Explanation : Risk identification and measurement is the quantitative part of the process.
It involves identifying the risks and summarizing their potential
quantitative impact. Communication and risk governance are largely
qualitative.
Explanation : Risk monitoring, mitigation, and management require recognizing and
taking action when these (risk exposure and risk tolerance) are not in line.
Risk governance involves setting the risk tolerance. Risk identification and
measurement involves identifying and measuring the risk exposures.
Explanation : While risk infrastructure, which a risk management framework must
address, refers to the people and systems required to track risk exposures,
there is no requirement to actually name the responsible individuals.
Explanation : In establishing a risk management system, determining risk tolerance must
happen before specific risks can be accepted or reduced. Risk tolerance
defines the appetite for risk. Risk budgeting determine how or where the
risk is taken and quantifies the tolerable risk by specific metrics. Risk
exposures can then be measured and compared against the acceptable
risk.
Explanation : A chief risk officer or a risk management committee is an individual or
group that focuses primarily on risk management. A chief financial officer,
may supervise a CRO, and would likely have some involvement in a risk
management committee, but a CFO has broader responsibilities, cannot
provide the specialization and exclusive attention to risk management that
is necessary in a large organization.