ARM 401 CORE EXAM SET 2026/2027 QUESTIONS AND
SOLUTIONS RATED A+
✔✔HAZOP - ✔✔-a comprehensive review of a process or system
-a team of subject matter experts and stakeholders identifies the risks associated with a
given process and recommends a solution
-primarily used to design complex, scientific systems
-used when virtually all risks must be eliminated
✔✔steps in HAZOP process - ✔✔1. subdivides the project or system design into small
components
2. reviews each component to identify risks
3. identifies the cause and potential outcomes for each risk
4. develops a solution for each risk
5. ensures that solutions work and reevaluates as necessary
✔✔SWOT Analysis - ✔✔-team approach that's useful in analyzing a new project or
product
-strengths and weaknesses are internal environmental factors
-opportunities and threats are external environmental factors
-a goal is necessary to keep the SOT analysis from becoming too general or failing to
provide actionable info
-concludes with a "go" or "no go" recommendation
✔✔assessing risks of an organization - ✔✔-unique qualities of org
-industry it's in
-internal/external factors
-upstream and downstream external factors (upstream: suppliers and manufacturers;
downstream: distribution channels and consumer demands)
✔✔traditional risk assessment tools and techniques - ✔✔1. risk thresholds
2. checklists
3. workshops
4. risk registers and risk maps
5. process flow analysis
6. audits
7. cause and effect analysis
8. fault tree analysis
9. failure mode and effects analysis
✔✔risk thresholds - ✔✔-when an org must decide what it's willing to sacrifice or accept
in exchange for achieving its goals
✔✔checklists - ✔✔-easy to use and communicate known risks to employees with little
efforts
,-don't help identify unknown risks
✔✔workshops - ✔✔-allows attendees to brainstorm and assess risks in an open,
collaborative forum
-gives more perspectives
-downside is the potential for senior management to influence the flow of ideas from
stakeholders; some people conform
✔✔risk registers and risk maps - ✔✔-used to sort and rank a large number of risks
-risk register: a ledger of identified risks that're recorded in a table in a document; data
in this is specific to the org
-risk map: a graphic diagram showing the components of a the register; identify,
prioritize, and quantify risks in a two dimensional pictorial that illustrates frequency and
severity on vertical and horizontal axes
✔✔process flow analysis - ✔✔-dissects processes within the org from input to output for
the purpose of improving them
✔✔audits - ✔✔-can identify both negative risks and opportunity risks
✔✔cause and effect analysis - ✔✔-looks backward through a defective process and
identifies the possible reasons, direct and contributory, that caused a negative event or
problem
-impossible to solve or prevent a problem without finding the root cause
-combines brainstorming, communications, and mapping to find the caused of a
problem and the solution
✔✔fault tree analysis - ✔✔-a process that originates with an assumption about what
caused an event or failure
-work downward from assumption then used a diagram to connector the factors that
caused the failure and determine how to devise methods to prevent similar failures in
the future
✔✔Failure Model and Effects Analysis (FMEA) - ✔✔-uses a team of individuals to
examine a process and identify potential failures at each step in the process, as well as
the consequences of each failure
✔✔emerging risk assessment tolls and techniques - ✔✔-emerging tech and smart
devices provide real-time data
-radio frequency identification, seniors, AI, computer vision
-don't replace traditional methods but do overcome some of the shortcomings of the
tradition methods
,✔✔risk registers - ✔✔-a tool developed at the risk owner level that links specific
activities, processes, projects, or plans to a list of identified risks and results or risk
analysis and evaluation and that is ultimately consolidated at the enterprise level
-use when you are dealing with a lot of risks
-identify, describe, and prioritize risks
-an effective register describes each risk, determines each risk's likelihood and potential
consequences, offers controls that could mitigate the negative effects of each risk, and
identifies the party responsible for executing those controls
-can be used for one scenario or all of an org's risks
-organizational risk registers can organize risks by scenario, risk quadrant, or affected
business unit or risk owner
✔✔tasks a risk register should accomplish - ✔✔-identify the org's risks appropriately
-prioritizes risks according to their potential effects on the org
-allows for collaboration and instant updating by risk managers and stakeholders
-tracks improvement actions to take, when they're taken, and when a follow-up or
review will occur
✔✔risk maps - ✔✔-a template depicting the likelihood and potential
impact/consequences of risks
-used to bring the register's info to focus and make it easier to act on
-can also be used to categorize risk in relation to an org's risk appetite for a specific risk,
project, or process
-goal is always to pinpoint where risk management efforts should be focused
-variations include assessing certain segments of risk or risk at a given point in time
-can be used to document inherent risk, residual risk, and optimum risk: important
because they can determine the necessity and potential effectiveness of a risk
treatment
✔✔inherent risk - ✔✔the level of risk that would be faced if it were to remind untreated
or no action were to be taken to alter the level of risk
✔✔residual risk - ✔✔the level of risk remaining after actions are taken to alter the level
of risk
✔✔optimum risk - ✔✔the level of risk that is within an org's risk appetite
✔✔collaboration - ✔✔the act of working together to achieve a shared objective
✔✔cooperation - ✔✔the act of working together to achieve individual objectives instead
of a shared objective
✔✔coordination - ✔✔the act of improving efficiency and reducing redundancy by some
combo of arranging, assigning, organizing, or scheduling activities
, ✔✔three keys to effective collaboration - ✔✔-gain a holistic perspective
-motivate workers
-contributing to a common goal
✔✔two tasks a risk professional needs to excel in when working with subject-matter
experts - ✔✔-asking the right questions of the right people
-understanding the answers
✔✔qualitative risk analysis - ✔✔-measures a risk by the significance of consequences;
may use ratings such as high, medium, low
-a clear, written explanation of the agreed-upon bases for each determination should
included in the assessment
-don't provide exactly what costs the threats entail; what one person considers a high-
level threat might be a low -level threat to someone else
✔✔quantitative risk analysis - ✔✔assigns specific values to consequences and their
probabilities to reach a numeric indication of the level of risk
✔✔risk analysis - ✔✔-identify risk
-note range of consequences and determine probability of each
-can focus on a specific event or a process
✔✔risk control - ✔✔a conscious act or decision not to act that reduces the frequency
and/or severity of losses or makes losses more predictable
✔✔control assessment - ✔✔-to accurately determine its level of risk, an org must
examine the effectiveness of its current risk control measures
-identify every current technique and verify its effectiveness
-can be quantitative, qualitative, or both
✔✔marginal benefit of accidents - ✔✔providing an opportunity to examine why they
happened and the ability to learn how to avoid a repeat occurrence in the future
✔✔three basic causes of accidents - ✔✔poor management, safety policy, and personal
or environmental factors
✔✔five theories to understanding accident causation - ✔✔1. sequences of events
(domino theory)
2. energy transfer theory
3. technique of operations review (TOR) approach
4. change analysis
5. job safety analysis
SOLUTIONS RATED A+
✔✔HAZOP - ✔✔-a comprehensive review of a process or system
-a team of subject matter experts and stakeholders identifies the risks associated with a
given process and recommends a solution
-primarily used to design complex, scientific systems
-used when virtually all risks must be eliminated
✔✔steps in HAZOP process - ✔✔1. subdivides the project or system design into small
components
2. reviews each component to identify risks
3. identifies the cause and potential outcomes for each risk
4. develops a solution for each risk
5. ensures that solutions work and reevaluates as necessary
✔✔SWOT Analysis - ✔✔-team approach that's useful in analyzing a new project or
product
-strengths and weaknesses are internal environmental factors
-opportunities and threats are external environmental factors
-a goal is necessary to keep the SOT analysis from becoming too general or failing to
provide actionable info
-concludes with a "go" or "no go" recommendation
✔✔assessing risks of an organization - ✔✔-unique qualities of org
-industry it's in
-internal/external factors
-upstream and downstream external factors (upstream: suppliers and manufacturers;
downstream: distribution channels and consumer demands)
✔✔traditional risk assessment tools and techniques - ✔✔1. risk thresholds
2. checklists
3. workshops
4. risk registers and risk maps
5. process flow analysis
6. audits
7. cause and effect analysis
8. fault tree analysis
9. failure mode and effects analysis
✔✔risk thresholds - ✔✔-when an org must decide what it's willing to sacrifice or accept
in exchange for achieving its goals
✔✔checklists - ✔✔-easy to use and communicate known risks to employees with little
efforts
,-don't help identify unknown risks
✔✔workshops - ✔✔-allows attendees to brainstorm and assess risks in an open,
collaborative forum
-gives more perspectives
-downside is the potential for senior management to influence the flow of ideas from
stakeholders; some people conform
✔✔risk registers and risk maps - ✔✔-used to sort and rank a large number of risks
-risk register: a ledger of identified risks that're recorded in a table in a document; data
in this is specific to the org
-risk map: a graphic diagram showing the components of a the register; identify,
prioritize, and quantify risks in a two dimensional pictorial that illustrates frequency and
severity on vertical and horizontal axes
✔✔process flow analysis - ✔✔-dissects processes within the org from input to output for
the purpose of improving them
✔✔audits - ✔✔-can identify both negative risks and opportunity risks
✔✔cause and effect analysis - ✔✔-looks backward through a defective process and
identifies the possible reasons, direct and contributory, that caused a negative event or
problem
-impossible to solve or prevent a problem without finding the root cause
-combines brainstorming, communications, and mapping to find the caused of a
problem and the solution
✔✔fault tree analysis - ✔✔-a process that originates with an assumption about what
caused an event or failure
-work downward from assumption then used a diagram to connector the factors that
caused the failure and determine how to devise methods to prevent similar failures in
the future
✔✔Failure Model and Effects Analysis (FMEA) - ✔✔-uses a team of individuals to
examine a process and identify potential failures at each step in the process, as well as
the consequences of each failure
✔✔emerging risk assessment tolls and techniques - ✔✔-emerging tech and smart
devices provide real-time data
-radio frequency identification, seniors, AI, computer vision
-don't replace traditional methods but do overcome some of the shortcomings of the
tradition methods
,✔✔risk registers - ✔✔-a tool developed at the risk owner level that links specific
activities, processes, projects, or plans to a list of identified risks and results or risk
analysis and evaluation and that is ultimately consolidated at the enterprise level
-use when you are dealing with a lot of risks
-identify, describe, and prioritize risks
-an effective register describes each risk, determines each risk's likelihood and potential
consequences, offers controls that could mitigate the negative effects of each risk, and
identifies the party responsible for executing those controls
-can be used for one scenario or all of an org's risks
-organizational risk registers can organize risks by scenario, risk quadrant, or affected
business unit or risk owner
✔✔tasks a risk register should accomplish - ✔✔-identify the org's risks appropriately
-prioritizes risks according to their potential effects on the org
-allows for collaboration and instant updating by risk managers and stakeholders
-tracks improvement actions to take, when they're taken, and when a follow-up or
review will occur
✔✔risk maps - ✔✔-a template depicting the likelihood and potential
impact/consequences of risks
-used to bring the register's info to focus and make it easier to act on
-can also be used to categorize risk in relation to an org's risk appetite for a specific risk,
project, or process
-goal is always to pinpoint where risk management efforts should be focused
-variations include assessing certain segments of risk or risk at a given point in time
-can be used to document inherent risk, residual risk, and optimum risk: important
because they can determine the necessity and potential effectiveness of a risk
treatment
✔✔inherent risk - ✔✔the level of risk that would be faced if it were to remind untreated
or no action were to be taken to alter the level of risk
✔✔residual risk - ✔✔the level of risk remaining after actions are taken to alter the level
of risk
✔✔optimum risk - ✔✔the level of risk that is within an org's risk appetite
✔✔collaboration - ✔✔the act of working together to achieve a shared objective
✔✔cooperation - ✔✔the act of working together to achieve individual objectives instead
of a shared objective
✔✔coordination - ✔✔the act of improving efficiency and reducing redundancy by some
combo of arranging, assigning, organizing, or scheduling activities
, ✔✔three keys to effective collaboration - ✔✔-gain a holistic perspective
-motivate workers
-contributing to a common goal
✔✔two tasks a risk professional needs to excel in when working with subject-matter
experts - ✔✔-asking the right questions of the right people
-understanding the answers
✔✔qualitative risk analysis - ✔✔-measures a risk by the significance of consequences;
may use ratings such as high, medium, low
-a clear, written explanation of the agreed-upon bases for each determination should
included in the assessment
-don't provide exactly what costs the threats entail; what one person considers a high-
level threat might be a low -level threat to someone else
✔✔quantitative risk analysis - ✔✔assigns specific values to consequences and their
probabilities to reach a numeric indication of the level of risk
✔✔risk analysis - ✔✔-identify risk
-note range of consequences and determine probability of each
-can focus on a specific event or a process
✔✔risk control - ✔✔a conscious act or decision not to act that reduces the frequency
and/or severity of losses or makes losses more predictable
✔✔control assessment - ✔✔-to accurately determine its level of risk, an org must
examine the effectiveness of its current risk control measures
-identify every current technique and verify its effectiveness
-can be quantitative, qualitative, or both
✔✔marginal benefit of accidents - ✔✔providing an opportunity to examine why they
happened and the ability to learn how to avoid a repeat occurrence in the future
✔✔three basic causes of accidents - ✔✔poor management, safety policy, and personal
or environmental factors
✔✔five theories to understanding accident causation - ✔✔1. sequences of events
(domino theory)
2. energy transfer theory
3. technique of operations review (TOR) approach
4. change analysis
5. job safety analysis
