RIMS - CRMP Complete Study Guide; 1 Analyze the Business Model, 2 Developing Organizational Risk Strategies, 3 RIMS CRMP-Implementing the Risk Process

RIMS - CRMP Complete Study Guide; 1 Analyze the Business Model, 2 Developing Organizational Risk Strategies, 3 RIMS CRMP-Implementing the Risk Process Risks - Answer The effect of uncertainty on objectives The chance of something happening that will have an impact on objectives Being prepared for the worst and being poised to exploit opportunities as they are discovered Enterprise Risk Management - Answer A strategic business discipline that supports the achievement of an organization's objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio. Support Function: Business continuity and crisis management - Answer Risk identification, assessment and creation of emergency response and recovery plans related to threats or hazards that might lead to operational disruptions Analysis - Answer A systematic examination and evaluation of data or information by breaking it into its component parts to uncover their relationships. An examination of data and facts to uncover and understand cause-effect relationships, thus providing basis for problem solving and decision making. To embed risk management in both routine and strategic decision, what should managers be able to recognize? - Answer The type of decision being made; Who should be included in the decision making process; Where in the process decisions are being made Risk management strategies' general focus - Answer Meeting or exceeding an organization's objectives Adhering to control-based objectives, rules and/or controls Complying with regulatory requirements Support Function: Internal Audit - Answer Risk identification, assessment and treatment through audit plans with focus on fraud, corruption, regulatory noncompliance and/or misrepresentation related to the organization's internal control systems, financial operations, financial statements and reporting as well as enterprise risk and the organization's risk management framework and process. What steps can the risk management professional take to embed risk management in decision making? - Answer Include risk assessment in planning process; Leverage cross-functional risk assessment team and subject matter experts to identify enterprise risks; Consider cascading and cumulative effects Gap Analysis - Answer Technique that can be used to determine what steps might need to be taken to improve the organization's capacity to move from a current state to a desired future state. Risk appetite - Answer The total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one or more desire and expected outcomes. Communication and Consultation - Answer Risk management professional's role in Implementing Risk Strategies Support Function: Legal - Answer Risk identification, assessment and treatment of risks related to the obligation an organization undertakes and transfers through contracting, as well as its compliance with applicable laws and regulatory obligations. What are the typical failures in risk management which can be avoided if it is embedded in the decision making process? - Answer Program not integrated into strategy or its execution; Focused on the wrong risks; Not executed in a repeatable process; Risk management is practiced in a silo; Activity not viewed as being value added Strategic Plan - Answer Determines that actions the organization will take at any stage of the planning period as circumstances change. Risk owner - Answer The individual who is ultimately accountable for ensuring that risk is managed appropriately, including the implementation of selected responses. Risk Identification Process - Answer Finding, Recognizing and Recording Risks Support Function: Compliance - Answer Risk identification, assessment and treatment of risk related to regulations that may affect the organization's ability to operate in its respective jurisdictions, as well as activities that fall within its compliance and ethics programs. To successfully integrate risk management into decision making, risk management professionals will rely on strategies that draw on personal and technical skills in - Answer Building organizational awareness; . Differentiating the different types of decisions used in varying situations using elements of decision quality; Performing various roles in the taking risk into account in decision-making process Strategy - Answer A complete plan of action for whatever situations might arise in achieving an organization's goals within the established time. Risk tolerance - Answer The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unit, a particular risk category or for a specific initiative. Strategic Risk Management - Answer A business discipline that drives deliberation and action regarding uncertainties and untapped opportunities that affect an organization's strategy and strategic execution. Value Chain - Answer The series of functions, processes, materials and activities (inputs) from concept to the eventual end user that creates and builds value at every step in order to deliver a product or service. To build organizational awareness, the risk management professional needs to do the following: - Answer Be a persuasive communicator and facilitator; Have a clear communication plan; Engage interested parties, including primary and secondary audiences; Demonstrate that risk management creates the most value ; Develop feedback loops for continuous learning Risk Analysis - Answer The process of characterizing and understanding the nature of risk and of considering the level of risk in the context of the organization's willingness to accept risk. Support Function: Safety - Answer Risk identification, assessment and treatment of risks focused on preserving the physical well-being of employees and third parties. Likelihood, Consequences, other criteria such as timing, duration, vulnerability and interdependencies - Answer Risk is typically analyzed on the basis of Support Function: Information Security - Answer Risk Identification, assessment and treatment of risk arising our of or affecting information and technology infrastructure. To build organizational awareness, risk management creates the most value when - Answer Risk management Aligns with strategic goals; Takes corporate culture into account; Involves key enterprise functions Financial Statements - Answer Internal source of information that includes financial analytics or projections strategic planning team - Answer The risk manager should be a part of the _______________________ to provide the structure discipline for consideration of risks in a strategic portfolio. Internal Audit Reports - Answer Internal source of information that focuses on business practices important to the goals and reflection of regulatory environment of the organization risk management - Answer __________________ should be an agenda item at every strategy session. Support Function: Facilities - Answer Risk identification, assessment and treatment of the organization's properties, equipment and physical infrastructure systems. Simple and frequent - Answer A type of decision that are automatic, taken in the moment. These decisions generally rely on the knowledge and capability of the decision maker using the back-of-the-napkin technique. Bow tie analysis - Answer hazard analysis technique (cause and consequence) Business impact analysis - Answer consider business impacts at a location or from a specific process Support Functions: Quality - Answer Risk identification, assessment and treatment of risks related to products and services. Significant importance or complex - Answer A type of decision that require more deliberate effort. These decisions generally have some period of planning and a longer decision timeline. Organizational Structure - Answer Internal source of information that reports from different departments (HR, Legal, risk, operations, HS, environment, etc.) Review the existing strategic plan - Answer The first step for the risk manager is to __________________________ to identify and understand the organization's goals. key performance indicators - Answer Each high-level strategy objective should be broken down into more tactical, operational _____________________ for analysis. External Organization Information - Answer External source of information that includes external audit reports, competitive analysis, rating agency, consumer reports, legal matters, media coverage Strategic importance and complex - Answer A type of decision that call for formal planning process over a longer timeline in which multiple risk management techniques can be applied. Decision quality elements should be embedded in the process. Due to the importance of the decision, biases should be formally considered by the entire planning team. Support Function: Project Management - Answer Assess and identify project risks, mitigate threats and capitalize on opportunities that my affect the success of a specific project. Gap analysis - Answer determine steps to improve the organization's capacity to move from a current state to a desired, future state. (current available factors, success factors needed to achieve future desired objectives, highlighting the gaps) How to obtain the real story aside from reading information? - Answer Talk to those inside the organization; Talk with external stakeholders ; Do site visits assumptions - Answer The risk manager can then identify ________________ made by management when developing these goals. Root Cause Analysis - Answer multiple techniques designed to identify the underlying or initiating risk sources or drivers. (fault tree analysis, event tree analysis, failure mode and effect analysis and cause-and-effect analysis - fish bone diagram) Element of decision quality: Frame the issue; identify the need - Answer Is solving this problem or realizing this opportunity worthwhile? What are the intended outcomes? Risk Culture - Answer The norms and traditions of behavior of individuals and of groups within an organization that determine the way in which they identify, understand, idsuss and act on the risk organization confronts and takes. Influence analysis/diagrams - Answer identify the strength of influencing factors and help determine potential weighting for consideration during the risk assessment process. Define root causes for major risks, define the chain of events likely in a scenario and become the foundation for further modeling. Training needs assessment: Why conduct the training? - Answer to tie the performance deficiency to a working need and be sure the benefits of conducting the traiing are greater than the problems being cuased by the performance deficiency. Conduct two types of analysis to answer this question: 1) needs versus wants analysis and 2) feasibility analysis Element of decision quality: Explore doable alternatives - Answer What options are available and how effective or disruptive will each one be in solving the problem or realizing the opportunity? What unintended consequences will each alternative create? Knowledge - Answer A risk management professional must possess general business acumen to generate conversations that lead to deeper understanding of organizational structure; value chain; market analysis, PESTLE, etc. key risks to each strategic goal - Answer The risk manager can then use in-depth risk analysis to assess the __________________ as well as the risks to the successful execution of the strategic plan. Risk Register Analysis - Answer compile risk into a risk register to analyze and manage those risks in an organized way, typically by category. Training needs assessment: Who is involved in the training? - Answer involve appropriate parties to solve the deficiency. Conduct a target population analysis to learn as much as possible about those involved in the deficiency and how to customize a training program to capture their interest. Element of decision quality: Consider meaningful, reliable information - Answer Is the information accurate, applicable and useful? How will this information inform the decision-making process? What different interpretations of the data are possible and how will each one affect the decision-making process? Skills - Answer A risk management professional must possess communication, technical and interpersonal skills to obtain organizational information. Action plans - Answer _____________ should be developed to address gaps between the key risks to the strategic plan and the successful delivery of the mission. Organize - Answer After obtaining information, what should be the next step to be done? organizational strategy - Answer Risk strategy should be continually revised to align with ____________________. Element of decision quality: Develop realistic options available to the decision makers - Answer How feasible, acceptable or desirable is each option and which will be most useful in achieving the objective? Scenario analysis - Answer process of analyzing possible and plausible future events by considering alternative settings, circumstances and outcomes. It provides a basis for making decisions in the context of different conditions. Training needs assessment: How can the performance deficiency be fixed? - Answer Can training fix the performance deficiency or suggest other remediation if training is not appropriate? Conduct a performance analysis to identify what skill deficiency is to be fixed by a training remedy. Risk analysis results to - Answer determine the risk adjusted probability of achieving strategic objectives; determine the key risks that may negatively or positively affect the achievement of the strategic objectives Synthesize - Answer A process of combining information in ways that are coherent, logical and meaningful. Element of decision quality: Understand clearly the values and trade-offs - Answer In pursuing each option, what are the consequences of making the trade-offs that will be needed? How clearly is the expected value understood? Training needs assessment: What is the best way to perform? - Answer Is there a better or preferred way to do a task to get the best results? Are job performance standards set by the organization? Are thre governmental regulations to consider when completing the task in a required manner? Conduct a task analysis to identify the best way to perform. Site analysis - Answer leaders at each site perform an assessment by analyzing and evaluating the potential risks based on what is being produced at the site and its environmental factors. This may include threat, vulnerability and criticality analyses. Prioritize - Answer The step to choose the information that is most relevant, timely, useful and valuable for assessing risks that could affect the organization's objectives. risk register - Answer ________________ is a tool that can be used to provide an overview or the organization's risk profile aligned to corporate strategy Element of decision quality: Use logical correct reasoning - Answer What biases may be influencing reasoning? Training needs assessment: When will training take place? - Answer What is the best timing to delivery training? Attendance at training can be impacted by work cycles, holidays and so forth. Conduct a contextual analysis to answer logistic questions. SWOT analysis - Answer strengths and weaknesses (internal), opportunities and threats (external) Monte Carlo analysis - Answer mathematical technique that generates random variables for modelling risk or uncertainty of a certain system (simulation). The random variables or inputs are modelled on the basis of probability distributions Developing training goals: Align training to specific organizational performance goals - Answer Training should directly support specific organization performance goals, such as increasing, revenues, decreasing costs, teaching a new process, launching a new product or complying with regulations. What are the primary risk management skills? - Answer Organize and synthesize; Differentiate and prioritize; Employ computer and math skills What are the components of enterprise risk profile that must be communicated to key stakeholders? - Answer Risk assessment; Risk appetite; Risk tolerance; Control process Element of decision quality: Acting on the decision - Answer Are these resources available for allocation to the decision? How readily will the decision be accepted and supported by stakeholders? Stress analysis - Answer a form of simulation used to determine reactions to different situations. Also used to gauge how certain stressors will affect a company or industry. Developing training goals: Identify performance goals for learners - Answer Performance goals identify the tasks team members have to perform to reach the goal. This the time to explore the peformance gaps between what the members are doing now and what they need to be able to do to accomplish the goal. Risk management professional's role: Strategic Advisor - Answer provides insights on known and emerging risks; shares specialized knowledge on potential exposures; recommend actions and influence decisions, identify and solicit involvement from key stakeholders How can you apply technical knowledge using risk management methods to business process? - Answer Identify the source of information; Rank its importance for the achievement of the organization's objectives; Compare the reliability of this source with other information sources; Determine whether to include the source as an important information source knowledge and understanding - Answer Organizational risk competency capabilities: _________________ of operations What are the methods of analyzing operations - Answer Identify the methods; Compare operations with intended culture and strategy; Validate strong relationship - Answer Organizational risk competency capabilities: ________________ with key stakeholders Developing training goals: Determine the learning activities - Answer This step involves identifying the activities that will help team members learn how to successfully achieve the specific perfor mance goals. Risk management professional's role: Facilitator - Answer encourages participants to share relevant information; provides the team with updates on the changes in the organization; Query and challenge what is said in order to fully develop a concept or issue and explore risks from a 360-degree perspective Influence diagrams, scenario analysis, site analysis, SWOT - Answer Examples of qualitative methodology for analyzing data Bowtie, business impact analysis, fault tree, cause/consequence analysis - Answer Examples of combined methodology for analyzing data What do learning objectives address? - Answer Knowledge, skills or attitudes, what learners will know, such as the elements of risk management process, skills learners can hold, such as those relating to risk appetite and tolerance. Risk management professional's role: Spectator - Answer refrains from influencing a risk dialogue; only take meeting notes or for staff development purposes, provide exposure to the risk management process Conduct Risk - Answer Comprises a wide variety of activities and types of behavior that fall outside other main categories of risk ; Risk attached to the way in which a firm, and its staff, behave in a wide range of market-facing and internal situations; How customers are treated, remuneration of staff and how firms deal with conflicts of interest ability to assess and plan - Answer Organizational risk competency capabilities: _______________________ for the appropriate number and type of resources necessary to execute a risk strategy and tactical plan Monte Carlo, stress analysis - Answer Examples of quantitative methodology for analyzing data How do learning objectives function? - Answer Learning objectives are SMART: five characteristics of effective learning objectives are that they are: specific, measurable, achievable, relevant and time bounded. Risk management professional's role: Coordinator - Answer arranging logistics of formal risk management planning meetings; set the date, location and agenda; keep team current and engaged; this can include risk updates to support a report, highlight specific risk for comment, detailing successes or adverse events. What are the steps to validate organizational information and behavior against an organization's intended culture? - Answer Scrutinize organizational functions; Compare the organization's business model and strategy with its operations to identify connections and points of dissonance risk awareness - Answer Organizational risk competency capabilities: ____________ as a core cultural characteristic What are attributes of a learning organization? - Answer Supports constructive criticism; Supports healthy debates; Open to understand attitudes about uncertainties, risk taking and tolerance forward-looking, long-term view - Answer Organizational risk competency capabilities: ___________________ into emerging risks Risk evaluation - Answer uses which risk criteria (risk appetite, risk tolerance, outputs from risk identification and risk analysis process) to determine which risks are acceptable and which require additional modification or treatment Pre-decision environment - Answer Decision has not yet been made; RMP should be able to articulate the value that can be gained by including more formal risk management process into the decision-making process for more significant or complex project, initiatives and strategy setting How are learning objectives communicated? - Answer Learning objectives have four parts: Each learning objective should indicate who will perform the action (person), the specific behavior to be performed, the conditions under which the behavior will be performed, and the degree to which the person must perform the behavior. Risk appetite - Answer is the total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one or more desire and expected outcomes. Coaching - Answer Methods of helping others to improve, develop, learn new skills, find success, achieve aims and manage change and challenges. Providing support and advice to an individual or group in order to help them recognize ways to improve their competencies and effectiveness. Active-decision Environment - Answer Decision is in the process of being made; RMP should identify the stakeholders, understand success measures; integration of risk management process; develop monitoring process What are the steps in benchmarking? - Answer Compare organization with peers and competitors; Differentiate and prioritize to identify peers trusted adivsor - Answer Organizational risk competency capabilities: Reputation for being technically risk-savvy and effective at influencing key decisions. Has earned the trust of leadership and decision-makers and is seen as a _____________. To benchmark the organization against its peers and competitors, which information must be obtained? - Answer Industry and trade publications; Stock analyst reports for publicly traded companies; Do your own research: Publicly available information such as google trends and prepare and competitive analysis identify, assess and treat risk - Answer Organizational risk competency capabilities: Ability to _______________ within a clear appetite and tolerance context. Risk tolerance - Answer is the amount of uncertainty an organization is prepared to accept in total - or more narrowly, within a certain business unit, a particular risk category, or for a specific initiative. Post-decision Environment - Answer Decision has already been made; RMP should create a learning environment for stakeholders to identify risks to performance through the execution process; Determine when in execution process risk-based discussions still could be used to favorably impact the outcome ERM integration in organizational strategies: Establish a purpose and value outcome for developing risk management competencies - Answer What value outcome will risk management competencies provide for strategy development and performance at strategic, operational and tactical levels? Risk interdependencies - Answer are situations where risks can have a cascading effect. Understanding this provides an opportunity to facilitate collaboration among various business units by addressing similar or related risks together. ERM integration in organizational strategies: Establish guiding principles by articulating the organization's risk philosophy - Answer Risk philosophy aligned with vision, mission and values; create and protect value Decision Making Environments - Answer Decisions can be categorized related to changes in the organization; scope and impact; level of familiarity In benchmarking, you may analyze and compare information and you can look for: - Answer Gaps, strengths and weaknesses, differentiators; risks matters to the organizational performance - Answer Organizational risk competency capabilities: Clear view into risk materiality and ability to narrow the focus to what really _________________. Core competencies - Answer These are fundamental for successfully performing as a risk management professional, irrespective of level of experience or training. These competencies form the foundation for being able to apply the related knowledge and skill components of the model for the needs of an organization. Quantitative Scoring Methods - Answer Scoring Method when rating organization against peers based on readily available data such as stock price, market capitalization and earnings per share Identify actual decision makers in the decision making environments - Answer Identify those who are accountable for performance ERM integration in organizational strategies: Establish a risk governance model that fits within the organization's unique governance arrangements - Answer Oversight, roles and responsibilities, structure unique to the organization Indemnification - Answer contractual obligation placed on the indemnifier to return the indemnified to essentially the same financial condition that existed prior to the loss or claim or to stand in as the source for financing the legal liability. Contractual risk transfer - Answer a legally binding agreement between two parties whereby one agrees to indemnify and hold another party harmless for specified actions, inactions, injuries or damages. ERM integration in organizational strategies: Determine the risk management strategy that will build organizational competencies in support of the organization's strategy - Answer Common definitions, references, measurements and process; improve risk management competencies throughout the organization, iterative plan tasks aligned with organization's planning processs Identify impact in the decision making environment - Answer Which decisions make the greatest impact on a specific strategy? Leverage information by using organized internal and external sources; information gathered from meetings; key inputs and outputs of the value chain and operations Qualitative Scoring Method - Answer Scoring Method when rating organization against peers based on economic, environmental and philanthropic programs that increase brand quality Core Competency: Attributes - Answer Qualities, characteristics and behaviors that, when displayed, will assist risk management professionals in getting things done in areas where they do not hold direct responsibility. These attributes are particularly important when adapting and integrating a horizontal, portfolio approach to risk management across an organization. What are the specific knowledge risk professionals need during benchmarking? - Answer Market analysis and environmental scanning; Business acumen-market analysis and value assessment; Due diligence and analytics Core Competency: Organizational Knowledge - Answer Risk management professionals of all levels are expected to know unique aspects of their respective organizations: its industry dynamics, its operating environment, and the activities it undertakes to achieve its strategy, goals and objectives. Hold harmless - Answer wording that requires one party to shield the other party from the effects of the legal liability assignable to transferor or obligor. Nine-box approach - Answer Approach that facilitates the consideration of the impact of decision within the various stages of decision-making. User knowledge from value chains and series of business processes steps that follow in succession. Tie in to the value creation and the resource of the value chain. Ultimate risk oversight responsibilities - Answer Belong at the board level Risk sharing/transfer - Answer action taken when i) costs of retaining risk exceeds the organization's risk tolerance; ii) risks or some portion can be transferred at a lower cost, iii) risks should be apportioned based o an agreement and iv) it is required by regulation. Operational risk assessment - Answer may be limitd to uncertainties associated with existing operations and operational plans - the assets, processes, people and systems in place - in order to deliver a particular outcome, such as planned earnings. Risk attitude - Answer the organization's or individual's view/perspective of the perceived qualitative and quantitative value that may be gained in comparison to the related potential loss or losses. What are the factors that are linked to value chain identification process? - Answer Value chains; Resources within the value chain; Key inputs and outputs ; Differentiators within an organization with its peers; Influential macro-economic factors