I85PREP
⌘ K
Enterprise Risk Management (ERM) study materials
Enterprise Risk Management (ERM) study resources

Enterprise Risk Management (ERM) practice questions

One question at a time. Build your Enterprise Risk Management (ERM) understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Enterprise Risk Management

In enterprise risk management, which statement best defines inherent risk?

  1. The risk that arises only from external fraud events
  2. The exposure that exists before any controls or mitigation are applied Correct answer.
  3. The risk that is transferred to a third party through insurance
  4. The risk that remains after management has implemented controls and responses

Explanation

Inherent risk is the gross exposure an entity faces in the absence of any controls, mitigation, or response actions. Risk practitioners compare inherent risk with residual risk to judge how much protection controls actually provide. It is assessed before considering the effect of mitigation.

Question 2Enterprise Risk Management

A company's risk appetite statement is best described as which of the following?

  1. The amount and type of risk the organization is willing to pursue to meet its objectives Correct answer.
  2. The set of internal controls designed to prevent fraud
  3. The list of risks identified during the annual risk assessment
  4. The maximum loss the firm can absorb before insolvency

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives. It is set by the board or senior leadership and guides decisions about which risks to take and how much. It differs from risk capacity, which is the maximum risk the firm can bear.

Question 3Enterprise Risk Management

Which of the following best characterizes the risk tolerance of an organization?

  1. The total number of risks recorded in the enterprise risk register
  2. The maximum level of variation in outcomes the organization is willing to accept for a specific risk Correct answer.
  3. The probability that a control will fail during a given period
  4. The process of transferring risk to an insurer

Explanation

Risk tolerance defines the acceptable level of variation or deviation from risk appetite for a specific objective or risk category. It provides practical thresholds against which actual exposures are monitored. It is more granular than the overall risk appetite.

Question 4Enterprise Risk Management

In the COSO enterprise risk management framework, risk is defined primarily in relation to which concept?

  1. The possibility that events will occur and affect the achievement of strategy and objectives Correct answer.
  2. The number of regulatory penalties incurred in a year
  3. The market value of the firm's equity
  4. The volume of transactions processed by the accounting system

Explanation

Enterprise risk management frames risk as the possibility that events occur and adversely affect the achievement of strategy and objectives. This links risk directly to objective setting rather than to a single financial metric. It is why ERM is described as strategy-focused.

Question 5Enterprise Risk Management

Which risk response involves accepting the risk and taking no action to reduce it?

  1. Acceptance Correct answer.
  2. Sharing
  3. Avoidance
  4. Reduction

Explanation

Acceptance means the organization retains the risk without additional mitigation because the exposure is within tolerance or the cost of action outweighs the benefit. It is a deliberate decision, not an oversight. It should be documented and monitored.

Question 6Enterprise Risk Management

A key risk indicator (KRI) is most useful to an ERM program because it does which of the following?

  1. Provides early warning signals about changes in risk exposure Correct answer.
  2. Replaces the need for periodic risk assessments
  3. Guarantees that risk events will not occur
  4. Calculates the firm's tax liability

Explanation

Key risk indicators are metrics that provide early warning of increasing or decreasing risk exposure, allowing management to act before losses occur. They are monitored against thresholds tied to risk tolerance. They complement, rather than replace, risk assessments.

Question 7Enterprise Risk Management

Which of the following is an example of a risk that is typically treated as a strategic risk rather than an operational risk?

  1. A server fails because of a failed hard drive
  2. A data entry clerk transposes two account numbers
  3. A warehouse worker drops a pallet of inventory
  4. A competitor launches a disruptive product that erodes market share Correct answer.

Explanation

Strategic risks arise from changes in the competitive, economic, or regulatory environment that affect the firm's ability to execute its strategy. A disruptive competitor directly threatens market position and long-term objectives. The other options are day-to-day operational failures.

Question 8Enterprise Risk Management

What is the primary purpose of a risk register in an enterprise risk management program?

  1. To document employee performance reviews
  2. To serve as a central log of identified risks, their owners, ratings, and responses Correct answer.
  3. To replace the internal audit function
  4. To record the firm's audited financial statements

Explanation

A risk register is a central inventory that captures each identified risk along with attributes such as owner, likelihood, impact, rating, and planned response. It supports monitoring, reporting, and prioritization across the enterprise. It does not replace other governance functions.

Question 9Enterprise Risk Management

A manufacturer faces a risk that a key supplier may fail to deliver components. Management decides to qualify a second supplier in another region. Which risk response does this represent?

  1. Exploitation
  2. Avoidance
  3. Reduction Correct answer.
  4. Acceptance

Explanation

Qualifying an alternate supplier reduces the likelihood or impact of a supply disruption, so it is a reduction response. The underlying activity is still performed, unlike avoidance. It also spreads dependency rather than transferring risk to a third party.

Question 10Enterprise Risk Management

A bank's risk committee sets a threshold: losses from a particular process should not exceed $2 million in any quarter. This threshold is best described as which of the following?

  1. A risk appetite statement for the whole firm
  2. A risk tolerance level for that process Correct answer.
  3. A key performance indicator
  4. A risk capacity limit

Explanation

A specific quantitative threshold for an individual process is a risk tolerance level, translating broader appetite into an actionable limit. It defines acceptable variation for that risk. Risk capacity would refer to the maximum the whole firm could absorb.

Question 11Enterprise Risk Management

An analyst rates a risk as high likelihood and low impact. Which action is most consistent with a well-designed ERM framework?

  1. Escalate it automatically to the board regardless of context
  2. Transfer the risk entirely to a third party without further analysis
  3. Compare the rating against tolerance and select a response proportionate to the combined exposure Correct answer.
  4. Ignore the risk because the impact is low

Explanation

ERM evaluates likelihood and impact together against tolerance to determine a proportionate response. A high-likelihood, low-impact risk may warrant monitoring or reduction rather than escalation or transfer. Decisions should reflect combined exposure and cost-benefit.

Question 12Enterprise Risk Management

Which of the following best describes the concept of risk aggregation in enterprise risk management?

  1. Assigning each risk to a separate owner
  2. Combining individual risk exposures to understand the total effect on the organization Correct answer.
  3. Reporting only the largest single risk to the board
  4. Eliminating all risks that exceed a single threshold

Explanation

Risk aggregation combines exposures across units, categories, or scenarios to reveal the total or correlated effect on the enterprise. It helps identify concentrations and interactions that individual risk views miss. It does not mean eliminating risks or reporting only the largest one.

Question 13Enterprise Risk Management

A risk manager calculates that a control reduces a risk's annualized loss expectancy from $500,000 to $100,000, and the control costs $150,000 per year. What is the net benefit of implementing the control?

  1. $100,000
  2. $150,000
  3. $250,000 Correct answer.
  4. $400,000

Explanation

The control reduces expected loss by $400,000 ($500,000 minus $100,000). Subtracting the annual control cost of $150,000 leaves a net benefit of $250,000. This cost-benefit comparison supports the response decision.

Question 14Enterprise Risk Management

Which of the following is the strongest indicator that an ERM program has been integrated into strategy setting?

  1. The risk register is updated once per year by the audit team
  2. Risk information is used when evaluating strategic alternatives and major initiatives Correct answer.
  3. Risk is assessed only after annual budgets are finalized
  4. Risk reports are distributed only to the compliance department

Explanation

Integration with strategy means risk information informs the evaluation and selection of strategic alternatives, not just post-hoc reporting. This is a core principle of modern ERM frameworks. Periodic-only updates and narrow distribution suggest siloed, compliance-driven risk work.

Question 15Enterprise Risk Management

An organization identifies a risk that is outside its risk appetite but cannot be avoided because the activity is core to its mission. What is the most appropriate next step?

  1. Remove the risk from the register
  2. Reclassify the risk as acceptable without further action
  3. Terminate the core activity immediately
  4. Document the exception and implement enhanced monitoring and mitigation Correct answer.

Explanation

When a core activity creates exposure beyond appetite, management should document the exception, escalate it appropriately, and strengthen mitigation and monitoring. Simply reclassifying or deleting the risk conceals it. Immediate termination may be infeasible for mission-critical activities.

Question 16Enterprise Risk Management

Which of the following best describes a bow-tie analysis in risk management?

  1. A schedule for rotating internal auditors
  2. A statistical model that forecasts stock returns
  3. A method for calculating depreciation of fixed assets
  4. A diagram linking multiple causes through a top event to multiple consequences, with barriers on each side Correct answer.

Explanation

Bow-tie analysis maps threats and causes on one side, the top event in the center, and consequences on the other, with preventive barriers before and mitigative barriers after the event. It clarifies where controls act. It is not a financial forecasting or scheduling technique.

Question 17Enterprise Risk Management

A company uses a heat map plotting risks by likelihood and impact. Which limitation should management keep in mind when relying on it?

  1. Heat maps eliminate the need for risk owners
  2. Heat maps automatically calculate expected monetary loss
  3. Heat maps cannot display more than three risks at a time
  4. Qualitative scales may hide differences in underlying data and can be subjective Correct answer.

Explanation

Heat maps typically rely on qualitative or ordinal scales, so risks placed in the same cell may differ greatly in actual exposure. Ratings can be subjective and inconsistent across assessors. Quantitative analysis and clear definitions help mitigate this limitation.

Question 18Enterprise Risk Management

Which of the following best describes the role of the board of directors in enterprise risk management?

  1. Designing the firm's internal control procedures
  2. Independently auditing the firm's financial statements
  3. Performing daily operational risk assessments
  4. Setting risk appetite and providing oversight of the ERM program Correct answer.

Explanation

The board sets or approves risk appetite and oversees whether management's ERM program is functioning effectively. It does not perform day-to-day assessments or design controls. Independent audit and control design are management or audit functions.

Question 19Enterprise Risk Management

A firm identifies a risk that a new regulation will increase compliance costs. Which risk category does this primarily represent?

  1. Liquidity risk
  2. Reputational risk
  3. Credit risk
  4. Regulatory or compliance risk Correct answer.

Explanation

Regulatory risk arises from changes in laws, rules, or enforcement that affect the organization's obligations and costs. Credit risk concerns counterparty default, and liquidity risk concerns the ability to meet obligations as they fall due. Reputational risk concerns damage to public perception.

Question 20Enterprise Risk Management

Which of the following statements about the three lines model in risk governance is most accurate?

  1. The third line owns and manages operational risk
  2. The second line sets risk frameworks and monitors, while the first line owns and manages risk Correct answer.
  3. The first line provides independent assurance over risk management
  4. All three lines perform identical functions

Explanation

In the three lines model, the first line owns and manages risk in the business, the second line provides oversight, frameworks, and monitoring, and the third line provides independent assurance. The roles are complementary but distinct. This separation supports effective governance.

Question 21Enterprise Risk Management

A firm's risk register lists a risk with a likelihood of 4 on a 1-5 scale and an impact of 5 on a 1-5 scale. Using a simple multiplicative scoring method, what is the risk score and how should it typically be prioritized?

  1. 20, high priority Correct answer.
  2. 45, moderate priority
  3. 1, negligible priority
  4. 9, low priority

Explanation

Multiplying likelihood (4) by impact (5) gives a score of 20, which on a 1-25 scale is high and warrants prioritized attention. Simple multiplicative scoring helps rank risks consistently within a common scale. Higher scores indicate greater combined exposure.

Question 22Enterprise Risk Management

Which scenario best illustrates correlation risk in an enterprise risk context?

  1. Multiple subsidiaries rely on the same cloud provider, so one outage affects all of them simultaneously Correct answer.
  2. Two unrelated business units experience losses in different years
  3. A risk owner updates a register entry after a review
  4. A firm purchases insurance for a single isolated risk

Explanation

Correlation risk arises when exposures that appear independent are actually linked, so a single event triggers losses across multiple areas at once. Shared dependencies such as a common vendor create this concentration. Independent events in different periods do not illustrate correlation.

Question 23Enterprise Risk Management

A risk committee debates whether to fund a control that costs $2 million and reduces expected annual loss from $3 million to $1.2 million. Which conclusion is most defensible?

  1. The control should be rejected because it does not eliminate all loss
  2. The control is worthless because residual loss remains
  3. The control should be adopted only if it costs less than the residual loss
  4. The control yields a net annual benefit of about $1.8 million before considering other factors Correct answer.

Explanation

Expected loss falls by $1.8 million ($3 million minus $1.2 million), which exceeds the $2 million cost only when compared over multiple years; on a single-year basis the benefit is $1.8 million against a $2 million cost, so the decision requires a multi-year horizon and qualitative factors. The defensible framing is to compare quantified benefit against cost rather than demand zero residual loss.

Question 24Enterprise Risk Management

An ERM team models a scenario in which a cyber incident and a simultaneous regulatory investigation both occur. Which technique is being applied?

  1. Variance analysis of budget versus actual
  2. Scenario analysis of combined or correlated events Correct answer.
  3. Depreciation scheduling
  4. Control self-assessment

Explanation

Scenario analysis explores plausible combinations of events, including correlated or compounding scenarios, to estimate combined impact and test response plans. It goes beyond single-risk assessment. Control self-assessment, variance analysis, and depreciation scheduling address different purposes.

Question 25Enterprise Risk Management

Which of the following best explains why an ERM program should distinguish between risk appetite and risk capacity?

  1. They are identical concepts used interchangeably in practice
  2. Appetite reflects willingness to take risk, while capacity reflects the maximum risk the firm can bear without breaching obligations Correct answer.
  3. Capacity is set by regulators while appetite is set by customers
  4. Capacity applies only to credit risk while appetite applies only to market risk

Explanation

Risk appetite is the amount and type of risk the organization is willing to pursue, while risk capacity is the maximum risk it can actually absorb given capital and obligations. A firm may be willing to take more risk than it can bear, so setting appetite within capacity is essential. Conflating them can lead to excessive exposure.

Question 26Enterprise Risk Management

Which statement best defines inherent risk in an ERM framework?

  1. The risk exposure that remains after controls and mitigations are applied
  2. The portion of risk that is transferred to a third party through insurance
  3. The maximum loss an organization could suffer in a worst-case scenario
  4. The level of risk before any controls or mitigations are applied Correct answer.

Explanation

Inherent risk is the exposure that exists in an activity before management applies any controls, while residual risk is what remains afterward. Distinguishing the two lets an ERM program show the value added by controls and prioritize where mitigation is needed.

Question 27Enterprise Risk Management

An organization defines the amount and type of risk it is willing to pursue to achieve its objectives. Which ERM term describes this statement?

  1. Risk capacity
  2. Risk tolerance
  3. Risk profile
  4. Risk appetite Correct answer.

Explanation

Risk appetite is the broad amount and type of risk an entity is willing to accept in pursuit of its objectives. Tolerance then translates that appetite into acceptable variation around specific measures.

Question 28Enterprise Risk Management

In the three lines model, which group typically provides independent assurance and challenge over risk management?

  1. Operational management owning the risk
  2. Internal audit reporting to the board or audit committee Correct answer.
  3. A risk and compliance function embedded in the first line
  4. An external consultant hired to design the risk register

Explanation

Internal audit forms the third line and provides independent, objective assurance to the governing body. Its independence from management is what allows it to challenge the first and second lines credibly.

Question 29Enterprise Risk Management

Which of the following is the best example of a key risk indicator?

  1. The percentage of the budget allocated to the internal audit function
  2. The number of employees who completed annual ethics training
  3. A rising count of unresolved high-severity security vulnerabilities past their remediation deadline Correct answer.
  4. The organization's total revenue growth compared with the prior year

Explanation

A key risk indicator is a forward-looking metric tied to a specific risk that signals changes in exposure. Overdue high-severity vulnerabilities directly track rising operational and cyber risk exposure.

Question 30Enterprise Risk Management

A risk is recorded with a likelihood rating of 5 and an impact rating of 1 on a 1-5 scale. What does a simple heat map most likely show for this risk?

  1. No rating because the scales are incompatible
  2. A low overall rating because impact is minimal Correct answer.
  3. A rating equal to the average of the two scores
  4. A high overall rating because likelihood is maximal

Explanation

Most heat maps multiply or otherwise combine likelihood and impact, so a 5 x 1 product yields a low combined score. High likelihood with negligible impact generally maps to a low-priority zone.

Question 31Enterprise Risk Management

Which risk category typically includes risks arising from changes in interest rates, foreign exchange rates, and commodity prices?

  1. Reputational risk
  2. Operational risk
  3. Market risk Correct answer.
  4. Compliance risk

Explanation

Market risk covers movements in financial prices such as interest rates, currencies, and commodities that affect the value of positions. Operational risk instead concerns failed processes, people, and systems.

Question 32Enterprise Risk Management

What is the main purpose of a risk owner in an ERM program?

  1. To approve the enterprise risk appetite statement
  2. To calculate the organization's overall risk capacity
  3. To independently audit the effectiveness of controls
  4. To hold accountability for managing a specific risk and its response Correct answer.

Explanation

A risk owner is an accountable individual responsible for monitoring a risk and ensuring an appropriate response is executed. This assigns clear ownership rather than diffuse responsibility.

Question 33Enterprise Risk Management

Which of the following best describes a control self-assessment?

  1. A regulatory examination of the organization's capital adequacy
  2. An independent audit opinion on financial statements
  3. A process where business units evaluate the effectiveness of their own controls Correct answer.
  4. A method for pricing insurance against a specific risk

Explanation

A control self-assessment has process owners evaluate and attest to the design and operating effectiveness of their controls. It builds first-line ownership of risk while feeding information to the second line.

Question 34Enterprise Risk Management

A firm decides to stop offering a product line because the associated liability exceeds its risk appetite. Which risk response is this?

  1. Avoidance Correct answer.
  2. Acceptance
  3. Mitigation
  4. Transfer

Explanation

Avoidance eliminates the risk by exiting the activity that generates it. Here the product line itself is discontinued, so the exposure no longer exists.

Question 35Enterprise Risk Management

An ERM team wants to compare the aggregate risk of several business units on a consistent basis. Which approach best supports this comparison?

  1. Converting each unit's exposures to a common quantitative metric such as expected loss Correct answer.
  2. Ranking each unit's risks by the subjective opinion of its manager
  3. Assigning each unit an equal share of the enterprise risk budget
  4. Listing each unit's risks alphabetically in a shared register

Explanation

Aggregation requires a common unit of measure so that exposures from different units can be summed and compared. Expected loss in monetary terms provides that common basis.

Question 36Enterprise Risk Management

A company buys a cyber insurance policy that covers losses above a $5 million retention. How should this arrangement be described in ERM terms?

  1. The company has eliminated all cyber risk from its profile
  2. The company has accepted the full risk without any financing arrangement
  3. The company has transferred the tail risk while retaining losses below the retention Correct answer.
  4. The company has avoided the activity that creates cyber risk

Explanation

Insurance transfers losses above a deductible or retention to the insurer while the insured retains the lower layer. This is risk transfer combined with retention of the first-loss portion.

Question 37Enterprise Risk Management

Which scenario best illustrates a risk that should be escalated to the board rather than handled locally?

  1. A customer complaint that the service desk resolves under standard procedure
  2. A minor equipment fault that maintenance can repair within a day
  3. A trading position whose potential loss could threaten the firm's capital adequacy Correct answer.
  4. A scheduling conflict between two internal training sessions

Explanation

Risks that could materially affect solvency or capital are enterprise-level concerns requiring board oversight. Local operational issues are handled within delegated authority limits.

Question 38Enterprise Risk Management

A risk manager estimates a risk has a 10% annual probability of occurring and would cause a $2,000,000 loss. What is the annualized loss expectancy?

  1. $200,000 Correct answer.
  2. $20,000
  3. $2,000,000
  4. $20,000,000

Explanation

Annualized loss expectancy equals the probability of the event times the expected loss amount. Here 0.10 x $2,000,000 gives $200,000.

Question 39Enterprise Risk Management

Which of the following best characterizes a stress test in enterprise risk management?

  1. A survey of employee satisfaction with risk training
  2. A forecast of expected results under the most likely scenario
  3. An evaluation of portfolio or business performance under severe but plausible adverse conditions Correct answer.
  4. A routine reconciliation of accounting records

Explanation

Stress testing examines how exposures behave under severe but plausible adverse scenarios that go beyond normal assumptions. It helps reveal vulnerabilities that base-case forecasts would miss.

Question 40Enterprise Risk Management

An organization's risk register contains 400 entries, and managers complain they cannot tell which matter most. Which improvement is most appropriate?

  1. Require every entry to be reviewed weekly regardless of severity
  2. Prioritize entries by exposure against appetite and assign owners and review dates to the top risks Correct answer.
  3. Add more fields to each entry to capture additional detail
  4. Archive the register and rely on annual audit findings instead

Explanation

A register becomes useful when risks are ranked by significance relative to appetite and the most material ones receive active ownership and monitoring. Adding detail or blanket review frequency increases effort without improving focus.

Question 41Enterprise Risk Management

A firm discovers that its top three risks are all triggered by the same economic downturn. What does this indicate about its risk profile?

  1. The risks should be removed from the register because they overlap
  2. The risks are concentrated and may materialize simultaneously Correct answer.
  3. The risks are well diversified because they are recorded separately
  4. The risks have no bearing on the firm's aggregate exposure

Explanation

When multiple risks share a common driver, they are correlated and can occur together, producing a concentration far larger than the sum of independent exposures. Aggregation should account for this common driver.

Question 42Enterprise Risk Management

Which practice best demonstrates a risk-aware culture within an organization?

  1. Performance bonuses reward volume growth with no consideration of risk
  2. Frontline staff report concerns and see them addressed without retaliation Correct answer.
  3. Risk training is delivered only to the audit department
  4. Employees are discouraged from reporting near misses to avoid paperwork

Explanation

A healthy risk culture encourages open reporting and responds constructively, so issues surface early. Incentives and training should reinforce rather than undermine that behavior.

Question 43Enterprise Risk Management

An ERM framework requires that risk information flow from business units to senior management and back. Which characteristic is this describing?

  1. Risk financing
  2. Risk avoidance
  3. Risk reporting and communication Correct answer.
  4. Risk aggregation

Explanation

Risk reporting and communication covers the upward flow of risk information and the downward flow of direction and decisions. It ensures decision-makers have timely, relevant data.

Question 44Enterprise Risk Management

A risk appears on the register with high impact but very low likelihood, and management takes no action because the probability is remote. Which critique of this decision is most valid?

  1. Low-likelihood risks never warrant attention in an ERM program
  2. Likelihood ratings are always more reliable than impact ratings
  3. The risk should be deleted from the register to reduce clutter
  4. Impact severity and velocity may justify contingency planning even when likelihood is low Correct answer.

Explanation

Rare but severe events can threaten viability, so ERM considers impact, velocity, and preparedness alongside likelihood. Contingency planning and monitoring may be warranted even for remote risks.

Question 45Enterprise Risk Management

Which of the following best explains why scenario analysis complements historical loss data in ERM?

  1. Historical data are only relevant to compliance risk
  2. Historical data may not capture events that have never occurred or are extremely rare Correct answer.
  3. Scenario analysis eliminates the need for any quantitative modeling
  4. Historical data are always sufficient for every risk type

Explanation

Historical losses cannot inform risks that have not yet materialized or are too rare to appear in the data. Scenario analysis fills that gap by exploring plausible but unobserved events.

Question 46Enterprise Risk Management

A firm's risk appetite statement says it has a low tolerance for regulatory breaches, yet a business unit proposes a product that operates in a legal gray area with high expected profit. What is the most appropriate ERM response?

  1. Ignore the appetite statement because it is only advisory
  2. Approve the product because expected profit is high
  3. Ask the business unit to reword the proposal to avoid the word regulatory
  4. Escalate the conflict between the proposal and the stated appetite for a governance decision Correct answer.

Explanation

When a proposal conflicts with approved appetite, the conflict should be escalated to the body that owns the appetite for a documented decision. Profit potential does not override an approved risk boundary.

Question 47Enterprise Risk Management

An organization's ERM process identifies risks annually, but major losses occur between cycles because conditions change. Which design weakness is most likely responsible?

  1. The organization uses too many risk categories
  2. The risk register contains too few entries
  3. Risk identification is static rather than continuous and triggered by change Correct answer.
  4. The board reviews risk too frequently

Explanation

Risk identification must be ongoing and responsive to changes such as new projects, market shifts, and incidents. A purely annual cycle leaves the organization blind to emerging exposures.

Question 48Enterprise Risk Management

A risk committee is deciding between two controls. Control A reduces expected annual loss by $1,500,000 at an annual cost of $500,000. Control B reduces expected annual loss by $900,000 at an annual cost of $200,000. Which conclusion is best supported?

  1. Control A has the higher net benefit, while Control B has the higher benefit-cost ratio Correct answer.
  2. Both controls have identical net benefits
  3. Control B has the higher net benefit and the higher benefit-cost ratio
  4. Control A has the higher net benefit and the higher benefit-cost ratio

Explanation

Control A nets $1,000,000 ($1,500,000 minus $500,000) with a ratio of 3.0, while Control B nets $700,000 with a ratio of 4.5. A therefore delivers more absolute value, but B is more efficient per dollar spent.

Question 49Enterprise Risk Management

An ERM team models a scenario combining a systems outage with a simultaneous loss of a key supplier. Why is this combined scenario more informative than assessing each risk separately?

  1. Separate risk assessments are never valid
  2. Combined scenarios always produce lower loss estimates
  3. Combined scenarios remove the need for probability estimates
  4. Interacting events can create compounded impacts and reveal dependencies hidden in siloed analysis Correct answer.

Explanation

Interacting events can amplify impact and expose shared dependencies that single-risk analysis misses. Combined scenarios test whether the organization can respond when several stresses arrive at once.

Question 50Enterprise Risk Management

A global firm sets a single enterprise-wide risk appetite but operates in markets with very different regulatory regimes. What is the most defensible way to apply the appetite?

  1. Translate the enterprise appetite into locally calibrated limits that still respect the overall boundary Correct answer.
  2. Let each local unit set its own appetite with no reference to the enterprise statement
  3. Apply identical limits everywhere regardless of local regulation
  4. Suspend the appetite in markets with the strictest regulation

Explanation

An enterprise appetite sets the overall boundary, while local limits operationalize it within each market's conditions. Local calibration preserves consistency while accommodating differing regulatory environments.