.

1. Schwarcz, S. L. (2008). Systemic Risk. The Georgetown Law Journal, 97(1), 193-249. The introduction (p. 193) defines systemic risk as "a risk that an event will trigger a loss of economic value or confidence in, and collapse of, a substantial part of the financial system."

2. De Bandt, O., & Hartmann, P. (2000). Systemic Risk: A Survey. European Central Bank Working Paper No. 35. Section 2, "What is Systemic Risk?", discusses systemic risk as an event that triggers a chain reaction of failures affecting a large portion of the financial system.

3. International Monetary Fund (IMF). (2009). Global Financial Stability Report: Responding to the Financial Crisis and Measuring Systemic Risks. Chapter 3, "Measuring Systemic Risks," defines systemic risk as "a risk of disruption to financial services that is caused by an impairment of all or parts of the financial system and has the potential to have serious negative consequences for the real economy." (p. 103).

ISO 17776:2016 provides specific guidelines and a structured approach for hazard identification and risk assessment. While its primary application is for major accident hazards in offshore petroleum and natural gas production installations, it details a comprehensive set of tools and techniques (e.g., HAZID, HAZOP, FMECA) that are widely recognized and applied in various industries for these purposes. It serves as a practical guide for implementing the risk assessment component of the broader risk management framework described in ISO 31000.

A. ISO 15776: This standard specifies requirements for personal flotation devices and is unrelated to risk assessment methodologies.

B. ISO 16776: This standard details test methods for determining the effects of daylight on plastics, not hazard identification.

D. ISO 18776: This standard provides rules for the construction and installation of elevators in existing buildings, not risk management.

1. International Organization for Standardization. (2016). ISO 17776:2016: Petroleum and natural gas industries — Offshore production installations — Guidelines and tools for hazard identification and risk assessment of major accidents. ISO. The scope and introduction sections (Clauses 1 and 4) explicitly define the standard's purpose for hazard identification and risk assessment.

2. Vinnem, J. E. (2014). Offshore Risk Assessment: Principles, Modelling and Applications of QRA Studies (3rd ed.). Springer. Chapter 4, "Hazard Identification," extensively references ISO 17776 as the primary standard for HAZID studies in the offshore industry (pp. 85-87).

3. Rausand, M. (2011). Risk Assessment: Theory, Methods, and Applications. John Wiley & Sons. In Chapter 6, "Hazard Identification," ISO 17776 is cited as a key source for systematic hazard identification techniques (p. 189). https://doi.org/10.1002/9781118281117

The fundamental distinction between pure and speculative risk lies in their potential outcomes. A pure risk presents only the possibility of a loss or no loss, with no opportunity for financial gain. Examples include natural disasters, accidents, or property damage. Conversely, a speculative risk is undertaken voluntarily with the prospect of either a gain or a loss. Financial investments, business ventures, and gambling are classic examples of speculative risks where the outcome can be positive, negative, or neutral.

A. The cause is not the defining characteristic; a pure risk can be caused by human error (e.g., an accident), and a speculative risk can be influenced by environmental factors (e.g., weather affecting crop futures).

B. Both pure and speculative risks can often be analyzed and measured using probability. Actuarial science measures pure risks, while financial modeling assesses speculative risks.

C. Both types of risk can be subject to regulatory control. For example, workplace safety regulations address pure risks, while securities and exchange commissions regulate speculative financial risks.

1. Hopkin, P. (2018). Fundamentals of Risk Management: Understanding, Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page. In Chapter 1, "Introduction to risk management," the text distinguishes between pure risk (downside risk) and speculative risk (upside and downside risk), stating, "Pure risk is associated with the possibility of a loss or no loss... Speculative risk is associated with the possibility of a gain or a loss." (p. 12).

2. Redja, G. E., & McNamara, M. J. (2017). Principles of Risk Management and Insurance (13th ed.). Pearson. Chapter 1, "Risk and Its Treatment," defines pure risk as "a situation in which there are only the possibilities of loss or no loss" and speculative risk as "a situation in which either profit or loss is possible." (p. 6).

3. University of Texas at Austin, McCombs School of Business. (n.d.). Risk Management and Insurance: Module 1 - The Problem of Risk. In this courseware, pure risk is defined by the outcomes of loss/no loss, while speculative risk is defined by the outcomes of loss/gain. This distinction is presented as a foundational concept in risk classification. (Section: "Classification of Risk").

Modern internal auditing, particularly when aligned with risk management frameworks like ISO 31000, has shifted from a transactional or compliance-based focus to a risk-based, process-oriented approach. The primary objective is to provide assurance that an organization's governance, risk management, and internal control processes are effective. Auditors spend the majority of their time evaluating the design and operational effectiveness of business processes to determine if they are achieving strategic objectives and managing key risks. Audits of people, technology, and infrastructure are typically performed within the context of these overarching business processes.

A. People: Audits focus on the systems and processes people operate within, and the controls governing their actions, rather than auditing individuals directly.

C. Technology: While IT auditing is a critical and growing specialty, technology is fundamentally an enabler of business processes. IT audits are often conducted to support broader process-level reviews.

D. Infrastructure: This is too specific and narrow. Auditing physical or IT infrastructure is a component of a larger operational or IT audit, which falls under the umbrella of process auditing.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 2100 – Nature of Work. This standard explicitly states, "The internal audit activity must evaluate and contribute to the improvement of the organization’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach." This establishes "process" as the core subject of internal audit work.

2. International Organization for Standardization. (2018). ISO 31000:2018 Risk management — Guidelines. Clause 6, "Process". The standard itself is structured around the risk management process. The role of internal audit is to provide assurance over this process and its application to the organization's other business processes.

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. Chapter 1, "Introduction to Internal Auditing," describes the evolution of the profession toward a process-based, risk-oriented, and proactive model, moving away from a purely financial and compliance focus. The textbook frames the audit universe in terms of business processes.

The primary objective of conducting a supply-chain analysis from a risk management perspective is to systematically identify and assess potential vulnerabilities. These vulnerabilities are weaknesses or points of failure within the supply chain—such as over-reliance on a single supplier, geopolitical instability, logistical bottlenecks, or lack of visibility—that could be exploited by a threat or trigger a disruption. By identifying these vulnerabilities, an organization can understand its risk exposure and develop appropriate strategies to mitigate, transfer, or accept the risks, thereby enhancing its resilience and ability to achieve its objectives. This process is a core component of risk identification as outlined in the ISO 31000 framework.

A. contingent business interruption coverage. This is a form of risk treatment (insurance) that an organization might purchase after identifying a vulnerability; it is not the purpose of the analysis itself.

B. customer technology needs. Identifying customer needs is typically the function of market research, sales, or product development, not a supply-chain risk analysis, which focuses on operational continuity.

C. international regulatory requirements. While regulatory non-compliance is a potential risk, it is only one of many vulnerabilities a supply-chain analysis seeks to identify. This answer is too narrow.

1. ISO 31000:2018, Risk management — Guidelines. Clause 6.4.2, "Risk identification," states that the purpose is to "find, recognize and describe risks that might help or prevent an organization achieving its objectives." It further suggests that this process should consider a wide range of factors, including the organization's "relationships with, and perceptions and values of, external stakeholders," which directly encompasses the supply chain. The analysis of the supply chain is a method to fulfill this requirement by identifying potential disruptions (vulnerabilities).

2. Sheffi, Y. (2005). The Resilient Enterprise: Overcoming Vulnerability for Competitive Advantage. MIT Press. In Chapter 2, "The Nature of Disruptions," Sheffi emphasizes that the first step in building resilience is understanding and identifying vulnerabilities throughout the supply chain. The book, a foundational text from a leading academic institution, frames supply-chain analysis as a critical tool for discovering these hidden weaknesses before they lead to a crisis.

3. Jüttner, U., Peck, H., & Christopher, M. (2003). Supply chain vulnerability: An investigation of the sources and drivers. International Journal of Logistics Management, 14(1), 1-18. This peer-reviewed article defines supply chain vulnerability as an organization's exposure to serious disturbances. The authors argue that a key management task is to conduct analyses to identify the sources of risk and drivers of vulnerability within the supply network and its external environment (p. 12). DOI: https://doi.org/10.1108/09574090310806479

The scenario describes risk aggregation, which is the process of combining multiple individual risks or losses to understand the total, consolidated impact of an event or a set of circumstances. In this case, the numerous injury claims and the loss of revenue are distinct financial consequences stemming from the single event of the train crash. By considering them together, the train operator is aggregating these losses to determine the overall financial and operational impact, which is a core concept in risk analysis.

B. risk categorisation: This is the process of grouping risks based on their source or nature (e.g., financial, operational, strategic), not summing the consequences of an event that has already occurred.

C. risk probability: This refers to the likelihood of an event happening. The train crash has already occurred, so the focus is on its consequences, not its probability.

D. risk severity: This describes the magnitude of the impact of a risk. While the situation is severe, "aggregation" specifically refers to the act of combining multiple distinct losses.

1. ISO Guide 73:2009, Risk management — Vocabulary.

Reference: Definition 3.8.1.6.

Content: Defines "risk aggregation" as the "combination of a number of risks into a single risk." The scenario perfectly illustrates this by combining the numerous claims (a number of risks/losses) and the revenue loss into a single, overall impact of the crash.

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Reference: Page 884, Section on "The Risk Management Process."

Content: The article discusses the ISO 31000 risk management process, which includes risk analysis. A key part of analysis is understanding the full scope of consequences. Aggregating various impacts (like injury claims and revenue loss) is essential to properly analyze the magnitude of the risk and inform the risk evaluation step, aligning with the principles of a comprehensive approach advocated by the standard. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch, M. (2010). ISO 31000:2009 - The new international standard on risk management. Risk Management, 12(4), 162-181.

Reference: Page 174.

Content: The paper explains that understanding the "causes and sources of risk, their positive and negative consequences, and the likelihood that those consequences can occur" is central to risk analysis under ISO 31000. Aggregating the various negative consequences from a single event is a practical application of this principle to determine the overall level of risk.

The statement is false. ISO 31000:2018 provides high-level principles and a framework for risk management, emphasizing its integration into an organization's overall governance, strategy, and decision-making. Its focus is fundamentally strategic, not tactical. The standard is intentionally non-prescriptive and does not dictate specific operational processes or tactical actions. Instead, it guides organizations on how to establish a strategic context for managing risk and empowers them to design and implement their own customized, tactical processes that fit their specific objectives and environment.

A. True: This is incorrect because the standard's core purpose is to provide a strategic framework and guiding principles, deliberately avoiding the prescription of specific tactical or process-level details.

1. ISO 31000:2018, Risk management — Guidelines. Introduction, p. v: "This document provides guidelines on managing risk faced by organizations... Applying these guidelines can be customized to any organization and its context." This highlights its non-prescriptive, high-level nature.

2. ISO 31000:2018, Risk management — Guidelines. Clause 4, Principles: The principles, such as being "Integrated" into all organizational activities and "Customized," confirm the standard's strategic and framework-oriented focus rather than a one-size-fits-all tactical approach.

3. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. While analyzing the 2009 version, this paper establishes the standard's foundational strategic nature, which was enhanced in the 2018 revision. It states, "It is not a 'how-to' book with detailed instructions... it is a high-level standard that sets out what should be achieved" (p. 882).

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. https://doi.org/10.1057/rm.2012.9. This analysis emphasizes the standard's "managerial and strategic orientation" and its goal to integrate risk management into "the overall governance, strategy and planning" (p. 274), contrasting it with more procedural or tactical approaches.

The OCEG (Open Compliance and Ethics Group) GRC Capability Model defines risk management as one of its core components. This definition emphasizes a proactive approach to dealing with uncertainty. Specifically, it is the capability to identify, assess, and address uncertainties and potential obstacles that could impact the achievement of an organization's objectives. This aligns directly with the principle that risk is the effect of uncertainty on objectives, a concept central to modern risk management frameworks like ISO 31000.

A. This describes the Governance component of the OCEG GRC model, which is concerned with directing and controlling the organization by setting objectives and monitoring performance.

C. This is the definition of the Compliance component within the OCEG GRC model, which focuses on adhering to mandatory requirements (laws, regulations) and voluntary obligations.

1. OCEG. (2015). GRC Capability Model, Version 3.0. Section 2.2, "The GRC Capability Model Components," p. 16. "Risk Management: The capability to proactively identify, assess, and address uncertainty and potential obstacles to achieving objectives."

2. Racz, N., Weippl, E., & Seufert, A. (2010). A frame of reference for research of integrated governance, risk, and compliance (GRC). Proceedings of the Annual Hawaii International Conference on System Sciences, 1-10. The paper explicitly references and builds upon the OCEG definitions, stating, "Risk management is the capability to address uncertainty and to identify and assess risks to the achievement of objectives." (Section 3.2). DOI: 10.1109/HICSS.2010.354

3. University of South Florida. (n.d.). Course ISM 6328: Information Security and Risk Management. Course materials often reference the OCEG model, defining its components. The course syllabus and lecture notes distinguish between Governance (setting objectives), Risk (addressing uncertainty), and Compliance (adhering to rules), consistent with the OCEG framework.

Inclusiveness is a fundamental principle of effective risk management as defined by the ISO 31000:2018 standard. This principle mandates the appropriate and timely involvement of stakeholders throughout the risk management process. By considering the diverse knowledge, perspectives, and perceptions of those involved or affected, an organization can achieve improved awareness and create a more robust and relevant risk management framework. This collaborative approach ensures that risks are comprehensively identified, analyzed, and treated, leading to better-informed decision-making and the successful achievement of objectives.

B. False: This is incorrect because ISO 31000:2018, the global guideline for risk management, explicitly lists "Inclusive" as one of the eight core principles for creating and protecting value.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4, "Principles". This section lists "Inclusive" as a key principle for effective risk management.

2. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4.5, "Inclusive". This sub-clause specifies that "Appropriate and timely involvement of stakeholders enables their knowledge, views and perceptions to be considered. This results in improved awareness and informed risk management."

3. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. The paper discusses the principles of ISO 31000, including inclusiveness, as foundational to the standard's approach to managing risk effectively (p. 276). https://doi.org/10.1057/rm.2012.9

4. University of Queensland. (n.d.). Enterprise Risk Management Framework. The framework, based on ISO 31000:2018, outlines the university's commitment to the principles of risk management, stating, "Our risk management approach is... Inclusive: We engage with our stakeholders to understand their perspectives and involve them in decision-making." (Section 3.2, Principles).

The statement is true. According to ISO 31000:2018, one of the core principles of effective risk management is that it must be "customized." This is synonymous with being "tailored." The risk management framework and its processes should be adapted and proportionate to the organization's specific external and internal context, including its objectives, culture, and complexity. A generic, one-size-fits-all approach is explicitly discouraged by the standard, as it would fail to address the unique risks and opportunities an organization faces.

B. False: This is incorrect. The ISO 31000:2018 standard explicitly lists "Customized" as a key principle, meaning a non-tailored or generic approach contradicts the standard's guidance for effective risk management.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Section 4, "Principles." The standard lists "Customized" as a principle, stating: "The risk management framework and process are customized and proportionate to the organization’s external and internal context related to its objectives."

2. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886. In the discussion of the principles (which were carried over to the 2018 version), the article emphasizes that risk management must be tailored to the specific needs and context of the organization. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x, Page 883).

3. University of Queensland. (n.d.). Enterprise Risk Management Framework. This document, based on ISO 31000, outlines the university's risk management principles, including: "Tailored – our risk management framework and processes are customised and proportionate to the University’s internal and external context." (Section 3.1, "Principles").

The statement is true. A core principle of the ISO 31000 standard is "Continual improvement." This principle mandates that an organization's risk management framework, processes, and overall capabilities should be dynamically improved through learning and experience. "Enhanced risk management" is the direct outcome of applying this principle. It signifies a mature approach where risk management evolves beyond a static process into a continuously refined capability that adds value and supports the achievement of organizational objectives. This iterative enhancement ensures that risk management remains relevant and effective in a changing environment.

B. False: This is incorrect because it contradicts the fundamental principle of "Continual improvement" as explicitly stated in Clause 4 of the ISO 31000:2018 standard.

1. ISO 31000:2018, Risk management — Guidelines, Clause 4, Principles. Principle (h) states: "Continual improvement. Risk management is continually improved through learning and experience." This directly supports the premise that enhancing capabilities is a core emphasis.

2. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. In Section 3, "The Principles of Risk Management," the author discusses how the principle of continual improvement is essential for the framework's effectiveness, leading to enhanced organizational performance. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)

3. University of Sydney. (n.d.). Risk Management Framework and Policy. In the section on "Risk Management Principles," the university's framework, based on ISO 31000, lists "Continual improvement" as a key principle, stating the University is committed to continually improving its risk management practices. This demonstrates the application of the principle to enhance capabilities.

The landscape of risk management has been fundamentally reshaped by advancements in technology, the expansion of globalization, and major shifts in finance. Technology introduced systemic risks like cybersecurity threats. Globalization created complex international supply chains and geopolitical exposures. The 2008 financial crisis was a major catalyst that elevated the importance and regulation of financial risk management globally.

While global warming and climate change are now recognized as critical, systemic risks, their widespread integration into mainstream corporate Enterprise Risk Management (ERM) frameworks is a more recent development compared to the other three factors. The dramatic changes driven by technology, globalization, and finance have been influencing the core practices of risk management for a longer period.

A. Technology: The digital revolution created entirely new and pervasive risk domains, such as cybersecurity and data privacy, which have fundamentally altered risk management practices.

B. Globalization: The creation of interconnected global markets and supply chains has made risk management significantly more complex, introducing new geopolitical and operational risks.

D. Finance: The 2008 global financial crisis and the increasing complexity of financial instruments were pivotal events that forced a dramatic evolution in risk management theory and practice.

1. COSO (Committee of Sponsoring Organizations of the Treadway Commission). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. The executive summary and subsequent chapters discuss the evolution of ERM in response to a changing business landscape. It explicitly notes drivers such as "The proliferation of data and technology" and "The increasing complexity of business" (related to globalization). While it introduces the importance of ESG, the framework's evolution is heavily rooted in the longer-standing technological, strategic, and financial shifts.

2. World Economic Forum. (2023). The Global Risks Report 2023. This report, and its preceding editions, illustrates the shifting risk landscape. While environmental risks like "Failure to mitigate climate change" now dominate the long-term outlook (p. 6, Figure 1), reports from a decade prior (e.g., 2013) were more focused on economic and financial risks like "Major systemic financial failure." This demonstrates the more recent ascent of climate change as a primary driver in the global risk discourse compared to established financial concerns.

3. ISO 31000:2018, Risk management — Guidelines. Clause 5.4.1, "Understanding the organization and its context," requires organizations to consider the external environment, which includes "financial, technological, economic, natural and competitive" factors. While the standard acknowledges the natural environment as a source of risk, academic and industry literature confirms that the dramatic, practice-altering changes from technology, globalization, and finance have a longer history in shaping modern ERM.

In the context of business process management, which is fundamental to integrating risk management per ISO 31000, organizational processes are broadly categorized into two types. 'Hard processes' are well-defined, repeatable, and often automated or technology-driven, such as manufacturing assembly lines or automated financial transactions. 'People processes' (also known as soft processes) are less structured and rely heavily on human skills, judgment, and interaction, such as strategic planning, research and development, or collaborative design. An effective integrated risk management framework must encompass both of these process types to be comprehensive.

B. Soft processes: This term is often used synonymously with 'people processes'. However, 'people processes' is a more descriptive and commonly used term in this dichotomy, making it the better choice.

D. Quality analysis: This is a specific task or a set of techniques applied within a process (e.g., a quality management process). It is not a fundamental category of process itself.

1. Checkland, P. (1999). Systems Thinking, Systems Practice: Includes a 30-Year Retrospective. John Wiley & Sons. In Part 2, Checkland extensively discusses the distinction between 'hard' systems thinking, applicable to well-defined, technical problems (aligning with hard processes), and 'soft' systems methodology, designed for complex, human-centric problem situations (aligning with people processes).

2. Harmon, P. (2014). Business Process Change: A Business Process Management Guide for Managers and Process Professionals (3rd ed.). Morgan Kaufmann. In Chapter 2, Harmon discusses the nature of business processes, distinguishing between highly structured, repeatable work and unstructured, knowledge-based work, which corresponds to the hard process vs. people process classification.

3. Ould, M. A. (2005). Business Process Management: A Rigorous Approach. British Computer Society. Chapter 3, "What is a Process?", differentiates between processes that are highly deterministic and automatable ('hard') and those that are dependent on the expertise and discretion of people ('soft' or 'people' processes).

Enhanced Risk Management (ERM) describes a mature and integrated approach where risk management is embedded into an organization's governance, strategy, and decision-making processes. Its primary goal is to proactively manage the "effect of uncertainty on objectives," which is the definition of risk according to ISO 31000. By enhancing risk management, an organization moves beyond simple compliance to use the framework as a strategic tool to improve performance, foster innovation, and ensure its objectives are met. This aligns directly with the purpose of risk management as defined in the ISO 31000 standard, which is to create and protect value.

A. Extended risk management: This is not a standard or formally recognized term within the ISO 31000 framework or mainstream risk management literature.

C. Evasive risk management: This is not a recognized term. The word "evasive" implies avoiding responsibility, which is contrary to the proactive and accountable principles of ISO 31000.

D. Avoidance risk management: Risk avoidance is a specific risk treatment option (i.e., deciding not to pursue an activity), not a comprehensive management system for achieving all organizational objectives.

1. ISO 31000:2018, Risk management — Guidelines, Clause 4, Principles. The standard states, "The purpose of risk management is the creation and protection of value. It improves performance, encourages innovation and supports the achievement of objectives." An "enhanced" system is one that successfully fulfills this purpose.

2. Leitch, M. (2010). "ISO 31000:2009—The new international standard on risk management". Risk Analysis: An International Journal, 30(6), 887-892. The paper discusses how the standard provides a basis for organizations to improve and enhance their risk management practices to better support the achievement of objectives (p. 888, Section 2). DOI: https://doi.org/10.1111/j.1539-6924.2010.01426.x

3. Purdy, G. (2010). "ISO 31000:2009—Setting a New Standard for Risk Management". Risk Analysis, 30(6), 881-886. This article explains that ISO 31000 is designed to help organizations enhance the likelihood of achieving objectives by managing uncertainty effectively (p. 882, Introduction). DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

A DBMS (Database Management System) and an RDBMS (Relational Database Management System) are software systems designed to create, store, retrieve, and manage data in a structured manner. The data stored within these systems constitute an organization's official records. The various outputs and system components, such as logs, reports, data dictionaries, and database schemas, are considered artifacts. These systems provide the technological foundation for the "recording and reporting" activities mandated by management system standards like ISO 31000, ensuring that evidence of processes and decisions is captured and maintained.

A. RBPS (Risk-Based Process Safety) and RBDM (Risk-Based Decision Making) are management processes or frameworks, not the technological systems that directly create and store records.

C. TDMS (Test Data Management System) and VSMS (Vendor Security Management System) are highly specialized systems; DBMS/RDBMS are the more fundamental and universal technologies for record-keeping.

D. MOS (Management Operating System) and SMOS (Safety Management Operating System) are conceptual frameworks for management, which would utilize other systems to generate their required artifacts and records.

1. Elmasri, R., & Navathe, S. B. (2017). Fundamentals of Database Systems (7th ed.). Pearson.

Page 5, Section 1.2: Defines a database as a collection of related data and a DBMS as a "computerized system that enables users to create and maintain a database." The data itself represents records, and the system's metadata (catalog/dictionary) and logs are artifacts of its operation.

2. ISO 15489-1:2016, Information and documentation — Records management — Part 1: Concepts and principles.

Section 3.15: Defines a record as "information created, received, and maintained as evidence and as an asset by an organization...".

Section 8.3.2: Discusses designing and implementing systems for records, stating that "Business systems, including business applications... should be designed... to create and manage authoritative records." DBMS and RDBMS are the core technologies for such business systems.

3. Stanford University, CS145: Introduction to Databases (Courseware).

Lecture 1 Notes: Typically describe a DBMS as a software package designed to store and manage databases. The course explains how these systems manage data (records) and generate logs, schemas, and other outputs (artifacts) essential for data integrity and auditing. The system's function is explicitly the management of records.

Pure risk is a category of risk where the only possible outcomes are loss or no loss; there is no opportunity for financial gain. A fire in a manufacturing line is a classic example of a pure risk. If the fire occurs, the organization suffers a loss (e.g., damaged equipment, business interruption). If the fire does not occur, the organization's state remains unchanged (no loss). The other options represent speculative risks, which are taken on voluntarily and involve three potential outcomes: loss, no loss, or gain. These are typically associated with business or financial decisions.

B. entering into a contract to purchase a new factory.

This is a speculative risk. The purchase is an investment made with the expectation of gain (profit), but it also carries the risk of financial loss.

C. making a strategic decision that affects the long-term future of the organisation.

This is inherently a speculative risk. Strategic decisions are undertaken to achieve positive outcomes (gain), but they always involve uncertainty and the possibility of negative consequences (loss).

D. the purchase of a currency derivative.

This is a financial or speculative risk. Derivatives are used to either speculate for a profit (gain) or to hedge against a potential loss, both of which involve possibilities beyond just loss/no loss.

1. Rejda, G. E., & McNamara, M. J. (2017). Principles of Risk Management and Insurance (13th ed.). Pearson. In Chapter 1, "Risk and Its Treatment," the text defines pure risk as "a situation in which there are only the possibilities of loss or no loss" (p. 6). It contrasts this with speculative risk, which involves the possibility of profit or loss.

2. Vaughan, E. J., & Vaughan, T. (2013). Fundamentals of Risk and Insurance (11th ed.). John Wiley & Sons. Chapter 1, "The Problem of Risk," distinguishes between pure and speculative risk, stating, "Pure risk involves the chance of loss or no loss only... Speculative risk describes a situation where there is a possibility of loss but also a possibility of gain" (p. 8).

3. University of Georgia, Terry College of Business. (n.d.). RMIN 4000: Risk Management and Insurance Courseware. The curriculum defines pure risks as those that are "loss or no loss" situations, typically related to accidental or unforeseen events like fires, floods, and accidents, which are often insurable. Speculative risks are defined as those involving a chance of gain, such as investment and strategic decisions.

Insurance is a classic example of the risk sharing (also known as risk transfer) technique. This risk treatment option involves contractually shifting the financial consequences of a potential loss from one party (the insured) to another (the insurer). In exchange for a premium, the insurer agrees to bear the specified risk, pooling it with the risks of other policyholders. This mechanism does not eliminate or reduce the likelihood of the risk event itself but reallocates the financial burden, which is the core principle of risk sharing as defined within the ISO 31000 framework.

B. Reduction: This technique, also called risk mitigation, involves actions to decrease the probability or negative impact of a risk event, such as installing a fire suppression system. Insurance does not reduce the event's likelihood.

C. Retention: This technique involves knowingly and willingly accepting the loss or financial impact if a risk event occurs. Insurance is the opposite; it is a method to transfer financial responsibility, not retain it.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Clause 6.5.2, "Selection of risk treatment options," explicitly lists "sharing the risk" as a primary option. The explanatory note for this option states that risk sharing involves "agreeing with another party or parties to bear or share the risk" and can be achieved through mechanisms including "contracts, insurance."

2. Leitch, M. (2010). ISO 31000:2009 The new international standard on risk management. Risk Management, 12(3), 162-181. In the section discussing risk treatment (p. 175), the paper outlines that risk sharing (or transfer) is a key strategy where a third party takes on the risk, with insurance being the most common form of this treatment.

3. University of Queensland. (n.d.). UQ Risk Management Framework. In its documentation aligning with ISO 31000, the university's risk treatment guidelines categorize "Transfer (Share)" as a control type, defining it as "transferring or sharing a risk with another party who is more willing or better equipped to manage it," and lists "insurance" as the primary example. (See Section: Risk Treatment and Controls).

In the ISO 31000:2018 framework, 'monitoring and review' is an integral activity that occurs continuously and concurrently throughout all stages of the risk management process. Its purpose is to assure and improve the quality and effectiveness of the process design, implementation, and outcomes. By checking for changes in context, validating assumptions, and assessing the effectiveness of risk treatments, it provides crucial information that is fed back into the system. This allows for dynamic adjustments and continuous improvement, making it function as a classic feedback loop rather than a discrete, final stage.

A. It is not an "extra" or sequential stage but an activity that is integrated and performed throughout the entire process.

C. It is a distinct activity that applies to the whole process, including risk assessment, not just a sub-component of it.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Section 6.6, "Monitoring and review," states: "Monitoring and review should take place at all stages of the risk management process... The results of monitoring and review should be recorded and reported... and should also be used as an input to the review of the risk management framework." This describes a feedback mechanism.

Figure 4, "Process," visually depicts "Monitoring and review" as a central activity that runs parallel to all other process steps (Scope, Context, Criteria; Risk Assessment; Risk Treatment), reinforcing that it is not a single stage but a continuous, overarching function.

2. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300.

Page 280: The authors discuss the iterative nature of the ISO 31000 process, noting that "monitoring and review... make it possible to ensure that the controls are effective and efficient in practice... and to learn lessons from events." This learning and adjustment function is the essence of a feedback loop. DOI: https://doi.org/10.1057/rm.2012.9

3. University of Queensland. (n.d.). Enterprise Risk Management Framework.

Section 4.2, "Risk Management Process": In its implementation of ISO 31000, the university's framework document describes monitoring and review as a step to "review and monitor risks, controls and treatments; and learn from experience." This learning aspect, which informs future risk management activities, is characteristic of a feedback loop.

According to ISO 31000:2018, risk is defined as the "effect of uncertainty on objectives." This definition is central to the entire standard. Therefore, when managing and controlling risk, an organization must fundamentally address and take into account the various uncertainties it faces. The process of risk management is designed to identify, analyze, and evaluate these uncertainties to understand their potential impact on the organization's goals. Ignoring uncertainty would mean ignoring the very nature of risk itself, rendering any management effort ineffective.

A. Risk perception is a critical component of the "Human and cultural factors" principle in ISO 31000, which significantly influences how risk is identified and managed.

B. Effective risk management requires establishing both the internal and external context, making a focus on internal controls alone insufficient and incomplete.

D. This statement is the direct opposite of the ISO 31000 definition of risk, which is fundamentally centered on the concept of uncertainty.

1. ISO 31000:2018, Risk management — Guidelines, Clause 3.1, "Terms and definitions". This clause explicitly defines risk as the "effect of uncertainty on objectives."

2. ISO 31000:2018, Risk management — Guidelines, Clause 4, "Principles". This section lists "Human and cultural factors" as a key principle, and Clause 6.3, "Establishing the context," mandates consideration of both external and internal environments.

3. Purdy, G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal, 30(6), 881-886. On page 882, the author states, "The most important feature of the new definition is that risk is defined in relation to uncertainty..." This peer-reviewed article confirms that uncertainty is the core concept. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

4. Lalonde, C., & Boiral, O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management, 14(4), 272-300. The paper discusses how the standard frames risk management as a process to deal with uncertainty, stating, "the ISO 31000 standard defines risk as the 'effect of uncertainty on objectives'" (p. 275). DOI: https://doi.org/10.1057/rm.2012.9