PECB ISO 31000 Lead Risk Manager ISO-31000-Lead-Risk-Manager Exam Questions

Page: 1 / 14
Total 80 questions
Question 1

According to ISO 31000, what is the main difference between the roles of the oversight body and top management in risk management?



Answer : B

The correct answer is B. The oversight body supervises risk management, while top management manages risk. ISO 31000:2018 clearly distinguishes between governance and management responsibilities within the risk management framework. The oversight body (such as a board of directors or equivalent governing body) is responsible for oversight, ensuring that risk management is appropriate, effective, and aligned with the organization's purpose, strategy, and governance arrangements.

Top management, on the other hand, is responsible for managing risk by establishing, implementing, and maintaining the risk management framework and ensuring that risk management is integrated into organizational activities and decision-making. ISO 31000 emphasizes leadership and commitment by top management as essential for embedding risk management into strategy, operations, and culture.

Option A is incorrect because the oversight body does not manage daily risk activities, nor does top management limit its role to opportunity-based risks. Option C is incorrect because, while both have responsibilities, their roles are distinct and complementary, not identical. Option D incorrectly assigns operational risk assessment responsibilities to the oversight body.

From a PECB ISO 31000 Lead Risk Manager perspective, understanding this distinction ensures proper governance, accountability, and effectiveness of risk management across all levels of the organization.


Question 2

Scenario 7:

Maxime, a chocolate manufacturer headquartered in Ghent, Belgium, produces toffees, eclairs, enrobed chocolates, and caramels. In 2023, a contamination incident in its caramel line triggered a large-scale product recall across Europe, exposing weaknesses in supplier evaluation, reporting channels, and crisis communication. Recognizing the financial, operational, and reputational impact of this event, top management decided to apply a risk management process in line with ISO 31000. The aim was to strengthen resilience, embed risk awareness across departments, and ensure risks are systematically managed in both daily operations and long-term strategies.

To ensure that the risk management process is effective, Maxime set up a structured monitoring and review process with clear procedures for collecting and analyzing data on key risks like supplier reliability, food safety, and communication. For validation of measurement methods, Sophie, the head of Quality Assurance, was tasked with assessing whether the tools used were suitable for evaluating the effectiveness of the process.

Additionally, Maxime introduced a set of measures designed to provide early warning indicators across critical areas. In operations, they tracked the number of production line stoppages and the percentage of defective batches. On the financial side, they monitored fluctuations in raw material prices, especially cocoa, and their impact on margins. For regulatory matters, they followed the frequency of nonconformities identified during inspections. In terms of technology, system downtime in automated packaging lines was measured.

To ensure these indicators were communicated effectively, Sophie worked with top management to present the results in a format that made changes easy to spot and understand. Rather than relying only on static reports, they chose a more dynamic approach that displayed key values visually, highlighted deviations, and issued alerts when thresholds were crossed.

In addition, Maxime established clear communication and consultation processes to ensure that relevant stakeholders were properly engaged. The top management used an approach that clarified who was responsible for carrying out tasks, who held final accountability, who should be consulted for expertise, and who needed to stay informed. To strengthen engagement, Maxime organized how risk information would be delivered to different audiences. Employees received updates during team briefings and through the company's internal platform, while external parties, such as suppliers and regulators, were informed through formal reports and direct correspondence. This approach ensured that each group had access to the information most relevant to them in a timely way.

Based on the scenario above, answer the following question:

According to Scenario 7, what reporting method did the top management and Sophie decide to use to communicate warning signals effectively?



Answer : C

The correct answer is C. Gauges. ISO 31000 highlights that effective risk communication requires presenting information in a form that is clear, timely, and easy to interpret, particularly when communicating warning signals that require prompt attention.

In Scenario 7, Maxime deliberately moved away from static reports and adopted a dynamic, visual reporting approach that displayed key values, highlighted deviations, and issued alerts when thresholds were crossed. This description aligns closely with the use of gauges, dashboards, or visual indicators that provide at-a-glance understanding of risk status.

Tactical and operational refer to management levels, not reporting methods. Narrative reports rely heavily on text and are less effective for immediate recognition of warning signals. Gauges, on the other hand, are designed to visually represent current status relative to thresholds, making them ideal for early warning communication.

From a PECB ISO 31000 Lead Risk Manager perspective, visual tools such as gauges enhance situational awareness, reduce cognitive load, and support faster decision-making. Therefore, the correct answer is Gauges.


Question 3

Which of the following is an example of an internal stakeholder?



Answer : C

The correct answer is C. Managers reporting and escalating risks within the organization. ISO 31000 defines stakeholders as persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity. Stakeholders can be internal or external, depending on their relationship with the organization.

Internal stakeholders are individuals or groups within the organization, such as employees, managers, executives, and internal committees. In the scenario provided, managers who report and escalate risks are clearly internal stakeholders, as they are directly involved in organizational processes and decision-making.

Option A, shareholders, are typically considered external stakeholders, as they are not involved in daily operations, even though they have a strong interest in performance. Option B, customers, are also external stakeholders concerned with outputs rather than internal processes. Option D, regulators, are external stakeholders representing legal and regulatory interests.

ISO 31000 emphasizes the importance of inclusiveness, requiring organizations to involve both internal and external stakeholders appropriately. Internal stakeholders play a critical role in risk identification, analysis, reporting, and treatment because of their proximity to operations and decision-making.

From a PECB ISO 31000 Lead Risk Manager perspective, correctly identifying internal stakeholders supports effective communication, accountability, and integration of risk management into everyday activities.


Question 4

What should an organization consider when selecting the most appropriate risk treatment option(s)?



Answer : C

The correct answer is C. The balance between potential benefits in achieving the objectives and costs, effort, or disadvantages of implementation. ISO 31000 emphasizes that risk treatment decisions should be proportionate, informed, and value-focused.

Selecting risk treatment options requires evaluating trade-offs. Organizations must consider how much a treatment option contributes to achieving objectives while also assessing its costs, resource requirements, operational impact, and potential disadvantages. This balanced approach ensures that risk management protects and creates value rather than imposing unnecessary burdens.

Option A is incorrect because focusing solely on cost ignores effectiveness and value creation. Option B is equally flawed, as ignoring costs and effort may lead to unsustainable or impractical solutions. Option D contradicts ISO 31000's emphasis on feasibility, proportionality, and alignment with context.

From a PECB ISO 31000 Lead Risk Manager perspective, effective risk treatment is about making informed choices, not automatically selecting the most aggressive option. Therefore, the correct answer is balancing benefits with costs, effort, and disadvantages.


Question 5

Scenario 4:

Headquartered in Barcelona, Spain, Solenco Energy is a renewable energy provider that operates several solar and wind farms across southern Europe. After experiencing periodic equipment failures and supplier delays that affected energy output, the company initiated a risk assessment in line with ISO 31000 to ensure organizational resilience, minimize disruptions, and support long-term performance.

To better quantify the financial exposure to inverter failure risk, the team multiplied the estimated probability of failure (10%) by the potential loss per event (900,000), yielding an annual expected impact of 90,000.

Based on the scenario above, answer the following question:

As indicated in Scenario 4, Solenco used Expected Monetary Value (EMV) to calculate the annual expected impact of the inverter failure risk. Is this acceptable?



Answer : B

The correct answer is B. Yes, organizations need to calculate the EMV of the identified negative risks only. ISO 31000 does not mandate specific quantitative techniques but allows organizations to use appropriate methods to analyze risk, provided they support informed decision-making. Expected Monetary Value (EMV) is a commonly used quantitative technique for analyzing negative (downside) risks, particularly where financial impacts can be reasonably estimated.

In Scenario 4, Solenco applied EMV appropriately by combining the probability of failure with the estimated financial consequences. This provided a clear, comparable metric for prioritizing the inverter failure risk relative to other risks in the risk register. ISO 31000 supports such proportional and context-appropriate analysis.

Option A is incorrect because not all risks require EMV calculation; the technique should be applied selectively based on relevance and materiality. Option C is incorrect because ISO 31000 does not prohibit point-in-time quantitative techniques; instead, it encourages combining them with monitoring and review. Option D is incorrect, as EMV is widely used across industries, not only in finance.

From a PECB ISO 31000 Lead Risk Manager perspective, EMV is acceptable and useful for analyzing significant financial risks when assumptions are transparent and results are reviewed regularly. Therefore, the correct answer is Yes, organizations need to calculate the EMV of the identified negative risks only.


Question 6

What is availability bias?



Answer : B

The correct answer is B. The reliance on previous occasions that one has been a part of when trying to predict a future event. Availability bias is a cognitive bias where individuals assess the likelihood of events based on how easily examples come to mind, often influenced by personal experience, recent events, or vivid memories.

In risk management, availability bias can distort risk perception by causing individuals to overestimate risks they have personally experienced or recently encountered, while underestimating less familiar but potentially significant risks. ISO 31000 emphasizes that risk management should be systematic, evidence-based, and inclusive, precisely to reduce the influence of cognitive biases.

Option A describes emotional discomfort rather than a cognitive bias. Option C refers more closely to anchoring bias, where decisions are overly influenced by a single reference point. Option D describes social loafing, not availability bias.

From a PECB ISO 31000 Lead Risk Manager perspective, recognizing availability bias is essential to ensure objective risk identification and analysis. Structured techniques, data analysis, and diverse stakeholder involvement help mitigate this bias. Therefore, the correct answer is reliance on previous occasions when predicting future events.


Question 7

Scenario 2:

Bambino is a furniture manufacturer headquartered in Florence, Italy, specializing in daycare furniture, including tables, chairs, children's beds, shelves, mats, changing stations, and indoor playhouses. After experiencing a major supply chain disruption that caused delays and revealed vulnerabilities in its operations, Bambino decided to implement a risk management framework and process based on ISO 31000 guidelines to systematically identify, assess, and manage risks.

As the first step in this process, top management appointed Luca, the operations manager of Bambino, to facilitate the adoption and integration of the framework into the company's operations, ensuring that risk awareness, communication, and structured practices became part of everyday decision-making.

After Luca took on the responsibility, he reviewed how responsibilities and decision-making were distributed across the company's units, with each unit overseen by a director managing strategic, administrative, and operational matters. At the same time, in consultation with top management, he analyzed the broader environment of Bambino, namely mission, governance, culture, resources, information flows, and stakeholder relationships.

Building on this, Luca outlined concrete actions to strengthen risk management by engaging stakeholders, breaking the process into stages, and aligning objectives with the company's goals. Progress was tracked through existing systems, allowing timely adjustments. Additionally, clear objectives were linked to the mission and strategy, responsibilities were defined, leadership demonstrated commitment, and expectations for daily integration were clarified. Finally, resources for people, skills, and technology were allocated, supported by communication, reporting, and escalation mechanisms.

Additionally, Luca reviewed the requirements the company was bound by, including safety laws for children's products, local labor regulations, and permits needed for operations. He also considered voluntary commitments, such as sustainability labels and agreements with daycare institutions. Through this review, he identified the likelihood of occurrence and potential consequences of failing to meet these requirements, ranging from legal penalties to loss of customer trust, making this area a clear source of exposure. This included the possibility of fines for breaching product safety laws, sanctions for violating labor regulations, and reputational harm if sustainability or contractual commitments were not fulfilled.

Based on the scenario above, answer the following question:

Based on Scenario 2, what type of organizational structure does Bambino have?



Answer : A

The correct answer is A. Functional structure. In the scenario, Bambino's organizational structure is described as having company units overseen by directors responsible for strategic, administrative, and operational matters within their respective areas. This indicates a traditional functional structure, where responsibilities are grouped by function and authority flows vertically through defined managerial roles.

A functional structure typically organizes the company around key business functions such as operations, administration, finance, and production. Each function is managed independently, with directors overseeing decision-making within their domain. This structure aligns with the description provided in Scenario 2, where Luca reviewed how responsibilities and decision-making were distributed across units managed by directors with broad functional accountability.

A divisional structure would involve separate divisions based on products, markets, or geographic regions, each operating semi-independently. This is not indicated in the scenario, as Bambino operates as a single integrated manufacturer specializing in daycare furniture. A matrix structure would involve dual reporting lines (e.g., functional and project-based), which is also not described.

From an ISO 31000 perspective, understanding the organizational structure is part of establishing the internal context, which is essential for designing and integrating an effective risk management framework. The functional structure influences how responsibilities are assigned, how communication flows, and how risk management is embedded into daily operations. Therefore, the correct answer is functional structure.


Page:    1 / 14   
Total 80 questions