Pass the GAQM: ISO ISO-31000-CLA Questions and answers with ExamsMirror

A pure risk only leads to the possibility of a loss, whereas a speculative risk may lead to a gain12. For example, entering into a contract to purchase a new factory is a speculative risk, as it could result in either profit or loss depending on market conditions.

ISO 31000:2018 offers a generic outline for the design of the risk management framework and process. ISO 31000:2018 provides guidelines that can be adapted to any organization’s situation and circumstances.

ISO 31000:2018 risk management process is descriptive6. This means that it provides guidance on what should be done for effective risk management, but not how it should be done. The process can be customized to any organization and its context.

A business interruption review is an evaluation of the effectiveness of a business continuity plan, which is a set of procedures and resources to ensure that an organisation can continue its critical functions in the event of a disruption12.

According to 3, a captive insurance company is “a wholly owned subsidiary insurer that provides risk mitigation services for its parent company or related entities”. It can act as a reinsurer by accepting risks from other insurers or captives 1. It can also access reinsurance markets to transfer some of its own risks 1. It can sometimes offer greater cover than is available in the insurance market by tailoring its policies to suit its parent’s needs 3. It does not have to be located in the same country as its parent company; in fact, many captives are domiciledoffshore for tax or regulatory reasons 4.

Systematic means doing something according to a plan or method. Systematic implies orderliness, consistency, and rigor in applying risk management.

According to 1, ISO 31000 is a family of standards relating to risk management codified by the International Organization for Standardization (ISO). It provides principles and guidelines on managing risks that could affect organizations.

According to 1, there are four types of potential risk strategies for threats: avoid (eliminate or change), transfer (share or outsource), mitigate (reduce or control), accept (retain or monitor). There are also four types of potential risk strategies for opportunities: exploit (ensure or enhance), share (allocate or collaborate), enhance (increase or maximize), accept (acknowledge or watch).

 People processes and hard processes are two types of integrated processes3. People processes involve human factors such as culture, values, ethics, and behavior that influence risk management. Hard processes involve technical aspects such as methods, tools, techniques, and systems that support risk management.

Treatment plan becomes a living document of defining the direction of the risk treatment andbeing able to monitor progress against the plan3. Treatment plan helps to ensure that risk treatment actions are aligned with the changing context, objectives, and stakeholder expectations.