Risk Management Framework
4
Steps
Identify, Assess, Mitigate, Monitor
4
Strategies
Avoid, Reduce, Transfer, Accept
COSO
The Standard
Internal control framework
plot every risk on the grid
The 5×5 Heat Map
Probability up the side, impact across the bottom. Where the cell turns red, you stop reading and start acting.
Probability →
Bad-press tweet
Key talent loss
Compliance fine
Vendor outage
Data breach
Harassment lawsuit
WARN trigger
1
2
3
4
5
Impact →
avoid
eliminate the activity
reduce
controls + training
transfer
insurance, vendor
accept
budget for the loss
COSO Internal Control Framework
The reference standard the PHR cites for enterprise risk. Five components.
- 1.Control Environment
- 2.Risk Assessment
- 3.Control Activities
- 4.Information and Communication
- 5.Monitoring
Exam Traps
Avoidance is not always feasible
You cannot avoid hiring or scheduling. Transfer through insurance handles low-probability high-impact risks the business cannot exit.
Acceptance is a legitimate strategy
When mitigation costs more than the expected loss, accept and budget for it. The exam treats Acceptance as wrong only when it is being used to dodge real risk.
Risk identification is ongoing, never one-time
Risk registers must be reviewed continuously as the business changes. The exam tests whether candidates understand this is not a checkbox.
Transfer does not eliminate harm
Insurance shifts who pays, not whether the loss happens. Buying EPLI does not stop the lawsuit. It pays the bill when one comes.
Transfer pays, does not prevent
Insurance moves the cost off your books. The harm still happens. Do not pick Transfer when prevention was possible.
Match the strategy to the cell
High prob + high impact = Avoid or Reduce hard. Low prob + high impact = Transfer. Low + low = Accept and move on.
Bears, falling, dehydration, getting lost, weather. Write down everything that could go wrong on the hike.
Bears unlikely, but high-impact. Dehydration likely, but low-impact. Plot probability against severity.
Avoid the bear-heavy trail. Reduce dehydration by carrying extra water. Transfer the medical risk by buying travel insurance. Accept the small chance of a sprained ankle.
Weather changes. New risks appear. Old risks fade. Keep checking the register, not just the map.
Ready to test your PHR knowledge?
1,700+ practice questions written by certified professionals.
Start Practicing PHR