Question 1

Which best describes risk assessment under ISO 31000?

Accepted Answer

The overall process of risk identification, risk analysis, and risk evaluation.. Risk assessment is the umbrella term for the three steps that turn raw uncertainty into a prioritised decision: identify what could happen, analyse how likely and how consequential it is, evaluate whether it crosses the criteria. Treatment and monitoring follow assessment; they are not part of it.

Reference: ISO 31000:2018 Clause 6.4.1

Question 2

What is the primary purpose of the risk-management framework under ISO 31000?

Accepted Answer

To assist the organisation in integrating risk management into its significant activities and functions.. The framework is essentially infrastructure: leadership, integration, design, implementation, evaluation, and improvement. Its job is to make risk thinking part of how decisions get made across the business. If the framework is producing reports nobody acts on, or controls disconnected from objectives, that is a sign the integration purpose has been lost.

Reference: ISO 31000:2018 Clause 5.1

Question 3

What does Clause 5.4.2 require top management to articulate?

Accepted Answer

A risk-management policy or statement that expresses the organisation's commitment to managing risk.. Articulating commitment is the moment top management says, in writing and on the record, that this is how the organisation will treat risk. It tends to land as a one-page policy that sets out scope, accountability, and integration intent. Skipping it is a common gap in firms that have working risk processes but no visible leadership statement to anchor them.

Reference: ISO 31000:2018 Clause 5.4.2

Question 4

Under Clause 5.3, what is the central message about how risk management should be integrated?

Accepted Answer

Risk management should be a part of, not separate from, governance, strategy, objectives and operations across every part of the structure.. Integration is the test of whether risk management is real. If product managers, project leads and operations heads are not asking risk questions in their day-to-day choices, the framework has not landed. The standard puts integration into Clause 5.3 specifically to keep it from being an afterthought that follows policy publication.

Reference: ISO 31000:2018 Clause 5.3

Question 5

Under Clause 3.7, what is the intended scope of the term likelihood in risk-management terminology?

Accepted Answer

The chance of something happening, expressed objectively or subjectively, qualitatively or mathematically.. Likelihood is a wider umbrella than probability. A risk owner can describe the chance of a supplier default as 'unlikely' on a five-band scale, or as a calculated 3 percent annual figure, and both are likelihood. The terminology was chosen so the same vocabulary covers qualitative, semi-quantitative and fully quantitative analyses.

Reference: ISO 31000:2018 Clause 3.7

Question 6

Which item belongs in the risk management commitment that top management articulates?

Accepted Answer

The way in which conflicting objectives are dealt with.. Articulated commitment is a governance-layer statement. It names purpose, links to objectives, integration intent, accountabilities, resources, how conflicting objectives are reconciled, and how performance is reported. Mixing in operational logs or workshop calendars dilutes the statement and pushes governance work into the wrong layer.

Reference: ISO 31000:2018 Clause 5.4.2

Question 7

Under ISO 31000, what should top management establish to support communication and consultation?

Accepted Answer

An approved approach for communication and consultation with internal and external stakeholders that supports the framework.. Communication and consultation at the framework level is a deliberate, approved approach: who gets what information when, who is consulted on what, what feedback loops exist. It sits as infrastructure rather than as a sequence of one-off conversations, which is why 5.4.5 wants it formally established.

Reference: ISO 31000:2018 Clause 5.4.5

Question 8

Nia Adebanjo is told that 'best available information' under the principles means the team must wait for complete information before proceeding. Which response is correct?

Accepted Answer

Inputs draw on historical and current information and future expectations, while explicitly accounting for the limitations and uncertainties associated with that information.. The best-available-information principle treats historical and current information together with future expectations as legitimate inputs, while requiring the limitations and uncertainties of that information to be made explicit. The principle is designed to keep risk work moving with what is available, not to gate it behind unattainable completeness.

Reference: ISO 31000:2018 Clause 4

Question 9

Under ISO 31000, what is the role of a measurement planner in the monitoring and review activity?

Accepted Answer

Define measurement tools that link measurable attributes to a specified information need.. Three measurement roles, three different jobs. The client asks the question. The planner designs how to answer it. The reviewer checks the design before it is used. Smaller programmes often collapse these into one person, but the roles still need to be performed - otherwise the data either does not answer the question or quietly confirms whatever the team already believed.

Question 10

A practitioner reports that the consequence of a data centre outage is 'low likelihood, high impact'. Which correction best aligns the wording with ISO 31000 vocabulary?

Accepted Answer

Likelihood describes the chance of the outage occurring; consequence describes the outcome affecting objectives. The two attach to the event, not to each other.. Likelihood is the chance dimension and consequence is the outcome dimension. They sit on either side of the event in the analysis stage. Saying a consequence has low likelihood collapses the two and leaves decision makers without the structure they need to weigh the risk against criteria.

Reference: ISO 31000:2018 Clause 3.7

ISO 31000 Risk Manager Free Practice Questions.

Take the quiz.

Want 20 more?

You've seen ten. The bank holds 400+ questions.