Tap to reveal what to do
- Do this first
- Why
- Control reference
- Common mistake
Keys: F or Space flip · → or G got it · ← or R review again · S shuffle. On a phone, swipe right or left.
You are all caught up
Cards you marked “Got it” come back after a few days so they stick. Cards to review again return sooner.
Topic mastery
Key concepts
- Risk
- The effect of uncertainty on objectives, usually described as an event, its cause and its consequence.
- Inherent vs residual
- Risk before controls versus the risk management actually carries after controls.
- Appetite and tolerance
- How much risk the organisation is willing to take, expressed as measurable thresholds.
- Treatment options
- Modify (mitigate), avoid, share (transfer) or retain (accept) the risk.
- Risk owner
- A named person with the authority and budget to manage the risk.
How an auditor tests it
- Check the methodology exists and is applied consistently across the register.
- Sample top risks and confirm named owners, current scores and recent reviews.
- Trace residual scores to evidence that the listed controls are operating.
- Check acceptances were approved at the right authority level and have expiry dates.
- Review overdue treatment plans and whether they were escalated.
Evidence examples
- Risk methodology and acceptance criteria
- Risk register with history
- Treatment plans with status and dates
- Signed risk acceptances
- Risk committee or management review minutes
Interview angles
- Walk me through how you'd score a new risk.
- What makes a risk acceptance valid?
- How do you explain risk to a board that only sees colours?
- When would you quantify a risk instead of scoring it?