Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
What is typically the day-to-day responsibility of a Chief Risk Officer within a large organisation?
The day-to-day responsibility of a Chief Risk Officer within a large organisation is to ensure that all key risks are adequately managed and reported4. This involves overseeing the implementation of risk management policies, processes and systems across the organisation.
Which of the following are ISO 31000:2009 Enhanced Risk Management attributes? (Choose two)
Full accountability for risk controls and treatment and decision making involves risk are two of the enhanced risk management attributes according to ISO 31000:20091. These attributes indicate that risk management is integrated into governance and decision-making processes.
Which element is often the biggest challenge in risk implementation?
Human element is often the biggest challenge in risk implementation. Human element involves overcoming resistance to change, engaging stakeholders, building trust and commitment, and fostering a positive risk culture.
The ISO 31000:2018 process can be used to identify stakeholder risk requirements, needs, and expectations.
The ISO 31000:2018 process can be used to identify stakeholder risk requirements, needs, and expectations4. This is part of establishing the context for risk management, which involves defining the scope, objectives, criteria, roles and responsibilities for risk management.
Which step is the last part of the risk assessment process, which started with risk identification then moved to risk assessment, and finally risk evaluation?
the last step of the risk assessment process, which starts with risk identification, moves to risk assessment, and finally risk evaluation, is Risk evaluation.
Risk evaluation involves comparing the estimated level of risk against the risk criteria established during the risk assessment phase, to determine the significance of the risk and whether it is acceptable or not. This decision is made in consultation with stakeholders, who may provide additional context and information to inform the decision.
The American Society for Quality (ASQ) describes risk evaluation as 'the process of comparing an estimated risk against given risk criteria to determine the acceptability of the risk.' [1]
Similarly, ISO/IEC 27001:2013 (Information technology --- Security techniques --- Information security management systems --- Requirements) defines risk evaluation as 'the process of comparing the estimated risk against given risk criteria in order to determine the significance of the risk.' [2]
Organizational information systems, information flows, and formal and informal decision-making processes are all a part of establishing which type of context in regard to the organization?
According to ISO31000 (2018), clause 5., establishing the context involves defining ''the external and internal parameters to be taken into account when managing risk''. The internal context includes ''information systems, information flows and decision-making processes'' among other factors.
Which two of the following are types Integrated Processes? (Choose two)
People processes and hard processes are two types of integrated processes3. People processes involve human factors such as culture, values, ethics, and behavior that influence risk management. Hard processes involve technical aspects such as methods, tools, techniques, and systems that support risk management.
Exam domains verified against: Official GAQM ISO-31000-CLA exam guide, last checked October 2026.
Covers fundamental concepts of risk management principles and establishes baseline understanding of risk management in organizational contexts. Learn core concepts including risk appetite, risk tolerance, and how organizations establish a risk-aware culture.
Focuses on integration of risk-based thinking approaches within organizational processes. Emphasizes systematic risk consideration in decision-making and applying risk-based thinking to enhance organizational resilience.
Addresses key terminology, fundamental risk concepts, and standardized definitions used in risk management frameworks. Tests ability to distinguish between subtle differences in ISO definitions through case vignettes.
Sample question from this domain above: Q6
Covers the simplified version of ISO 31000:2018 standard with focus on practical implementation and core principles. Emphasizes the 2018 framework and process flow for real-world application.
Covers core principles that form the foundation of effective risk management practices and their application. Maps each principle to workplace examples for practical understanding.
Sample question from this domain above: Q2
Addresses the structural framework necessary for implementing and maintaining effective risk management systems within organizations. Provides guidance on the selection and application of risk management frameworks in various contexts.
Covers the systematic approach to risk management including identification, analysis, evaluation, and treatment processes. Focuses on mapping process steps to realistic scenarios and decision points.
Sample question from this domain above: Q5
Focuses on practical tools and methodologies used in risk assessment including qualitative and quantitative techniques. Covers specific topics such as risk identification, risk assessment, and risk treatment approaches.
Explores advanced concepts from ISO 31000:2009 emphasizing enhanced risk management practices and their evolution in modern organizations. Examines the development of risk management strategy accounting for organizational resources and internal support.
Common questions about the exam itself
