Implementing risk management strategies means connecting vulnerabilities to workable controls, recovery capabilities, and financial decisions. This free ARM 402 guide provides 20 original practice questions and 60 concepts covering business interruption, cybersecurity and emerging technology, economic, operational, supply chain, reputational, personnel, intellectual property, and legal and compliance risks. Worked examples explain calculations and distinguish related decisions. Coverage follows the supplied current public course scope as of October 16, 2026; no future version is represented. Source citations establish syllabus relevance, rather than independently verifying every technical principle. Insurance outcomes depend on policy wording, and legal outcomes depend on jurisdiction. This representative preview uses multiple-choice scenarios; the issuer does not disclose ARM 402's exact item-format mixture.
What this guide covers
Practice 20 original ARM 402 questions and learn 60 concepts across all nine current course assignments.
ARM 402: Implementing Risk Management Strategies
1. Business impact analysis and tolerable disruption
A business impact analysis connects interrupted activities to consequences over time. It identifies when financial, service, contractual, safety, or stakeholder effects become unacceptable, then uses that tolerance to establish recovery priorities. A recovery time objective should leave room for operational restart after technical restoration. The analysis differs from estimating event probability: an infrequent disruption can still affect a critical activity. Apply it at the activity level, recording dependencies and minimum acceptable service, because restoring a department's systems does not necessarily restore its business outputs.
Worked example: A wholesaler can tolerate ten hours without dispatching orders. Restart checks take two hours after its warehouse system returns. Its system recovery objective must therefore be no more than eight hours, with staffing and loading equipment available for the restart.
Common mistake: Treating the longest tolerable interruption as the system recovery target overlooks the time needed to resume actual business service.
Official syllabus reference: [3]
2. Recovery point objectives and transaction loss
A recovery point objective defines how far back in time recovered data may fall relative to the disruption. It expresses tolerable data loss, whereas a recovery time objective expresses tolerable restoration duration. Backup frequency contributes to the recovery point, but successful execution, replication delays, corruption, and restoration integrity also matter. A recent copy is useful only if it is recoverable and trustworthy. Select the objective from the business consequences of missing transactions, then verify that the protection architecture can consistently supply an acceptable clean recovery point.
Worked example: An order platform accepts a maximum of 20 minutes of transaction loss. Hourly backups cannot meet that requirement by themselves. The company introduces protected transaction logs every ten minutes and tests reconstruction of complete orders from a restored backup.
Common mistake: A backup that restores quickly can still lose too much data; restoration speed and recovery-point recency measure different requirements.
Official syllabus reference: [3]
3. Recovery dependency chains and bottlenecks
A recovery dependency chain shows which resources must function before an activity can deliver its required output. Dependencies can include utilities, identity services, premises, specialist employees, applications, data, and external providers. Recovery sequencing follows these relationships rather than the visibility of individual systems. The slowest indispensable dependency can determine actual restoration time. Distinguish resources that are merely convenient from those necessary for minimum service, and test shared dependencies because several apparently separate activities may fail together when one enabling service remains unavailable.
Worked example: A retailer restores its sales application in two hours, but the identity service needed for staff login takes seven hours. Mapping the dependency reveals that faster application recovery alone cannot achieve the retailer's four-hour minimum-service target.
Common mistake: Adding individual system recovery times without examining parallel work and prerequisite relationships can misstate the actual business recovery duration.
Official syllabus reference: [3]
4. Lost contribution rather than lost revenue
An interruption's operating loss generally depends on lost revenue less expenses avoided because the revenue was not earned. Contribution margin is revenue minus variable costs and represents the amount available for fixed costs and profit. If fixed costs continue, lost contribution captures their uncovered portion together with lost profit; adding those fixed costs again double counts them. Apply the calculation to genuinely lost activity, considering postponed sales, substitute production, and later catch-up. Economic loss estimation remains separate from determining an insurance payment under particular policy definitions.
Worked example: A shop loses $200,000 of sales and avoids variable expenses equal to 65% of those sales. Its lost contribution is $70,000. If it spends another $12,000 on temporary premises, the modeled economic impact becomes $82,000 before insurance adjustments.
Common mistake: Equating sales shortfall with economic loss ignores avoided expenses and can substantially overstate the interruption's financial effect.
Official syllabus reference: [3]
5. Extra expense and incremental recovery economics
Extra expense is additional spending incurred to maintain or restore operations after disruption. An economic decision compares incremental spending with the contribution loss and other consequences it avoids. The relevant comparison uses alternatives over the same period and includes capacity constraints, setup delays, and uncertainty. Spending can be economically justified even when insurance does not reimburse it, while reimbursement does not by itself establish operational value. Policy treatment varies, so separate the business decision from any contractual requirement that expense reduce an otherwise covered loss.
Worked example: Temporary equipment costs $45,000 and prevents ten days of lost contribution at $7,000 per day. The modeled avoided loss is $70,000, giving a $25,000 net economic benefit before considering uncertainty, service commitments, taxes, or insurance reimbursement.
Common mistake: Comparing recovery expense with preserved revenue instead of preserved contribution exaggerates the benefit when serving those sales requires substantial variable spending.
Official syllabus reference: [3]
6. Business income coverage triggers and periods
Business income coverage is governed by the policy's insuring agreement, definitions, exclusions, conditions, limits, and applicable law. A common structure links income loss to qualifying physical damage, but specialized extensions and other forms can operate differently. The covered restoration period may differ from the time required to regain customers or market share. Waiting periods, sublimits, dependency provisions, and valuation requirements can alter payment. Analyze the cause, affected property, interruption, and timing separately rather than assuming every operational shutdown activates the same protection.
Worked example: A bakery reopens its repaired premises after three weeks but needs another month to rebuild sales. The risk manager examines the stated restoration period and any extended income provision before treating that later sales decline as insured.
Common mistake: Assuming all income lost after an incident is covered overlooks the policy's trigger, time boundaries, exclusions, and specific extensions.
Official syllabus reference: [3]
7. Alternate capacity and continuity strategy selection
Continuity strategies provide enough alternative capacity to meet a defined minimum service level within the required time. Options include alternate sites, remote work, reciprocal arrangements, manual processing, duplicate equipment, and contracted capacity. Their value depends on readiness, geographic independence, staffing, data access, and activation time. A nominal alternative can fail if it shares the same utility or is oversubscribed during a regional event. Compare the strategy's actual deliverable output with business requirements rather than assuming that duplicating an asset guarantees equivalent service.
Worked example: A call center needs 60 staffed seats within one day. A backup site offers 100 desks but only 20 working phone connections. The company must improve connectivity or combine sites before the arrangement meets the required service level.
Common mistake: Counting available floor space as recovery capacity ignores the people, connectivity, equipment, and permissions needed to deliver service.
Official syllabus reference: [3]
8. Continuity exercises and demonstrated recovery
Continuity exercises test whether plans, resources, and decisions produce the intended recovery outcome. A discussion exercise can expose unclear roles, while technical restoration and operational simulations test different capabilities. Define measurable objectives, realistic constraints, evidence requirements, and safe stopping conditions before the exercise. Success means achieving usable service and acceptable data integrity, rather than merely completing scripted steps. Record gaps, assign corrective actions, and retest material weaknesses. Exercise scope should be explicit because a successful desktop discussion does not prove that equipment or applications can actually recover.
Worked example: A payment firm's exercise requires processing reconciled transactions within five hours without its primary site. Staff restore the application in four hours but cannot reconcile balances. The exercise identifies a recovery gap despite successful technical restoration.
Common mistake: Marking an exercise successful because participants followed the checklist confuses procedural completion with demonstrated delivery of the required business outcome.
Official syllabus reference: [3]
9. Confidentiality, integrity, and availability
Confidentiality limits information access to authorized parties, integrity protects accuracy and authorized modification, and availability supports timely authorized use. A cyber event can affect one or several of these objectives. Matching controls to the threatened objective prevents incomplete treatment: encryption may protect confidentiality but cannot by itself ensure service availability or correct source data. Assess information and system needs separately, including the consequences of undetected alteration. Recovery should restore trustworthy operations, because an available system that produces incorrect transactions can continue causing losses.
Worked example: An attacker changes a supplier's bank details without copying customer records or interrupting service. The immediate failure concerns integrity. Payment-change verification and controlled modification rights address that mechanism more directly than encrypting the customer database alone.
Common mistake: Treating every cyber incident as data disclosure overlooks manipulation and service disruption, which can require substantially different preventive and recovery controls.
Official syllabus reference: [3]
10. Threat, vulnerability, and attack-path analysis
A threat is a potential cause of harm, while a vulnerability is a weakness through which that harm can occur. An attack path connects an initial opportunity to an asset or business consequence through reachable weaknesses and permissions. Vulnerability severity alone does not establish organizational risk: exposure, exploitability, existing barriers, and affected functions matter. Prioritize treatment where a credible path reaches consequential assets, while retaining attention to weaknesses that may become reachable after other controls fail. This supports decisions beyond simply counting unresolved technical findings.
Worked example: Two servers have the same software flaw. One is internet-facing and holds payment credentials; the other is isolated in a disposable test environment. The company prioritizes the first while checking whether the supposedly isolated server has hidden network connections.
Common mistake: Ranking weaknesses solely by technical severity can miss the attack paths and business consequences that make some exposures materially more urgent.
Official syllabus reference: [3]
11. Least privilege and temporary elevation
Least privilege limits each identity to permissions necessary for its authorized work. Temporary elevation further reduces exposure by activating powerful permissions only when justified and for a defined duration. Authentication establishes who is accessing a resource; authorization determines what that identity may do. Multifactor authentication therefore complements rather than replaces permission control. Apply restrictions to employees, service accounts, and automated agents, with separate administrative identities and traceable approvals. Review unused permissions because job changes and accumulated access can create authority that no longer serves a legitimate purpose.
Worked example: A database specialist needs administrator rights for a scheduled upgrade. The organization grants those rights for a two-hour window through a separate account, records the session, and removes elevation automatically when the approved maintenance period ends.
Common mistake: Assuming multifactor authentication makes unrestricted administrator access acceptable overlooks the damage possible after a privileged session is compromised.
Official syllabus reference: [3]
12. Segmentation and zero-trust access decisions
Network segmentation separates systems into zones and controls permitted traffic between them, reducing opportunities for lateral movement. Zero-trust approaches make access decisions using identity, device condition, resource sensitivity, and other relevant signals rather than treating network location as sufficient proof of trust. Neither approach requires denying all connectivity; necessary flows are explicitly permitted and constrained. Their effectiveness depends on actual enforcement and maintenance as systems change. Use them to limit how compromise of a routine workstation can reach privileged services, production systems, or sensitive data.
Worked example: A manufacturer permits office computers to view production reports through a controlled gateway but blocks direct access to machine controllers. When an office workstation is compromised, that separation reduces the available path into production control systems.
Common mistake: Placing systems on different network segments without restricting traffic creates separation on a diagram while leaving practical attack paths open.
Official syllabus reference: [3]
13. Immutable backups and clean restoration
Protected backups reduce the chance that an attacker or operational error destroys every recoverable copy. Immutability prevents alteration during a defined retention period, while isolation reduces shared access paths; these are related but different safeguards. Recovery also requires clean configurations, usable credentials, valid data, and sufficient restoration capacity. Replication supports availability but can rapidly reproduce corruption. Test representative restoration and transaction reconciliation, including compromised administrator scenarios. Backup completion reports alone do not establish that the organization can resume trustworthy service within its recovery objectives.
Worked example: A retailer's replica immediately copies encrypted files during an attack. Its separately administered immutable backup remains intact. A restoration test confirms that clean application images and transaction journals can rebuild the service without reconnecting infected systems.
Common mistake: Treating real-time replication as a complete backup strategy ignores its ability to copy malicious changes and accidental corruption immediately.
Official syllabus reference: [3]
14. Incident containment and evidence preservation
Cyber incident containment limits further harm while preserving the ability to understand the event and recover safely. Decisions balance operational needs, attacker movement, volatile evidence, and the risk of continued compromise. Isolation, credential revocation, and controlled service restrictions may be appropriate depending on the incident. Record actions and preserve relevant logs and artifacts through established handling procedures. Eradication removes the cause or foothold, while recovery restores validated service. Avoid confusing rapid reconnection with resolution, because an unremoved access path can allow immediate reinfection.
Worked example: A security team detects an infected workstation contacting a malicious server. It isolates the endpoint through management tooling, preserves available logs, checks exposed credentials, and investigates related activity before returning the rebuilt workstation to normal network access.
Common mistake: Reconnecting a restored device before checking persistence and exposed credentials can recreate the same compromise despite apparently successful cleanup.
Official syllabus reference: [3]
15. Cloud shared responsibility and vendor access
Outsourcing technology changes the allocation of tasks without automatically transferring all risk. Cloud responsibility depends on the service model and contract: a provider may secure infrastructure while the customer remains responsible for identities, configuration, data handling, and permitted uses. Vendor access can also become a route into customer systems. Map responsibilities to specific controls, verify evidence, and address incident coordination and exit arrangements. A certification or assurance report informs assessment but does not establish that every relevant service, customer configuration, or subcontractor activity is covered.
Worked example: A company buys hosted payroll software. The provider maintains the application, but the customer controls employee access and bank-change approvals. The risk manager checks both parties' responsibilities instead of assuming the hosting arrangement prevents unauthorized payment changes.
Common mistake: Assuming a provider's security certification covers customer configuration and every integration can leave important responsibilities unassigned and controls untested.
Official syllabus reference: [3]
16. AI hallucination, drift, and use-specific validation
Generative AI can produce plausible but unsupported statements, while predictive models can lose accuracy when data or relationships change. These mechanisms require different tests: factual verification addresses unsupported content, and performance analysis on relevant recent data helps detect drift. Validate a system for its intended decision and affected population rather than relying on general demonstrations. Constrain sensitive inputs, verify material outputs against authoritative records, and establish fallback procedures. A confidence score is useful only if its meaning and calibration support the specific task and consequences.
Worked example: An AI tool drafts contract summaries but invents a renewal clause. The company requires links to actual provisions and reviewer comparison with the signed contract. Separately, it tests whether changed contract templates reduce extraction accuracy over time.
Common mistake: Fluent output and high model confidence do not establish factual accuracy, legal suitability, or stable performance on a changed operating population.
Official syllabus reference: [3]
17. Operational technology and connected-device exposure
Operational technology controls physical processes, so cyber changes can affect equipment, product quality, safety, and continuity as well as information. Connected sensors and devices expand access paths and often have long service lives or limited update capabilities. Inventory devices, restrict remote access, separate control networks, and validate changes with process specialists. Conventional information-technology practices may require adaptation because immediate patching or restarting can disrupt physical operations. The objective is to reduce exploitable exposure while preserving safe process behavior, including reliable manual or protective shutdown capabilities.
Worked example: A water-treatment operator discovers a remotely accessible control interface. It restricts remote access through an approved gateway and tests authentication changes with process engineers, ensuring that protective controls and local operation remain available during the transition.
Common mistake: Applying an untested software update directly to production controllers can exchange a cyber weakness for an immediate process or availability failure.
Official syllabus reference: [3]
18. Inflation and nominal-versus-real comparisons
Inflation changes purchasing power, so nominal growth can differ from real economic improvement. For a consistent period, real growth equals one plus nominal growth divided by one plus inflation, minus one. Replacement costs may rise differently from a broad price index because materials, labor, and specialized equipment have distinct markets. Apply consistent price dates when comparing losses, budgets, and valuations. An inflation-adjusted estimate is still an estimate; it should reflect the relevant cost components rather than assuming one index accurately describes every asset or expense.
Worked example: A repair budget rises from $100,000 to $108,000 while relevant costs rise 5%. Its real increase is 1.08 divided by 1.05, minus one, or about 2.86%. The nominal 8% increase overstates the gain in purchasing power.
Common mistake: Comparing nominal costs from different years without a suitable price adjustment can misidentify inflation as deterioration in operational performance.
Official syllabus reference: [3]
19. Transaction, translation, and economic currency exposure
Transaction exposure arises from identified foreign-currency receipts or payments whose home-currency value changes before settlement. Translation exposure concerns converting foreign operations' financial statements into a reporting currency. Economic exposure concerns longer-term effects on competitiveness, demand, costs, and enterprise value. One currency movement can create all three, but the appropriate responses differ. A forward can hedge a specified payable without eliminating competitive pressure from foreign rivals. Identify the cash flow, accounting measure, or strategic effect at risk before choosing a currency-risk treatment.
Worked example: A US importer owes euros in three months, consolidates a European subsidiary, and competes with European manufacturers. The payable creates transaction exposure, consolidation creates translation exposure, and changing relative product prices create economic exposure.
Common mistake: Hedging an identified currency payable does not automatically protect foreign earnings translation or the business's longer-term competitive position.
Official syllabus reference: [3]
20. Forward hedges and matched currency cash flows
A currency forward fixes an exchange rate for a specified amount and settlement date. It reduces uncertainty in a matched foreign-currency obligation but can produce an unfavorable comparison with the later spot rate. Mismatched amounts or dates leave residual exposure, while cancellation of the underlying transaction can turn a hedge into a separate currency position. Natural hedging matches receipts and payments in the same currency where commercially practical. Evaluate counterparty obligations, liquidity effects, and contract terms rather than judging hedge quality solely by whether it later earns a gain.
Worked example: An importer owes EUR 500,000 and contracts to buy that amount at USD 1.12 per EUR. Its dollar requirement becomes $560,000 before fees. If the order shrinks to EUR 400,000, the unmatched EUR 100,000 requires a separate decision.
Common mistake: Calling a hedge unsuccessful whenever spot rates later improve confuses eliminating uncertainty with maximizing the benefit of hindsight.
Official syllabus reference: [3]
21. Interest-rate repricing and duration sensitivity
Interest-rate risk affects cash flows and market values through different mechanisms. Floating-rate borrowing changes interest expense when its reference rate resets, while existing fixed-rate debt normally retains its contractual coupon until specified events. Fixed-income asset values generally move inversely to yields, with duration providing an approximate first-order sensitivity measure. Match the analysis to the question: expense repricing, asset valuation, and future refinancing are distinct exposures. Consider reset dates, maturities, embedded options, and hedges before applying a simple rate-change calculation to an entire balance sheet.
Worked example: A firm has $4 million of immediately resetting floating debt. A 1.5-percentage-point increase adds approximately $60,000 annual interest if the balance persists. Its separate fixed-rate loan does not incur that increase during its unchanged fixed-rate period.
Common mistake: Applying a rate increase to every debt balance overlooks fixed coupons, reset timing, maturities, and the separate nature of refinancing exposure.
Official syllabus reference: [3]
22. Credit expected loss and concentrated counterparties
A simplified expected credit loss combines probability of default, exposure at default, and loss given default over a consistent horizon. The result is an average modeled loss, not a maximum or a reserve requirement applicable in every accounting framework. Collateral, recovery costs, timing, guarantees, and correlated defaults affect interpretation. Concentration matters because several exposures can fail together during stress even when their individual expected losses appear modest. Use expected loss alongside stressed cash-flow consequences and counterparty dependence rather than treating a low average as proof of affordability.
Worked example: A supplier credit exposure is $500,000, modeled default probability is 4%, and loss given default is 60%. Simplified expected loss is $12,000. A full default could still cause a $300,000 credit loss plus disruption to production.
Common mistake: Treating expected credit loss as the amount that will occur understates the possibility of a much larger concentrated default.
Official syllabus reference: [3]
23. Liquidity and the cash conversion cycle
Liquidity is the ability to meet obligations when due, which differs from accounting profitability. The cash conversion cycle combines inventory days and receivable days, then subtracts payable days to approximate how long operating cash remains tied up. Longer collection or stocking periods can create funding pressure even when margins remain positive. Analyze actual payment timing, available facilities, restrictions, and stress conditions. Shortening supplier payment terms can improve a supplier relationship while worsening the buyer's cash requirements, so working-capital decisions need a connected view of the operating cycle.
Worked example: A distributor holds inventory for 40 days, collects customers in 35 days, and pays suppliers in 25 days. Its cash conversion cycle is 50 days. If customer collections slow by 15 days, it needs funding for a longer cycle.
Common mistake: A profitable income statement does not establish that cash will arrive before payroll, debt payments, and supplier obligations become due.
Official syllabus reference: [3]
24. Economic scenario analysis and correlated stresses
Scenario analysis evaluates a coherent combination of conditions and their consequences, while sensitivity analysis changes selected inputs to show their individual effects. Economic stress often changes several variables together: demand can fall as credit tightens, customers pay later, and financing costs rise. Modeling these jointly reveals pressures that isolated sensitivities miss. A scenario is conditional analysis rather than a prediction unless probabilities are separately supported. Translate assumptions into volumes, margins, working capital, and liquidity so management can compare response options and identify failure points.
Worked example: A construction supplier models a downturn with sales down 15%, collection periods extended by 20 days, and borrowing rates up two percentage points. The combined cash forecast shows a funding shortfall that the sales-only sensitivity did not reveal.
Common mistake: Adding separate worst cases mechanically can create an incoherent scenario, while testing each factor alone can miss reinforcing economic pressures.
Official syllabus reference: [3]
25. Bow-tie analysis and barrier independence
Bow-tie analysis places a defined loss-of-control event between its initiating threats and potential consequences. Preventive barriers act before that event; mitigating barriers limit consequences afterward. The method makes control purpose visible and helps identify missing, shared, or fragile barriers. A barrier needs a credible mechanism, accountable maintenance, and evidence that it functions. Several controls dependent on one sensor or power supply may fail together. Use the diagram to examine barrier independence and degradation rather than counting the number of boxes as a measure of protection.
Worked example: For a storage-tank overflow, level control helps prevent loss of containment, while secondary containment limits spread afterward. If the operating alarm and shutdown both use one failed sensor, their apparent redundancy does not provide independent protection.
Common mistake: Counting multiple barriers without checking common dependencies can overstate protection when one failure disables several controls at once.
Official syllabus reference: [3]
26. FMEA scoring and severity overrides
Failure mode and effects analysis examines how a process or component can fail, the resulting effects, and associated causes and controls. Some implementations multiply severity, occurrence, and detection-difficulty ratings into a risk priority number. Equal products can conceal very different consequence profiles, and ordinal scores do not become precise probabilities through multiplication. Define rating scales and escalation rules before comparing results. High-severity failures may warrant separate attention even when occurrence is low. Reassess residual ratings after implementing controls rather than assuming planned changes have already reduced risk.
Worked example: One failure scores severity 10, occurrence 1, and detection difficulty 2, producing 20. Another scores 4, 4, and 3, producing 48. A severity-based escalation rule can appropriately prioritize the first for engineering review despite its lower product.
Common mistake: Treating the highest risk priority number as the automatic first priority can hide rare failures with disproportionately severe consequences.
Official syllabus reference: [3]
27. Control hierarchy and hazard elimination
The hierarchy of controls favors addressing hazards at their source through elimination or substitution, then engineering measures, with administrative controls and personal protective equipment generally more dependent on human action. The hierarchy guides selection but does not establish that any specific replacement is safer overall. Substitution can introduce new hazards, and engineering controls need validation and maintenance. Apply it to the actual exposure mechanism and combine compatible measures where necessary. Evaluate residual risk after the change, including maintenance, abnormal operation, and foreseeable attempts to bypass inconvenient safeguards.
Worked example: A cleaning process uses a volatile solvent. Replacing it with an effective less hazardous agent may reduce exposure at source. The company still checks the replacement's compatibility, ventilation needs, handling risks, and effect on product quality before adoption.
Common mistake: Assuming substitution automatically eliminates risk can overlook new chemical, process, compatibility, or ergonomic hazards introduced by the replacement.
Official syllabus reference: [3]
28. Segregation of duties and compensating controls
Segregation of duties prevents one person from controlling incompatible stages of a transaction, such as creating a supplier, approving payment, and reconciling the bank account. It reduces opportunities for error concealment and fraud but does not eliminate collusion or management override. Small teams may need compensating controls, such as independent review using source evidence and restricted system permissions. A review is meaningful only when the reviewer can detect the targeted problem and act on exceptions. Separate job titles alone do not prove that actual access is separated.
Worked example: A small charity cannot hire another accountant. It prevents the bookkeeper from authorizing bank transfers and has a trustee review new payees against invoices and bank statements. The arrangement targets incompatible powers rather than merely adding another signature.
Common mistake: Requiring two signatures adds little protection when both approvers rely on the same unchecked information or share unrestricted system access.
Official syllabus reference: [3]
29. Management of change and introduced hazards
Management of change evaluates risks created when equipment, materials, software, procedures, staffing, or operating conditions change. It examines affected interfaces, required approvals, training, documentation, and readiness before implementation. Temporary changes also matter because they can persist beyond their intended period or invalidate established safeguards. The process should distinguish routine replacement within approved specifications from changes that alter assumptions. A pre-start review confirms that required controls are actually in place. Success means controlled introduction and verification, rather than obtaining signatures after the change has already occurred.
Worked example: A factory increases a conveyor's speed to meet demand. The change review checks guarding, stopping distances, downstream capacity, maintenance intervals, and operator workload. A controlled trial reveals that the packing station becomes a bottleneck before full-speed production begins.
Common mistake: Classifying a change as temporary does not prevent it from altering hazards, defeating controls, or becoming an unreviewed permanent arrangement.
Official syllabus reference: [3]
30. Human factors and error-proof process design
Human factors analysis examines how task design, workload, interfaces, environment, and organizational conditions influence performance. Slips, memory lapses, mistaken decisions, and deliberate workarounds have different causes and call for different responses. Error-proofing reduces the opportunity for a mistake or makes it immediately visible, such as keyed connectors or automatic field checks. Training remains useful when knowledge is missing, but it may not solve an interface trap. Examine normal work and production pressures to understand why an action made sense to the person at the time.
Worked example: Technicians repeatedly connect two identical hoses incorrectly during hurried changeovers. Instead of relying only on reminders, the company installs incompatible connector shapes and tests the arrangement with users. The redesign prevents reversal without requiring perfect attention.
Common mistake: Calling an event operator error can prematurely end analysis and leave the task conditions that repeatedly produce the same mistake unchanged.
Official syllabus reference: [3]
31. Leading indicators, lagging outcomes, and exposure
Lagging indicators record outcomes such as losses or failures, while leading indicators track conditions or activities expected to influence future outcomes. Neither category is inherently reliable: a leading measure needs a credible connection to the risk mechanism, and outcome measures need exposure and reporting context. Normalize counts where appropriate, examine data completeness, and distinguish activity completion from control effectiveness. Stable loss counts during rapid growth may reflect an improving rate, while falling counts during reduced activity may conceal unchanged risk per unit of work.
Worked example: A warehouse records eight injuries in both years, but hours worked double. Its injury rate falls, although severity and reporting completeness still need examination. Separately, the percentage of functioning vehicle proximity sensors provides evidence about a specific preventive barrier.
Common mistake: Treating training hours as proof of effective control ignores whether employees learned the task and whether the underlying exposure actually changed.
Official syllabus reference: [3]
32. Preventive, predictive, and corrective maintenance
Preventive maintenance follows planned intervals, predictive maintenance uses condition information to anticipate deterioration, and corrective maintenance repairs faults after detection or failure. Selection depends on failure behavior, monitoring feasibility, consequences, and available redundancy. Predictive methods are less useful when a failure has no detectable warning interval, while excessive intrusive maintenance can itself introduce defects. Match maintenance tasks to failure modes rather than applying one schedule to all equipment. Include spare-parts availability and restoration duration because even a low-frequency failure can create substantial interruption when replacement takes months.
Worked example: A plant monitors bearing vibration because deterioration usually provides warning before failure. It still replaces another component on a scheduled basis because its failure pattern and inspection limits make vibration monitoring unsuitable for that separate mechanism.
Common mistake: Installing condition sensors does not replace every scheduled task, especially where important failures occur without a reliably detectable warning period.
Official syllabus reference: [3]
33. Multi-tier supply mapping and hidden dependencies
Supply mapping traces critical products and services beyond immediate vendors to important sub-suppliers, facilities, logistics routes, utilities, and information dependencies. The objective is to identify where interruption can stop a required business output. A long vendor list may still depend on one upstream source. Map the particular component or capability rather than assuming every product from a supplier shares the same exposure. Prioritize depth using criticality, substitutability, recovery lead time, and available evidence because exhaustive mapping of every purchase may not be practical or useful.
Worked example: A medical-device assembler buys the same chip from three distributors. Mapping reveals that all chips come from one fabrication plant. The apparent three-source arrangement does not protect the assembler against disruption at that common upstream facility.
Common mistake: Counting direct vendors without tracing production origins can disguise a single point of failure behind several independent commercial relationships.
Official syllabus reference: [3]
34. Supplier correlation and common-cause disruption
Diversification reduces risk only to the extent that alternative sources do not fail together. Suppliers can share a region, port, utility, sub-tier factory, software platform, or financial dependency. Joint failure probability therefore cannot automatically be calculated by multiplying individual probabilities. Identify common causes and model conditional outcomes, separating shared events from supplier-specific failures. Geographic distance can help but does not establish independence when production or logistics converge elsewhere. Apply this analysis when assessing whether alternate sourcing will genuinely preserve capacity during the disruption scenarios that matter.
Worked example: Two suppliers operate in different cities but route all exports through the same port. A port closure interrupts both simultaneously. The buyer adds a qualified inland route rather than assuming that a second supplier already provides effective logistics diversification.
Common mistake: Multiplying supplier failure probabilities assumes independence and can substantially understate joint disruption when shared facilities or infrastructure dominate the exposure.
Official syllabus reference: [3]
35. Safety stock and reorder-point mechanics
In a basic continuous-review model, the reorder point equals expected demand during replenishment lead time plus safety stock. Inventory position includes stock on hand and on order, less backorders, so it differs from physical inventory. Safety stock buffers uncertainty in demand or lead time, whereas cycle stock supports ordinary replenishment. More stock can improve continuity but increases financing, storage, obsolescence, and spoilage costs. Select assumptions that match the actual system; changing supplier reliability or review frequency can invalidate a buffer calculated under earlier conditions.
Worked example: A repair center uses 12 parts daily with a 15-day replenishment lead time and a chosen 60-part buffer. Its reorder point is 240 parts of inventory position. The order quantity is a separate decision from that trigger.
Common mistake: Adding the normal order quantity to the reorder point confuses how much to buy with when to initiate replenishment.
Official syllabus reference: [3]
36. Supplier qualification and total cost of ownership
Supplier qualification evaluates whether a provider can consistently deliver required quality, capacity, service, and compliance. Purchase price is only one component of total cost of ownership, which can include transport, inspection, defects, rework, inventory, expediting, and disruption. Use evidence relevant to the actual product and production site, because general reputation may not demonstrate capability. Qualification should also examine financial resilience and dependencies. A cheaper offer can remain attractive, but its comparison must account for expected downstream costs and the consequences of unavailable or unusable supply.
Worked example: A component offer is $2 cheaper per unit but requires added inspection and generates more assembly failures. The buyer compares delivered usable-unit cost, rework, buffer inventory, and interruption exposure before deciding whether the lower invoice price creates value.
Common mistake: Selecting the lowest unit price without considering usable yield and delivery reliability can increase total spending and production interruption exposure.
Official syllabus reference: [3]
37. Bullwhip effects and demand-signal distortion
The bullwhip effect occurs when order variability grows as demand information moves upstream through a supply chain. Forecast updating, large order batches, promotions, shortage gaming, and long lead times can amplify modest consumer changes. Upstream firms then face excess capacity swings, stockouts, or obsolete inventory that do not reflect final demand. Sharing reliable consumption data, smoothing ordering practices, and shortening lead times can reduce distortion. Information sharing alone is insufficient when incentives encourage inflated orders or when allocation rules reward customers for overstating their needs.
Worked example: Retail sales rise 5%, but retailers double orders because they fear allocation limits. Wholesalers interpret those orders as lasting demand and expand their own purchases. When retail demand stabilizes, the chain is left with excess stock and canceled orders.
Common mistake: Treating customer orders as an unbiased measure of final demand overlooks batching, promotions, and shortage behavior that can amplify upstream volatility.
Official syllabus reference: [3]
38. Qualified alternates and supply recovery lead time
An alternate supplier provides continuity only when its product, process, capacity, and delivery route can meet requirements within the needed time. Qualification, tooling, testing, regulatory conditions, contracting, and transport can make switching slower than expected. Compare the full transition lead time with available inventory and tolerable interruption. Reserved capacity or maintained tooling can shorten recovery, but agreements need credible activation terms. Distinguish an identified candidate from a ready alternate, and test whether the source would remain available during the same event affecting the primary supplier.
Worked example: A factory has ten days of critical bearings in stock. Its alternate supplier can ship in three days, but qualification testing takes four weeks. The company begins prequalification now because emergency purchase capability alone cannot bridge the interruption.
Common mistake: A supplier's willingness to quote does not establish that approved, usable material can reach production before existing inventory is exhausted.
Official syllabus reference: [3]
39. Stakeholder expectations and reputation gaps
Reputation develops from stakeholder judgments about an organization's conduct, performance, and credibility. A reputation gap arises when actual behavior or perceived performance falls short of expectations. Different groups can evaluate the same event differently: customers may emphasize service, employees fairness, and investors financial resilience. Identify the specific promise and affected group before choosing a response. Strong performance in one dimension does not automatically offset failure in another. Reputation management therefore involves aligning operational behavior and commitments, rather than treating favorable publicity as a substitute for meeting expectations.
Worked example: A delivery company meets its average transit target but repeatedly loses temperature-sensitive medicine. Healthcare customers judge product integrity more important than average speed. The company revises handling controls and customer commitments rather than relying on its general delivery statistics.
Common mistake: Assuming one favorable performance metric proves a strong reputation ignores the particular expectations and experiences that matter to different stakeholders.
Official syllabus reference: [3]
40. Reputation amplification and secondary consequences
An originating event can trigger reputation effects that extend beyond its direct financial or operational loss. Stakeholder concern, media attention, social sharing, and perceived organizational response can amplify consequences through cancellations, employee departures, financing pressure, or regulatory scrutiny. These pathways are contingent rather than automatic, so scenario analysis should identify credible links. Distinguish the original event from the mechanisms that spread its impact. This helps management intervene through corrective action, accurate information, and service support without assuming that every negative mention produces an equivalent measurable loss.
Worked example: A brief billing error is corrected quickly, but customers discover that complaints were dismissed for weeks. The perceived response amplifies the original problem, leading business clients to review renewals even though the accounting error itself caused limited direct loss.
Common mistake: Estimating reputation loss solely from the direct incident cost overlooks how perceived concealment or indifference can expand stakeholder consequences.
Official syllabus reference: [3]
41. Verified crisis communication and update cadence
Effective crisis communication provides verified facts, acknowledges what remains uncertain, explains protective or corrective actions, and sets expectations for updates. Coordination helps keep channels consistent while allowing messages to address different stakeholder needs. Speed matters when people need actionable information, but unsupported causal claims can weaken credibility when evidence changes. Separate confirmed impact from investigation hypotheses and avoid promises outside operational control. A defined update cadence can reduce information gaps even when the next update reports that investigation continues rather than announcing a complete resolution.
Worked example: A transport operator knows which routes are suspended but not when repairs will finish. It publishes affected routes, available alternatives, and the next update time. It does not invent a restoration estimate to make the announcement appear complete.
Common mistake: Waiting for a final root cause before sharing confirmed protective information can leave stakeholders unable to make decisions during the most consequential period.
Official syllabus reference: [3]
42. Sentiment measures and reputation evidence quality
Reputation indicators can include complaints, renewal behavior, trust surveys, employee feedback, and media or social sentiment. Each measure has selection effects and interpretation limits. Online mentions may overrepresent highly engaged users, automated activity, or a short-lived news cycle. Compare sources, examine denominators, and connect signals to affected stakeholder behavior. A sentiment score is evidence about sampled expression rather than a direct valuation of reputation. Use it to guide investigation and response while checking whether changes reflect the organization's conduct, sampling changes, or external events.
Worked example: A retailer sees negative mentions triple after a viral post, while verified complaints and repeat purchases remain stable. It investigates the issue and sample composition rather than translating the mention count directly into an assumed percentage decline in customer trust.
Common mistake: Equating social-media volume with representative stakeholder opinion ignores sampling bias, automated activity, and differences between online expression and actual behavior.
Official syllabus reference: [3]
43. Corrective action and credibility of public commitments
Public commitments create expectations that can increase reputation exposure if operational performance does not support them. Credibility improves when claims are specific, substantiated, and matched by corrective action addressing the underlying mechanism. Broad assurances can be fragile when exceptions or incomplete evidence emerge. Define the scope, time period, and verification basis of material claims, including environmental or social statements. Communication should accurately describe progress rather than imply completion. The operational remedy and the public explanation reinforce each other when stakeholders can observe that promised changes produce meaningful results.
Worked example: A clothing brand discovers incomplete labor audits at several factories. It states which facilities are covered, suspends unsupported claims, and publishes verified remediation milestones. Saying every supplier is fully compliant before the checks finish would create a new credibility exposure.
Common mistake: A stronger assurance campaign cannot reliably repair trust when the organization has not corrected the conduct that caused stakeholders' concern.
Official syllabus reference: [3]
44. Reputation exposure through third-party conduct
Stakeholders may associate an organization's reputation with suppliers, distributors, endorsers, franchisees, or other partners, even when legal entities and responsibilities differ. The exposure depends on brand visibility, perceived influence, contractual relationships, and the seriousness of the conduct. Evaluate partners whose behavior can contradict important commitments, then use appropriate selection, contractual expectations, verification, and exit options. Legal allocation does not fully determine stakeholder attribution. The practical decision is how the relationship can affect trust and what influence the organization can exercise before and after an event.
Worked example: A hotel brand uses an outsourced booking center that misrepresents cancellation terms. Guests attribute the experience to the hotel, whose name appears throughout the transaction. The brand changes scripts, verifies calls, and aligns refunds with its customer commitments.
Common mistake: An outsourcing clause may allocate costs between businesses without preventing customers from attributing the partner's conduct to the visible brand.
Official syllabus reference: [3]
45. Workforce capacity, competence, and correlated absence
Workforce exposure concerns whether enough people with the required skills can perform essential work under realistic conditions. Headcount alone can conceal licensing, experience, shift coverage, or location constraints. Absences can be correlated through transport disruption, illness, shared housing, or regional events. Map essential tasks to demonstrated competencies and available coverage, including peak demand and fatigue constraints. Cross-training can improve flexibility, but substituting unfamiliar personnel may reduce quality or safety. The analysis should establish usable capability per shift rather than assuming every employee is interchangeable.
Worked example: A distribution center has 80 employees but only four certified equipment operators, all assigned to one shift. A transport disruption affecting that shift stops loading. The company develops qualified coverage across shifts instead of relying on total headcount.
Common mistake: Treating all employees as interchangeable can hide a shortage of task-specific competence even when overall staffing appears comfortably sufficient.
Official syllabus reference: [3]
46. Near misses and reporting-system incentives
A near miss is an event that could have caused harm but did not produce the relevant injury or loss in that instance. Investigating its mechanism can reveal failed barriers before a severe outcome occurs. Reporting volume is affected by trust, definitions, workload, and incentives, so an increase can indicate improved visibility rather than deteriorating safety. Reward useful reporting and corrective action without encouraging fabrication or suppressing injuries. Evaluate event potential and control weaknesses rather than assuming all near misses have equal significance or that their count predicts losses mechanically.
Worked example: After introducing confidential reporting, a warehouse receives more accounts of forklift pedestrian conflicts. Rather than penalizing the increase, managers verify the events, redesign crossing points, and examine whether the change reduces credible conflict exposure over subsequent shifts.
Common mistake: Rewarding departments solely for low reported incident counts can encourage concealment and make the apparent improvement less reliable.
Official syllabus reference: [3]
47. Ergonomic exposure and task redesign
Ergonomic risk arises from the interaction of task demands and human capability, including force, repetition, posture, duration, and recovery opportunities. Exposure depends on combinations rather than a single universal limit. Task redesign can reduce reach distances, lifting demands, awkward positions, or repetitive effort through equipment and workflow changes. Evaluate the full cycle because solving one posture problem can increase another demand. Training supports correct use of redesigned work but does not remove excessive physical requirements. Validate improvements with representative workers and actual production conditions.
Worked example: Packers repeatedly reach across a wide conveyor to lift cartons. Moving materials closer and adding height-adjustable lift assistance reduces both reaching and load handling. A trial checks whether the redesign introduces twisting when cartons move to the outbound pallet.
Common mistake: Teaching a lifting technique without changing an excessive or awkward task can leave the main ergonomic exposure substantially intact.
Official syllabus reference: [3]
48. Succession planning and validated knowledge transfer
Key-person exposure occurs when critical relationships, authority, or know-how are concentrated in an individual. Succession planning identifies necessary capabilities and develops people who can perform them when needed. Documentation supports transfer, but competence must be demonstrated through realistic tasks and exception handling. Insurance can supply funds after a covered event without replacing knowledge or customer confidence. Separate long-term leadership succession from immediate operational backup, since each requires different readiness. Validate access rights and decision authority as well as technical skill so replacements can actually execute the role.
Worked example: An engineer alone understands a legacy machine's setup. Two technicians shadow the work, use revised instructions, and then complete an independent setup that meets quality specifications. This verifies usable transfer rather than merely recording attendance at knowledge-sharing sessions.
Common mistake: A complete manual does not prove that another employee can recognize exceptions, make necessary judgments, or perform the critical task independently.
Official syllabus reference: [3]
49. Employment-practice consistency and job-related criteria
Employment-practice risk can arise from recruitment, promotion, discipline, termination, harassment, and other workplace decisions. Applicable obligations vary by jurisdiction and employment relationship, so avoid assuming one legal test applies everywhere. Job-related criteria, consistent procedures, reliable evidence, and accessible reporting help reduce arbitrary decisions and identify problems. Consistency does not require ignoring relevant differences or legitimate accommodation obligations. Examine whether selection tools and managerial discretion operate as intended, including patterns that warrant investigation. Records should explain the actual basis for decisions rather than retroactively justify them.
Worked example: Two managers use different promotion standards for the same role. The company defines relevant competencies, calibrates assessment evidence, and reviews outcomes for unexplained differences. It also checks local requirements before changing the process or applying criteria across jurisdictions.
Common mistake: Applying the same superficial rule to everyone does not establish fairness when job relevance, individual circumstances, or applicable obligations require closer analysis.
Official syllabus reference: [3]
50. Occupational fraud and opportunity controls
The fraud triangle describes pressure, opportunity, and rationalization as a useful framework for understanding some occupational fraud situations. It is an analytical model rather than a reliable method for labeling individuals as fraudulent. Organizations can directly reduce opportunities through access restrictions, independent verification, reconciliations, and oversight. Pressure and rationalization may be influenced by incentives and culture, but personal characteristics alone do not establish wrongdoing. Design detection around transaction mechanisms and evidence, and recognize collusion and management override as limits of controls that otherwise separate individual authority.
Worked example: A purchasing employee can create suppliers and approve their invoices. Independent verification of new suppliers and separate payment authorization reduce the opportunity to direct funds to a fictitious vendor, regardless of whether managers can identify personal financial pressure.
Common mistake: Using the fraud triangle to accuse a financially stressed employee substitutes speculation about motives for evidence of actual transactions and control failures.
Official syllabus reference: [3]
51. Trade secrets and reasonable secrecy measures
Trade secret protection generally concerns valuable nonpublic information whose secrecy is supported by reasonable measures under the applicable law. Information can include formulas, processes, customer knowledge, or technical methods, but confidentiality labels alone do not establish protection. Limit access by business need, control copies and departures, and use appropriate confidentiality obligations. Independent discovery and lawful reverse engineering can limit the practical protection available. Compare secrecy with patent disclosure and commercial realities before selecting a strategy, especially when the product itself makes the information readily observable.
Worked example: A seasoning producer keeps its formula in a restricted repository, divides production instructions where practical, and reviews access when staff leave. It also assesses whether competitors could infer the formula from testing the finished product before relying entirely on secrecy.
Common mistake: Calling information confidential while allowing unrestricted internal and external distribution can undermine the secrecy measures needed to support trade secret protection.
Official syllabus reference: [3]
52. Patent claims, disclosure, and territorial protection
A patent can provide a time-limited right to exclude others from specified claimed activity in jurisdictions where the right exists and remains enforceable. The claims define the protected scope, not merely the product description or patent title. Patent systems require disclosure and assess requirements such as novelty and inventive contribution under applicable rules. Disclosure timing can affect eligibility, with exceptions varying by jurisdiction. Evaluate filing strategy before public release and distinguish owning an invention from obtaining protection in every market where it may be manufactured or sold.
Worked example: A startup plans to demonstrate a new valve internationally. Before disclosure, it obtains jurisdiction-specific advice on filing and examines which technical features its proposed claims would cover. A domestic patent alone would not create equivalent rights in every intended market.
Common mistake: Assuming a patent protects every product feature worldwide overlooks claim boundaries, territorial rights, validity, and the effect of public disclosure.
Official syllabus reference: [3]
53. Copyright, expression, and license scope
Copyright generally protects qualifying original expression rather than abstract ideas, methods, or functional principles. Rights, exceptions, duration, and ownership rules vary by jurisdiction and work type. Buying a copy or commissioning work does not necessarily convey every right needed for adaptation, redistribution, or commercial reuse. A license defines permitted activities and may limit users, territory, media, duration, or modification. Review software and content dependencies for compatible terms, including attribution and redistribution conditions, rather than assuming that publicly accessible material is available for unrestricted business use.
Worked example: A manufacturer purchases a technical illustration for an internal manual, then wants to place it in worldwide advertising. It checks whether the license permits external commercial distribution and modification instead of assuming the original purchase covers the expanded use.
Common mistake: Access to an image or software file does not establish permission to reproduce, adapt, redistribute, or use it commercially.
Official syllabus reference: [3]
54. Trademark confusion and brand clearance
Trademarks identify commercial source and can protect names, symbols, and other qualifying indicators under relevant law. Risk analysis considers whether proposed branding conflicts with others' rights in the relevant market and goods or services. Exact spelling differences do not automatically eliminate confusion, and obtaining a domain name does not establish trademark clearance. Search and assess relevant registrations and use before committing to packaging or launch costs. Trademark protection addresses source identification, while patents and copyright concern different interests, so one form of protection cannot substitute for the others.
Worked example: A new cleaning product uses a name that sounds like an established household brand despite different spelling. The company evaluates likely market confusion and relevant rights before ordering packaging, rather than relying on the availability of its preferred internet domain.
Common mistake: A free domain name or company-name registration does not prove that the proposed brand is clear of others' trademark rights.
Official syllabus reference: [3]
55. Freedom to operate and blocking intellectual property
Freedom to operate asks whether a proposed commercial activity can proceed without infringing relevant enforceable rights or breaching license restrictions. It differs from determining whether the organization owns protectable intellectual property. An improvement can qualify for its own patent while still practicing another party's broader claims. Analyze intended activities, markets, dates, ownership chains, and license scope with appropriate expertise. Responses can include redesign, suitable licensing, acquisition, or changing the launch plan. A supplier's assurance helps allocate responsibility but does not itself eliminate a third party's rights.
Worked example: A company patents an improved pump seal, but manufacturing it requires technology covered by another enforceable patent. It negotiates commercial rights to the underlying technology or redesigns the seal before launch rather than treating its improvement patent as operating permission.
Common mistake: Owning a patent is not an automatic authorization to manufacture or sell a product that uses another party's protected invention.
Official syllabus reference: [3]
56. Compliance obligation registers and applicability
An obligation register links applicable requirements to the organization's entities, activities, products, jurisdictions, responsible owners, and evidence of performance. Requirements can arise from law, regulation, permits, and contracts, but their authority and consequences differ. Applicability must be established before controls are selected. Changes in operations or external requirements can create new obligations or make old controls insufficient. Maintain traceability from each material requirement to its implementation and testing so management can distinguish an identified obligation from an operationally effective response rather than relying on a generic checklist.
Worked example: A distributor opens a warehouse in a new jurisdiction. It maps relevant product-storage, employment, permit, and customer-contract requirements to site activities and owners. The resulting gaps determine which controls must be ready before the new operation begins.
Common mistake: Reusing a mature checklist from another operation can create false assurance when products, jurisdictions, contractual commitments, or regulated activities differ.
Official syllabus reference: [3]
57. Indemnities, liability caps, and insurance alignment
An indemnity allocates specified losses or claims between contracting parties, while a liability cap limits defined contractual exposure subject to its wording and applicable law. The clauses' interaction must be read explicitly, including exclusions from the cap, defense obligations, covered claim types, and procedural conditions. Insurance may finance some liabilities but has its own limits, exclusions, and conditions. Compare the intended allocation with available coverage and financial capacity. Contractual transfer can fail economically if the counterparty cannot perform, even when the drafting effectively assigns responsibility.
Worked example: A vendor accepts an indemnity for certain third-party claims, but its insurance excludes one important claim category. The buyer clarifies cap treatment, defense responsibilities, and evidence of financial backing instead of assuming the insurance certificate matches every contractual promise.
Common mistake: An insurance limit does not automatically become a contractual liability cap, and a broad indemnity does not guarantee corresponding coverage.
Official syllabus reference: [3]
58. Negligence analysis and causal evidence
In many legal systems, negligence analysis considers a relevant duty, failure to meet the applicable standard of care, causation, and legally recognized damage. The precise tests, defenses, and allocation rules depend on jurisdiction and facts. An unfavorable outcome alone does not establish breach, and a breached procedure alone does not prove that it caused the claimed harm. Preserve factual evidence about conditions, decisions, timing, and alternative explanations. Use legal analysis to distinguish potential liability from operational fault, insurance coverage, and reputation consequences, which answer different questions.
Worked example: A visitor falls near a recently cleaned entrance. Investigators preserve inspection records, photographs, timing, footwear information, and witness accounts. These facts help assess the relevant condition and causal pathway rather than assuming either that every fall proves negligence or that a checklist defeats it.
Common mistake: A completed inspection form does not conclusively resolve liability when the actual condition, timing, causal evidence, and applicable legal standard remain disputed.
Official syllabus reference: [3]
59. Compliance control design and operating effectiveness
Control design asks whether a measure, if performed as intended, can address the relevant compliance obligation. Operating effectiveness asks whether it actually worked over the period examined. A policy can be well written yet unused, while a consistently performed check can be poorly designed for the requirement. Test both using appropriate samples, source evidence, exception handling, and accountable remediation. Prioritize by obligation significance and exposure without treating low priority as exemption. Training completion and management certification provide evidence of activities, but they do not independently establish compliance outcomes.
Worked example: A required approval must occur before product release. Testing finds signed forms, but timestamps show many were completed afterward. The control's intended design may be suitable, yet its operation fails to prevent unapproved release at the relevant decision point.
Common mistake: Counting completed forms without checking timing, authority, and supporting evidence can mistake administrative activity for an effective compliance control.
Official syllabus reference: [3]
60. Evidence preservation and legal privilege boundaries
When a dispute or investigation creates a preservation obligation under applicable rules, relevant records may need protection from routine deletion or alteration. Scope should reflect the matter, data sources, custodians, and legal advice rather than an unsupported universal retention period. Preserve authenticity and record handling so evidence remains interpretable. Legal privilege depends on jurisdiction and communication purpose; copying a lawyer or adding a label does not automatically establish it. Coordinate factual investigation and legal work carefully while maintaining accurate business records and complying with applicable disclosure requirements.
Worked example: After receiving a credible claim notice, a company identifies relevant email, messaging, maintenance logs, and video. With legal guidance, it suspends relevant routine deletion, records preservation actions, and keeps factual records distinct from communications seeking legal advice.
Common mistake: Marking every incident document privileged does not automatically protect it, and continuing routine deletion can destroy relevant evidence despite ordinary retention rules.
Official syllabus reference: [3]
Official syllabus sources
- Associate in Risk Management (ARM™) | The Institutes
- Exam Question Formats | The Institutes
- ARM 402: Implementing Risk Management Strategies