Free PECB ISO 31000 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO 31000 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What typically initiates ISO's development of a new standard?

   1. A.A stakeholder request responding to an unmet market needCorrect answer: A
   2. B.A final publication issued before any need is identified
   3. C.A committee vote on an already completed international standard
   4. D.A conformity assessment conducted after a standard is in use

   Explanation: ISO states: "ISO does not decide when to develop a new standard, but responds to a request from industry or other stakeholders such as consumer groups." The request responds to a market need rather than an automatic schedule or regulatory mandate.

   Reference: Developing standards — Key principles in ISO standard development, Respond to a need in the market

2. 2Which ISO 31000 component does PECB describe as linking risk management practice and framework to strategic goals?

   1. A.The risk management principlesCorrect answer: A
   2. B.The risk treatment plan
   3. C.The risk criteria
   4. D.The risk register

   Explanation: PECB explains that "the purpose of risk management principles provided by ISO 31000 is to link the framework and practice of risk management to the organization’s strategic goals". The principles connect, rather than replace, strategy.

   Reference: ISO 31000:2018 — Risk Management Guidelines — Risk Management Principles based on ISO 31000

3. 3In ISO standards development, who negotiates a standard's scope and technical content?

   1. A.The national bodies voting after the technical text is finalized
   2. B.The experts participating in ISO technical committeesCorrect answer: B
   3. C.The ISO central staff working without committee experts
   4. D.The stakeholders reviewing the text only after publication

   Explanation: ISO says: "These experts negotiate all aspects of the standard, including its scope, key definitions and content." The preceding paragraph identifies them as experts in technical committees.

   Reference: Developing standards — Key principles in ISO standard development, Based on global expert opinion

4. 4A company considers adopting another company's risk management process. Which action reflects PECB's guidance on integration?

   1. A.Adapt the process to the company's needs and cultureCorrect answer: A
   2. B.Use the other company's context as the sole design basis
   3. C.Adopt the other company's risk criteria without review
   4. D.Keep the copied process independent of company objectives

   Explanation: PECB says integration "does not have a universal formula but needs to be customized to the organization’s needs and culture". Copying a process without considering context overlooks that guidance.

   Reference: ISO 31000:2018 — Risk Management Guidelines — How can Risk Management activities be integrated into the organization’s processes?

5. 5Which organizations can use the ISO 31000 guidelines?

   1. A.Only large organizations operating across national borders
   2. B.Any organization regardless of size, activity or sectorCorrect answer: B
   3. C.Only organizations seeking management-system certification
   4. D.Only public organizations with statutory risk duties

   Explanation: ISO states: "It can be used by any organization regardless of its size, activity or sector." The guidelines are not limited to a particular sector or size.

   Reference: ISO 31000:2018 — Risk management — Guidelines — FAQ, How can I use ISO 31000, and can I become certified?

6. 6What role does the ISO 31000 risk management framework serve in an organization?

   1. A.It supports integrating risk management throughout the organizationCorrect answer: A
   2. B.It describes the likelihood of one specific risk event
   3. C.It specifies the consequences of one identified event
   4. D.It records the result of a single risk assessment

   Explanation: PECB says ISO 31000 "underlines the development of a framework that will fully integrate the risk management process into an organization". Integration supports an organization-wide process.

   Reference: ISO 31000:2018 — Risk Management Guidelines — II. Designing a Risk management framework

7. 7What is ISO 31000's relationship to organizational certification?

   1. A.It specifies requirements for certifying a risk management system
   2. B.It offers guidance but cannot be used for certification purposesCorrect answer: B
   3. C.It certifies an organization's compliance with national legislation
   4. D.It requires all organizations to obtain third-party certification

   Explanation: ISO explains: "ISO 31000 cannot be used for certification purposes, but does provide guidance for internal or external audit programmes." Guidance is distinct from certifiable requirements.

   Reference: ISO 31000:2018 — Risk management — Guidelines — FAQ, How can I use ISO 31000, and can I become certified?

8. 8What is PECB's guidance about commitment when implementing a risk management framework?

   1. A.Top management and the wider organization both need commitmentCorrect answer: A
   2. B.Commitment is needed from top management but not other staff
   3. C.Commitment is needed from staff instead of top management
   4. D.Commitment is needed from external parties instead of management

   Explanation: PECB states: "the commitment of the top management alone is not enough; therefore, the commitment of the whole organization needs to be pursued". Leadership and broader participation both matter.

   Reference: ISO 31000:2018 — Risk Management Guidelines — II. Designing a Risk management framework

9. 9How does ISO describe the possible nature of organizational risks?

   1. A.Risks represent threats but cannot present opportunities
   2. B.Risks can pose threats or offer opportunitiesCorrect answer: B
   3. C.Risks are opportunities only when consequences are certain
   4. D.Risks are restricted to events with financial consequences

   Explanation: ISO states that every organization "encounters risks that can either pose threats or offer opportunities." Risks may therefore relate to adverse or beneficial possibilities.

   Reference: ISO 31000:2018 — Risk management — Guidelines — Why is ISO 31000 important?

10. 10A team is designing a risk management framework. Which action reflects PECB's guidance on engaging stakeholders?

    1. A.Seek relevant stakeholders' views during framework developmentCorrect answer: A
    2. B.Assume all stakeholders have the same views as management
    3. C.Defer stakeholder input until the framework is no longer used
    4. D.Seek feedback only from stakeholders who already support the framework

    Explanation: PECB states: "Successful implementation of the ISO 31000 risk management framework requires the engagement and awareness of stakeholders." Engagement helps address uncertainty in decisions.

    Reference: ISO 31000:2018 — Risk Management Guidelines — II. Designing a Risk management framework