RIMS - CRMP COMPLETE STUDY
GUIDE; QUESTIONS WITH COMPLETE
ANSWERS
Risk Analysis -Answer-The process of characterizing and understanding the nature
of risk and of considering the level of risk in the context of the organization's
willingness to accept risk.
Support Function: Safety -Answer-Risk identification, assessment and treatment of
risks focused on preserving the physical well-being of employees and third parties.
Likelihood, Consequences, other criteria such as timing, duration, vulnerability and
interdependencies -Answer-Risk is typically analyzed on the basis of
Support Function: Information Security -Answer-Risk Identification, assessment and
treatment of risk arising our of or affecting information and technology infrastructure.
To build organizational awareness, risk management creates the most value when -
Answer-Risk management Aligns with strategic goals; Takes corporate culture into
account; Involves key enterprise functions
Financial Statements -Answer-Internal source of information that includes financial
analytics or projections
strategic planning team -Answer-The risk manager should be a part of the
_______________________ to provide the structure discipline for consideration of
risks in a strategic portfolio.
Internal Audit Reports -Answer-Internal source of information that focuses on
business practices important to the goals and reflection of regulatory environment of
the organization
risk management -Answer-__________________ should be an agenda item at every
strategy session.
Support Function: Facilities -Answer-Risk identification, assessment and treatment of
the organization's properties, equipment and physical infrastructure systems.
Simple and frequent -Answer-A type of decision that are automatic, taken in the
moment. These decisions generally rely on the knowledge and capability of the
decision maker using the back-of-the-napkin technique.
Bow tie analysis -Answer-hazard analysis technique (cause and consequence)
Business impact analysis -Answer-consider business impacts at a location or from a
specific process
,Support Functions: Quality -Answer-Risk identification, assessment and treatment of
risks related to products and services.
Significant importance or complex -Answer-A type of decision that require more
deliberate effort. These decisions generally have some period of planning and a
longer decision timeline.
Organizational Structure -Answer-Internal source of information that reports from
different departments (HR, Legal, risk, operations, HS, environment, etc.)
Review the existing strategic plan -Answer-The first step for the risk manager is to
__________________________ to identify and understand the organization's goals.
key performance indicators -Answer-Each high-level strategy objective should be
broken down into more tactical, operational _____________________ for analysis.
External Organization Information -Answer-External source of information that
includes external audit reports, competitive analysis, rating agency, consumer
reports, legal matters, media coverage
Strategic importance and complex -Answer-A type of decision that call for formal
planning process over a longer timeline in which multiple risk management
techniques can be applied. Decision quality elements should be embedded in the
process. Due to the importance of the decision, biases should be formally
considered by the entire planning team.
Support Function: Project Management -Answer-Assess and identify project risks,
mitigate threats and capitalize on opportunities that my affect the success of a
specific project.
Gap analysis -Answer-determine steps to improve the organization's capacity to
move from a current state to a desired, future state. (current available factors,
success factors needed to achieve future desired objectives, highlighting the gaps)
How to obtain the real story aside from reading information? -Answer-Talk to those
inside the organization; Talk with external stakeholders ; Do site visits
assumptions -Answer-The risk manager can then identify ________________ made
by management when developing these goals.
Root Cause Analysis -Answer-multiple techniques designed to identify the underlying
or initiating risk sources or drivers. (fault tree analysis, event tree analysis, failure
mode and effect analysis and cause-and-effect analysis - fish bone diagram)
Element of decision quality: Frame the issue; identify the need -Answer-Is solving
this problem or realizing this opportunity worthwhile? What are the intended
outcomes?
, Risk Culture -Answer-The norms and traditions of behavior of individuals and of
groups within an organization that determine the way in which they identify,
understand, idsuss and act on the risk organization confronts and takes.
Influence analysis/diagrams -Answer-identify the strength of influencing factors and
help determine potential weighting for consideration during the risk assessment
process. Define root causes for major risks, define the chain of events likely in a
scenario and become the foundation for further modeling.
Training needs assessment: Why conduct the training? -Answer-to tie the
performance deficiency to a working need and be sure the benefits of conducting the
traiing are greater than the problems being cuased by the performance deficiency.
Conduct two types of analysis to answer this question: 1) needs versus wants
analysis and 2) feasibility analysis
Element of decision quality: Explore doable alternatives -Answer-What options are
available and how effective or disruptive will each one be in solving the problem or
realizing the opportunity? What unintended consequences will each alternative
create?
Knowledge -Answer-A risk management professional must possess general
business acumen to generate conversations that lead to deeper understanding of
organizational structure; value chain; market analysis, PESTLE, etc.
key risks to each strategic goal -Answer-The risk manager can then use in-depth risk
analysis to assess the __________________ as well as the risks to the successful
execution of the strategic plan.
Risk Register Analysis -Answer-compile risk into a risk register to analyze and
manage those risks in an organized way, typically by category.
Training needs assessment: Who is involved in the training? -Answer-involve
appropriate parties to solve the deficiency. Conduct a target population analysis to
learn as much as possible about those involved in the deficiency and how to
customize a training program to capture their interest.
Element of decision quality: Consider meaningful, reliable information -Answer-Is the
information accurate, applicable and useful? How will this information inform the
decision-making process? What different interpretations of the data are possible and
how will each one affect the decision-making process?
Skills -Answer-A risk management professional must possess communication,
technical and interpersonal skills to obtain organizational information.
Action plans -Answer-_____________ should be developed to address gaps
between the key risks to the strategic plan and the successful delivery of the
mission.
Organize -Answer-After obtaining information, what should be the next step to be
done?
GUIDE; QUESTIONS WITH COMPLETE
ANSWERS
Risk Analysis -Answer-The process of characterizing and understanding the nature
of risk and of considering the level of risk in the context of the organization's
willingness to accept risk.
Support Function: Safety -Answer-Risk identification, assessment and treatment of
risks focused on preserving the physical well-being of employees and third parties.
Likelihood, Consequences, other criteria such as timing, duration, vulnerability and
interdependencies -Answer-Risk is typically analyzed on the basis of
Support Function: Information Security -Answer-Risk Identification, assessment and
treatment of risk arising our of or affecting information and technology infrastructure.
To build organizational awareness, risk management creates the most value when -
Answer-Risk management Aligns with strategic goals; Takes corporate culture into
account; Involves key enterprise functions
Financial Statements -Answer-Internal source of information that includes financial
analytics or projections
strategic planning team -Answer-The risk manager should be a part of the
_______________________ to provide the structure discipline for consideration of
risks in a strategic portfolio.
Internal Audit Reports -Answer-Internal source of information that focuses on
business practices important to the goals and reflection of regulatory environment of
the organization
risk management -Answer-__________________ should be an agenda item at every
strategy session.
Support Function: Facilities -Answer-Risk identification, assessment and treatment of
the organization's properties, equipment and physical infrastructure systems.
Simple and frequent -Answer-A type of decision that are automatic, taken in the
moment. These decisions generally rely on the knowledge and capability of the
decision maker using the back-of-the-napkin technique.
Bow tie analysis -Answer-hazard analysis technique (cause and consequence)
Business impact analysis -Answer-consider business impacts at a location or from a
specific process
,Support Functions: Quality -Answer-Risk identification, assessment and treatment of
risks related to products and services.
Significant importance or complex -Answer-A type of decision that require more
deliberate effort. These decisions generally have some period of planning and a
longer decision timeline.
Organizational Structure -Answer-Internal source of information that reports from
different departments (HR, Legal, risk, operations, HS, environment, etc.)
Review the existing strategic plan -Answer-The first step for the risk manager is to
__________________________ to identify and understand the organization's goals.
key performance indicators -Answer-Each high-level strategy objective should be
broken down into more tactical, operational _____________________ for analysis.
External Organization Information -Answer-External source of information that
includes external audit reports, competitive analysis, rating agency, consumer
reports, legal matters, media coverage
Strategic importance and complex -Answer-A type of decision that call for formal
planning process over a longer timeline in which multiple risk management
techniques can be applied. Decision quality elements should be embedded in the
process. Due to the importance of the decision, biases should be formally
considered by the entire planning team.
Support Function: Project Management -Answer-Assess and identify project risks,
mitigate threats and capitalize on opportunities that my affect the success of a
specific project.
Gap analysis -Answer-determine steps to improve the organization's capacity to
move from a current state to a desired, future state. (current available factors,
success factors needed to achieve future desired objectives, highlighting the gaps)
How to obtain the real story aside from reading information? -Answer-Talk to those
inside the organization; Talk with external stakeholders ; Do site visits
assumptions -Answer-The risk manager can then identify ________________ made
by management when developing these goals.
Root Cause Analysis -Answer-multiple techniques designed to identify the underlying
or initiating risk sources or drivers. (fault tree analysis, event tree analysis, failure
mode and effect analysis and cause-and-effect analysis - fish bone diagram)
Element of decision quality: Frame the issue; identify the need -Answer-Is solving
this problem or realizing this opportunity worthwhile? What are the intended
outcomes?
, Risk Culture -Answer-The norms and traditions of behavior of individuals and of
groups within an organization that determine the way in which they identify,
understand, idsuss and act on the risk organization confronts and takes.
Influence analysis/diagrams -Answer-identify the strength of influencing factors and
help determine potential weighting for consideration during the risk assessment
process. Define root causes for major risks, define the chain of events likely in a
scenario and become the foundation for further modeling.
Training needs assessment: Why conduct the training? -Answer-to tie the
performance deficiency to a working need and be sure the benefits of conducting the
traiing are greater than the problems being cuased by the performance deficiency.
Conduct two types of analysis to answer this question: 1) needs versus wants
analysis and 2) feasibility analysis
Element of decision quality: Explore doable alternatives -Answer-What options are
available and how effective or disruptive will each one be in solving the problem or
realizing the opportunity? What unintended consequences will each alternative
create?
Knowledge -Answer-A risk management professional must possess general
business acumen to generate conversations that lead to deeper understanding of
organizational structure; value chain; market analysis, PESTLE, etc.
key risks to each strategic goal -Answer-The risk manager can then use in-depth risk
analysis to assess the __________________ as well as the risks to the successful
execution of the strategic plan.
Risk Register Analysis -Answer-compile risk into a risk register to analyze and
manage those risks in an organized way, typically by category.
Training needs assessment: Who is involved in the training? -Answer-involve
appropriate parties to solve the deficiency. Conduct a target population analysis to
learn as much as possible about those involved in the deficiency and how to
customize a training program to capture their interest.
Element of decision quality: Consider meaningful, reliable information -Answer-Is the
information accurate, applicable and useful? How will this information inform the
decision-making process? What different interpretations of the data are possible and
how will each one affect the decision-making process?
Skills -Answer-A risk management professional must possess communication,
technical and interpersonal skills to obtain organizational information.
Action plans -Answer-_____________ should be developed to address gaps
between the key risks to the strategic plan and the successful delivery of the
mission.
Organize -Answer-After obtaining information, what should be the next step to be
done?
