- A risk has low likelihood but could result in significant reputational damage. Which response is most appropriate under COSO ERM?
Answer: Develop a crisis communication plan and monitor the risk given its potential reputational impact.
Reputational risks with significant impact warrant contingency planning and monitoring, even at low likelihood, because reputational damage can be severe and difficult to reverse. Answer B is correct. Accepting without response (A) is inappropriate for high-impact risks. Immediately ceasing activities (C) may be disproportionate. Reputational risk cannot be fully transferred (D).
- An organization has minimal financial risk appetite. Management is considering a large leveraged acquisition. Under COSO ERM, management should:
Answer: Assess whether the acquisition's risk profile exceeds the stated risk appetite before proceeding.
Risk appetite must be applied during strategy and objective-setting. A leveraged acquisition with significant financial risk must be evaluated against the minimal financial risk appetite. Answer B is correct. Strategic risks are fully within ERM scope (A). Not all risks can be transferred (C). Accepting without assessment violates ERM principles (D).
- Residual vendor risk exceeds risk appetite after a mitigation; other responses exist. What next?
Answer: Choose another risk response
When residual risk still exceeds your risk appetite, accepting it is not viable because it violates your threshold. Since other responses exist, you should select a different risk response to bring residual risk within appetite. Raising appetite just to match the risk is backwards, and stopping operations is too drastic if other options remain.
- In the context of COSO ERM, risk appetite is best defined as:
Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives.
Risk appetite represents the organization's willingness to accept risk in pursuit of value creation. It reflects strategy and guides risk tolerance decisions. Answer C is correct. Maximum financial loss (A) describes risk capacity. Identified risk events (B) describe a risk inventory. Risk after controls (D) describes residual risk.
- A risk has very high potential impact but very low likelihood. Under COSO ERM, the most appropriate initial response is typically to:
Answer: Monitor the risk and develop contingency plans given the high potential impact.
A high-impact, low-likelihood risk warrants monitoring and contingency planning. The high impact means consequences could be severe. Answer C is correct. Extensive controls immediately (A) may not be cost-effective. Automatic transfer (B) ignores needed analysis. Removing from the register (D) is inappropriate for high-impact risks.
- The COSO Enterprise Risk Management (ERM) framework is primarily designed to:
Answer: Help organizations identify, assess, and manage risks that could affect the achievement of strategic and operational objectives.
The COSO ERM framework provides a structured approach for organizations to manage uncertainty and risk in pursuit of their objectives. Answer B is correct. Encryption standards (A), accounting standards (C), and IT infrastructure standards (D) are outside the scope of the COSO ERM framework.
- Under the COSO ERM 2017 framework, which of the following represents the first component?
Answer: Governance and Culture
The COSO ERM 2017 framework has five components. Governance and Culture is the foundational first component, setting oversight responsibilities and cultural expectations around risk. Answer A is correct. Risk Assessment (B) is a term from COSO ICIF. Control Activities (C) and Information and Communication (D) are components of COSO ICIF, not the primary ERM components.
- Which statement about COSO ERM and COSO ICIF is correct?
Answer: COSO ERM is broader than COSO ICIF; ICIF focuses on internal control while ERM encompasses strategy, risk, and performance.
COSO ERM encompasses strategy through performance, while ICIF focuses specifically on internal control effectiveness. ERM is the broader framework. Answer C is correct. They are distinct frameworks (A). ICIF does not address strategic risk (B). Both apply to all organization types (D).
- The 'Review and Revision' component of COSO ERM 2017 is primarily concerned with:
Answer: Assessing how well ERM is performing and making adjustments in response to changes.
Review and Revision involves monitoring ERM performance, assessing changes in business context, and revising the framework to improve effectiveness. Answer D is correct. Identifying new risks (A) is Performance. Setting risk appetite (B) is Governance and Culture. Designing controls (C) is also Performance.
- An organization's board reviews and approves the risk appetite statement annually. Under COSO ERM, this falls within which component?
Answer: Governance and Culture
Board oversight of risk appetite is part of the Governance and Culture component, which addresses board roles, management structure, and cultural expectations around risk. Answer B is correct. Risk Assessment (A) involves analyzing risks. Strategy and Objective-Setting (C) involves applying risk appetite. Review and Revision (D) involves monitoring performance.
- The 'Performance' component of COSO ERM 2017 primarily involves:
Answer: Identifying, assessing, prioritizing, and responding to risks that affect the achievement of strategy and business objectives.
The Performance component covers the core risk management process: identification, assessment, prioritization, and response. Answer C is correct. ERM effectiveness review (A) is Review and Revision. Mission and values (B) are Governance and Culture. Stakeholder communication (D) is Information, Communication, and Reporting.
- Which of the following scenarios represents a failure in the 'Strategy and Objective-Setting' component of COSO ERM?
Answer: An organization pursues an aggressive growth strategy without considering how the associated risks align with its stated risk appetite.
The Strategy and Objective-Setting component requires risk appetite to be considered during strategy development. Pursuing a strategy without assessing its risk implications is a failure here. Answer A is correct. Monitoring residual risks (B) is Review and Revision. Control testing (C) is a Control Activities issue. Communication failures (D) are Information, Communication, and Reporting.
- Under COSO ERM, a 'key risk indicator' (KRI) is best described as:
Answer: A metric that provides early warning when a risk is increasing or approaching the risk tolerance threshold.
KRIs are forward-looking metrics that signal when risk levels are changing, enabling proactive management before tolerance is breached. Answer A is correct. Solvency ratios (B) are financial metrics. Control test results (C) are key control indicators. Benchmarks (D) are comparative measures, not KRIs.
- The COSO ERM 2017 framework introduced which significant enhancement compared to the 2004 version?
Answer: Greater emphasis on linking ERM to strategy-setting and the relationship between risk and performance.
The 2017 update strengthened the connection between ERM, strategy formulation, and performance management. Answer C is correct. Risk response categories were not reduced (A). Board oversight was retained and strengthened (B). Zero-risk tolerance was not introduced (D).
- Under COSO ERM, the concept of 'portfolio view of risk' means that:
Answer: Management considers interrelationships among risks across the organization to understand the aggregate risk profile.
A portfolio view requires assessing how individual risks interact and combine enterprise-wide, since collectively risks may exceed acceptable levels even when each appears manageable in isolation. Answer D is correct. The view is enterprise-wide, not IT-only (A). It requires cross-unit coordination (B). It encompasses all risk types (C).
- A risk that falls within an organization's risk tolerance and requires no immediate action is best described under COSO ERM as:
Answer: An accepted risk that is monitored but requires no additional response.
Under COSO ERM, 'accept' is a valid risk response for risks within established tolerance. No additional action is required beyond monitoring. Answer D is correct. Inherent risks requiring controls (A) have not been assessed against tolerance. KRI escalation (B) implies the risk is moving outside tolerance. Transfer (C) is an active response.
- Under the COSO ERM framework, which of the following best describes 'residual risk'?
Answer: The risk remaining after management has implemented responses to reduce inherent risk.
Residual risk is what remains after risk responses have been applied to inherent risk. Answer D is correct. Preliminary identified risk (A) is closer to inherent risk. External environmental factors (B) describe a source of risk. Portfolio-level aggregate risk (C) is a distinct concept.
- Current risk is $1M; risk appetite is $2M; capacity is $5M. Adding $0.5M of risk is:
Answer: Approve; within both limits
Your current risk rises from 1M to 1.5M after adding 0.5M. Since 1.5M is under the 2M appetite and under the 5M capacity, the addition is within both limits. The tempting error is choosing 'within appetite only' because you focus on one threshold, but checking capacity gives the same approve result here.
- An organization maintains a risk register with identified risks, likelihood, impact, current controls, and risk owners. In COSO ERM, maintaining this register primarily supports which component?
Answer: Performance - specifically risk identification, assessment, and prioritization.
A risk register is the primary tool in the Performance component, documenting and prioritizing risks. Answer A is correct. While it may support governance (B), review (C), and reporting (D), its primary purpose is in the Performance component's risk identification and assessment activities.
- Supplier terms changed, but process risks were not reassessed. Which ERM process was neglected?
Answer: Review and revision of risks
A change in supplier terms alters your risk exposure, so the risk assessment must be revisited to keep it current. Review and revision of risks is the ERM process that catches changed conditions and updates priorities. Communication and reporting is tempting because the new terms weren't communicated, but the failure was failing to reassess the risks themselves, not failing to report them.
