ISO 31000 - Certified Lead Risk Manager

Chief Risk Officer (CRO) serves as the principal adviser to the CEO, business unit heads, and critical function heads on risk matter. CRO leads the development and implementation of the organization's risk management framework and process.

According to , a captive insurance company is "a wholly owned subsidiary insurer that provides risk 3 mitigation services for its parent company or related entities". It can act as a reinsurer by accepting risks from other insurers or captives . It can also access reinsurance markets to transfer some of its own risks .
It can 1 1 sometimes offer greater cover than is available in the insurance market by tailoring its policies to suit its parent's needs . It does not have to be located in the same country as its parent company; in fact,
many 3 captives are domiciled offshore for tax or regulatory reasons . 4

Treatment plan becomes a living document of defining the direction of the risk treatment and being able to monitor progress against the plan . Treatment plan helps to ensure that risk treatment actions are aligned with 3 the changing context, objectives, and stakeholder expectations.

Risk avoidance involves deciding not to start or to discontinue activities that create unacceptable risk.

ISO 31000:2018 risk management process is descriptive . This means that it provides guidance on what 6 should be done for effective risk management, but not how it should be done. The process can be customized to any organization and its context.

According to , systemic risk is "the possibility that an event at the company level could trigger severe 1 instability or collapse an entire industry or economy". It is different from other types of risks that affect only specific parts or aspects of an organization . 2

Risk management can be used in varied and complex settings . Risk management can help organizations deal 2 with uncertainty and complexity in any type of activity, industry, or sector.

Key risk indicators are metrics that provide information about potential changes in the level of risk exposure . 3 They can help an organisation monitor and manage its risks more effectively. Key control indicators are metrics that measure the performance of internal controls . 4

According to , page 19, historic analysis is "a method of risk identification based on past data". It assumes 1 that past patterns and trends will continue in the future, which may not always be true.

Risk management is a process with inputs, activities, and outcomes . The inputs are the organization's 1 context and risk criteria. The activities are risk identification, analysis, evaluation, and treatment. The outcomes are improved decision making, performance, and resilience.