Which element should the organization analyze when examining its external context?

• A. Internal policies and procedures
• B. Standards, guidelines, and models adopted by the organization
• C. Key drivers and trends affecting the objectives of the organization
• D. Contractual relationships and commitments

How should risk be managed in the Intolerable region?

• A. Risk can be accepted if monitored closely.
• B. Risk is tolerable only if risk reduction is impracticable or its cost is grossly disproportionate to the improvement gained.
• C. Risk is tolerable if the cost of reducing it would exceed the benefit.
• D. Risk cannot be justified except in extraordinary circumstances.

What is an appropriate approach when communicating risks to the media?

• A. Sharing internal monitoring dashboards publicly
• B. Allowing multiple departments to issue independent statements
• C. Issuing press releases and interviews tailored to health, safety, and CSR-related challenges
• D. Providing full technical risk registers with detailed data tables

Scenario 6:
Trunroll is a fast-food chain headquartered in Chicago, Illinois, specializing in wraps, burritos, and quick-serve snacks through both company-owned and franchised outlets across several states. Recently, the company identified two major risks: increased dependence on third-party delivery platforms that could disrupt customer service if contracts were to fail or fees rose sharply, and stricter health and safety inspections that might expose vulnerabilities in hygiene practices across certain franchise locations. Therefore, the top management of Trunroll adopted a structured risk management process based on ISO 31000 guidelines to systematically identify, assess, and mitigate risks, embedding risk awareness into daily operations and strengthening resilience against future disruptions.
To address these risks, Trunroll outlined and documented clear actions with defined responsibilities and timelines. Regarding the dependence on third-party delivery platforms, the company decided not to move forward with planned partnerships with third-party delivery apps, as the risk of losing control over the customer experience and rising costs outweighed the potential benefits.
To address stricter health inspections across franchises, Trunroll invested in stronger hygiene protocols, mandatory staff training, and upgraded monitoring systems to reduce the likelihood of violations. Yet, management understood that some exposure would remain even after these measures. To address this risk, they decided to use one of the insurance methods, reserving internal financial resources to cover unexpected losses or penalties, ensuring the remaining risk was managed within acceptable boundaries.
Additionally, Trunroll set up a cloud-based platform to document and maintain risk records. This allowed managers to log supplier inspection results, training outcomes, and incident reports into one secure system, while also providing flexibility to update and scale applications as needed without managing the underlying infrastructure. In doing so, Trunroll ensured that all risk-related information is documented in progress reports and incorporated into mid-term and final evaluations, with risk management being updated regularly to monitor changes and treatments.
Based on the scenario above, answer the following question:
Trunroll documented all risk-related information in progress reports and incorporated it into mid-term and final evaluations. Which organizational level for risk reporting did they consider in this case?

• A. Corporate level
• B. Program/unit level
• C. Individual level
• D. Project level