Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. GAQM
  5. ISO-31000-CLA

GAQM ISO-31000-CLA Exam Questions
ISO 31000 - Certified Lead Risk Manager (Page 4 )

Updated On: 24-Feb-2026
Page 4 of 21
PDF with 100 Questions

Risk management as defined by OCEG GRC model is:

  1. Capability to set and evaluate performance against objectives
  2. Capability to proactively identify, assess and address uncertainty and potential obstacles to achieving objectives
  3. Capability to proactively encourage and ensure compliance with established policies and boundaries

Answer(s): B

Explanation:

According to 1, OCEG GRC model is "a framework for integrating governance, risk management,

compliance and ethics/culture into a single capability". It defines risk management as "the capability that enables an organization to understand how uncertainty affects its ability to achieve objectives" 2.



Which of the following is the current trend in auditing, risk management and compliance?

  1. Providing assurance over threats
  2. Performing discrete audits in compliance with internal control
  3. Front office function providing leading indicators about risk

Answer(s): C

Explanation:

According to 3, page 6, one of the current trends in auditing, risk management and compliance is "moving from a back-office function providing lagging indicators about risk (e.g., audit findings) to a front-office function providing leading indicators about risk (e.g., key risk indicators)".



Which risk is sometimes called `retained risk.'?

  1. Residual risk
  2. Conceptualize risk
  3. Analytical risk
  4. Procedural risk

Answer(s): A

Explanation:

According to ISO/IEC Guide73 (2009), clause B., residual risk is "the level of remaining after controls have been applied". It is sometimes called `retained risk' because it represents the amount of risk that an organization decides to accept or retain after implementing its mitigation strategies 3.



Which of the following statements does not apply to ISO 31000?

  1. It is the first standard issued by ISO for risk management
  2. It can be used by any organization regardless of its size, activity or sector
  3. It can be used for certification purposes

Answer(s): C

Explanation:

According to ISO31000 (2018), clause 1., it is "not intended for certification purposes". It provides guidance on how organizations can manage their risks effectively using a systematic approach based on principles, framework and process 3.



Who is expected to take a more focused oversight role with respect to risk management control and governance process?

  1. Internal auditors
  2. External auditors
  3. Audit committee
  4. None of the above

Answer(s): A

Explanation:

According to 3, page 7, one of the current trends in auditing, risk management and compliance is "increasing expectations for internal auditors to take a more focused oversight role with respect to enterprise-wide governance processes". Internal auditors can provide independent assurance on how well an organization manages its risks using various tools such as audits, reviews, assessments and evaluations.






Post your Comments and Discuss GAQM ISO-31000-CLA exam dumps with other Community members:

Join the ISO-31000-CLA Discussion