I85PREP
⌘ K
Risk and Compliance study materials
Risk and Compliance study resources

Risk and Compliance practice questions

One question at a time. Build your Risk and Compliance understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk and Compliance

Which statement best describes the primary purpose of corporate governance?

  1. To ensure the company pays the lowest possible amount of tax
  2. To provide direction and control through structures that align management with stakeholder interests Correct answer.
  3. To maximize the marketing budget of the organization
  4. To guarantee that the company never suffers a financial loss

Explanation

Corporate governance is the system of rules, practices, and processes by which a company is directed and controlled. Its central aim is to balance the interests of management, shareholders, and other stakeholders through accountability and oversight structures. It does not promise profit or tax outcomes.

Question 2Governance, Risk and Compliance

In a three lines model, which group forms the first line?

  1. The board audit committee
  2. External regulators
  3. Internal audit
  4. Operational management that owns and manages risk Correct answer.

Explanation

The first line consists of operational management, which owns and manages risk directly in the course of running the business. The second line provides oversight and compliance functions, and the third line is internal audit providing independent assurance.

Question 3Governance, Risk and Compliance

A compliance officer reports that a new regulation takes effect in 90 days and the firm has no process to implement it. Which action best reflects a proactive compliance approach?

  1. Perform a gap assessment and build an implementation plan with owners and deadlines Correct answer.
  2. Wait until the effective date to assess impact
  3. Delegate the matter entirely to the external auditor
  4. Record the regulation in a register without further action

Explanation

Proactive compliance means identifying the gap between current practice and the new requirement, then assigning ownership, timelines, and monitoring. A structured implementation plan allows the firm to meet the deadline and evidence its efforts. Simply logging the rule does not close the gap.

Question 4Governance, Risk and Compliance

What is the main function of a risk appetite statement?

  1. To list every risk the firm has ever encountered
  2. To replace the internal audit plan
  3. To set the salary bands for risk staff
  4. To define the amount and type of risk the organization is willing to accept in pursuit of objectives Correct answer.

Explanation

A risk appetite statement articulates the level and categories of risk the organization is prepared to take on to achieve its strategic goals. It guides decision-making and sets boundaries for risk-taking across the business. It is not an exhaustive risk list.

Question 5Governance, Risk and Compliance

Which of the following is an example of a key risk indicator (KRI)?

  1. The company's brand logo redesign schedule
  2. The annual shareholder meeting date
  3. The number of employees in the marketing department
  4. The number of customer complaints received per month Correct answer.

Explanation

A key risk indicator is a metric that provides early warning of increasing risk exposure. Complaint volumes can signal rising conduct or operational risk and are commonly tracked as a KRI. The other options are administrative facts rather than risk signals.

Question 6Governance, Risk and Compliance

Which document typically records identified risks, their owners, ratings, and mitigating controls?

  1. The risk register Correct answer.
  2. The balance sheet
  3. The employee handbook
  4. The press release

Explanation

The risk register is the central log where risks are documented along with ownership, likelihood and impact ratings, and the controls that mitigate them. It supports monitoring and reporting to governance bodies.

Question 7Governance, Risk and Compliance

What does the term 'tone at the top' refer to in a compliance program?

  1. The volume of the CEO's public speeches
  2. The tone used in customer service emails
  3. The ethical culture and commitment to compliance demonstrated by senior leadership Correct answer.
  4. The acoustic design of the head office

Explanation

Tone at the top describes how senior leaders visibly commit to ethics and compliance through their words and actions. When leadership models integrity, employees are more likely to follow compliant behavior. It is a cultural signal, not a literal acoustic feature.

Question 8Governance, Risk and Compliance

Which of the following best defines 'compliance risk'?

  1. The risk that a new product fails in the market
  2. The risk of financial loss or sanction arising from failure to comply with laws, regulations, or internal policies Correct answer.
  3. The risk of losing market share to a competitor
  4. The risk of a natural disaster damaging a warehouse

Explanation

Compliance risk is the exposure to penalties, financial loss, or reputational harm from violating applicable laws, regulations, or internal standards. It is distinct from strategic, market, and physical risks.

Question 9Governance, Risk and Compliance

A firm's board delegates day-to-day risk oversight to management while retaining ultimate accountability. Which governance principle does this illustrate?

  1. Absolute abdication of responsibility
  2. Delegation with retained accountability Correct answer.
  3. Separation of ownership from taxation
  4. Unlimited personal liability for directors

Explanation

Boards may delegate operational execution to management but cannot delegate their ultimate accountability for oversight. This principle keeps clear lines of responsibility while enabling efficient decision-making. It is not an abdication of duty.

Question 10Governance, Risk and Compliance

A risk has a likelihood score of 4 and an impact score of 5 on a 1-5 scale. Using a simple multiplication method, what is the inherent risk score?

  1. 1
  2. 9
  3. 45
  4. 20 Correct answer.

Explanation

Multiplying likelihood by impact gives the inherent risk score: 4 times 5 equals 20. This score is then mapped to a risk rating band to prioritize treatment. Addition or other operations would misstate the exposure.

Question 11Governance, Risk and Compliance

Which control type is designed to detect a problem after it has occurred?

  1. Strategic control
  2. Preventive control
  3. Directive control
  4. Detective control Correct answer.

Explanation

Detective controls identify errors or irregularities after they happen, such as reconciliations or exception reports. Preventive controls stop problems before they occur, and directive controls guide behavior. Detective controls are essential for timely correction.

Question 12Governance, Risk and Compliance

An employee is offered a luxury watch by a vendor bidding for a contract. Under most corporate codes of conduct, what is the most appropriate response?

  1. Decline it or disclose it according to the gifts and hospitality policy Correct answer.
  2. Accept it only if the vendor also gifts colleagues
  3. Ask for cash instead of the watch
  4. Accept it quietly without telling anyone

Explanation

Gifts that could influence a business decision create a conflict of interest and are typically restricted or require disclosure under gifts and hospitality policies. The employee should decline or report the gift per policy. Secrecy or soliciting cash would aggravate the breach.

Question 13Governance, Risk and Compliance

What is the primary role of the second line of defense in a risk governance framework?

  1. Setting up and monitoring risk management and compliance frameworks Correct answer.
  2. Conducting independent audits of the first line
  3. Executing business transactions directly with customers
  4. Approving the annual financial statements

Explanation

The second line provides oversight by designing risk and compliance frameworks, monitoring first-line activity, and advising on controls. It does not perform independent audits, which belong to the third line. Its focus is framework and challenge rather than execution.

Question 14Governance, Risk and Compliance

A company discovers that a supplier uses child labor in its supply chain. Which governance response best aligns with responsible supply chain compliance?

  1. Publicly deny any knowledge of the issue
  2. Terminate the relationship immediately without any assessment and take no further steps
  3. Investigate, require remediation, and strengthen supplier due diligence Correct answer.
  4. Ignore the issue because the supplier is a separate legal entity

Explanation

Responsible supply chain governance requires investigation, remediation where feasible, and improved due diligence to prevent recurrence. Simply cutting ties without assessment may harm affected workers and does not address root causes. Denial exposes the firm to reputational and legal risk.

Question 15Governance, Risk and Compliance

Which element is essential for an effective whistleblowing program?

  1. Requiring employees to identify themselves publicly to their managers
  2. Disciplining anyone who raises a concern
  3. Limiting reports to issues affecting senior executives only
  4. Providing confidential reporting channels and protection against retaliation Correct answer.

Explanation

Effective whistleblowing programs offer confidential or anonymous channels and strong anti-retaliation protections so that concerns can be raised safely. Retaliation or narrow scope undermines trust and deters reporting. Confidentiality encourages early detection of misconduct.

Question 16Governance, Risk and Compliance

A firm uses a heat map to display risks by likelihood and impact. What is the main benefit of this tool?

  1. It eliminates all identified risks
  2. It guarantees regulatory approval
  3. It visually prioritizes risks so management can focus on the most significant exposures Correct answer.
  4. It replaces the need for any internal controls

Explanation

A risk heat map plots risks by likelihood and impact, giving a visual snapshot that helps prioritize attention on the highest exposures. It supports communication and decision-making but does not eliminate risks or substitute for controls.

Question 17Governance, Risk and Compliance

What distinguishes inherent risk from residual risk?

  1. Inherent risk exists before controls, while residual risk remains after controls are applied Correct answer.
  2. They are identical concepts with different names
  3. Residual risk applies only to financial risks
  4. Inherent risk is measured after controls, while residual risk is measured before controls

Explanation

Inherent risk is the exposure that exists before any controls are considered, while residual risk is what remains after controls are applied. Comparing the two shows how effective controls are. This distinction guides decisions on additional treatment.

Question 18Governance, Risk and Compliance

A compliance manager wants to test whether employees understand the anti-bribery policy. Which approach provides the strongest evidence of understanding?

  1. Displaying the policy on the intranet homepage
  2. Sending the policy as an email attachment
  3. Counting how many employees downloaded the policy
  4. Scenario-based assessments with pass thresholds and remediation for failures Correct answer.

Explanation

Scenario-based testing with pass thresholds demonstrates whether employees can apply the policy to realistic situations. Download counts or distribution only show access, not comprehension. Remediation for those who fail closes the knowledge gap.

Question 19Governance, Risk and Compliance

Which statement best explains why segregation of duties is a key internal control?

  1. It speeds up every transaction by removing approvals
  2. It removes the need for any external audit
  3. It transfers all risk to the finance department
  4. It reduces the chance that one person can both commit and conceal an error or fraud Correct answer.

Explanation

Segregation of duties divides incompatible tasks, such as authorization, custody, and recording, among different people. This makes it harder for a single individual to commit and then hide an error or fraud. It is a preventive control central to internal control frameworks.

Question 20Governance, Risk and Compliance

A regulator requests records, and the firm's compliance team discovers some documents were deleted contrary to the retention policy. What is the most appropriate immediate action?

  1. Tell the regulator the records never existed
  2. Recreate the documents to look complete
  3. Delete the remaining records as well
  4. Notify legal counsel, preserve remaining records, and investigate the deletion Correct answer.

Explanation

When records relevant to a regulatory request are missing, the firm should involve legal counsel, preserve all remaining evidence, and investigate how the deletion occurred. Fabricating or concealing records compounds the violation. Transparency and remediation are essential.

Question 21Governance, Risk and Compliance

Which of the following best describes the purpose of a compliance risk assessment?

  1. To identify and prioritize compliance exposures so resources can be directed to the highest-risk areas Correct answer.
  2. To design the company's advertising campaign
  3. To calculate the firm's quarterly tax liability
  4. To set the interest rate on customer loans

Explanation

A compliance risk assessment identifies regulatory exposures and ranks them by likelihood and impact. The results guide where to allocate monitoring, training, and control resources. It is a prioritization tool rather than a financial or marketing exercise.

Question 22Governance, Risk and Compliance

A bank's board wants assurance that its risk framework is effective. Which source provides the most independent assurance?

  1. The first-line business unit's self-assessment
  2. A vendor's marketing brochure
  3. The second-line compliance team's own report
  4. Internal audit's independent review Correct answer.

Explanation

Internal audit provides independent, objective assurance to the board on the effectiveness of risk management and controls. First- and second-line reports are valuable but are not independent of the activities they oversee. Independence is what makes third-line assurance credible.

Question 23Governance, Risk and Compliance

A firm operates in several countries with differing data protection laws. Which approach best manages this regulatory complexity?

  1. Ignore local laws and follow only the headquarters' practices
  2. Map requirements by jurisdiction and apply the strictest applicable standard as a baseline Correct answer.
  3. Apply the least stringent law across all locations to save costs
  4. Apply rules randomly to see which ones work

Explanation

Mapping obligations by jurisdiction lets the firm understand where requirements differ, and adopting the strictest standard as a baseline reduces the risk of breaching any single regime. Applying the weakest law or headquarters-only practices leaves the firm exposed in stricter jurisdictions.

Question 24Governance, Risk and Compliance

A control is rated as having a 'high' residual risk despite existing mitigations. What is the most appropriate governance response?

  1. Reclassify the risk as low to avoid reporting
  2. Accept the risk without any documentation
  3. Remove the control because it is ineffective
  4. Escalate to the appropriate risk committee and develop a treatment plan Correct answer.

Explanation

When residual risk remains high after controls, it should be escalated to the relevant risk committee for a decision, and a treatment plan should be developed. Undocumented acceptance or misclassification undermines governance. Removing a control would only worsen exposure.

Question 25Governance, Risk and Compliance

A compliance function reports directly to the CEO and has no independent access to the board. What governance weakness does this present?

  1. Overstaffing of the compliance team
  2. Too much board involvement in daily operations
  3. Excessive independence from management
  4. Reduced ability to escalate serious issues objectively to the board Correct answer.

Explanation

Without direct access to the board or its committee, compliance may be constrained in escalating sensitive issues objectively, especially those involving senior management. Independent reporting lines strengthen the function's ability to challenge and inform the board. This is a structural governance weakness.

Question 26Governance, Risk and Compliance

Which corporate body holds ultimate responsibility for the effectiveness of a firm's risk and compliance framework?

  1. The front-line business units
  2. The external auditor
  3. The board of directors Correct answer.
  4. The internal audit team

Explanation

Ultimate accountability for the risk and compliance framework rests with the board of directors, which sets risk appetite and oversees management's execution. Operational teams and audit functions support the framework but do not own it at the highest level. External auditors provide independent opinions but do not govern the firm.

Question 27Governance, Risk and Compliance

What is the primary purpose of a risk appetite statement?

  1. To record employee disciplinary actions
  2. To calculate the firm's annual tax liability
  3. To list every regulation the firm must follow
  4. To define how much risk the firm is willing to accept in pursuit of its objectives Correct answer.

Explanation

A risk appetite statement articulates the amount and type of risk an organization is willing to accept while pursuing its strategic goals. It guides decision-making and resource allocation across the business. It is not a regulatory register, disciplinary log, or tax calculation.

Question 28Governance, Risk and Compliance

Which line of defense typically performs independent assurance over the effectiveness of controls?

  1. The second line
  2. The first line
  3. The board chair
  4. The third line Correct answer.

Explanation

The third line of defense, usually internal audit, provides independent and objective assurance to the board on the effectiveness of governance, risk, and control. The first line owns and manages risk, while the second line provides oversight and challenge. Independence is what distinguishes the third line.

Question 29Governance, Risk and Compliance

Which document establishes the authority and reporting lines of a compliance function?

  1. The sales forecast
  2. The marketing plan
  3. The compliance charter Correct answer.
  4. The payroll register

Explanation

A compliance charter formally defines the compliance function's mandate, authority, independence, and reporting lines. It is approved by senior governance bodies and provides the basis for the function's activities. The other documents concern commercial or operational matters.

Question 30Governance, Risk and Compliance

A firm's code of conduct should primarily do which of the following?

  1. Eliminate the need for employee training
  2. Set out expected standards of behavior and consequences for breaches Correct answer.
  3. Guarantee that no misconduct will occur
  4. Replace all regulatory requirements

Explanation

A code of conduct communicates the standards of behavior expected of employees and outlines consequences for violations. It supports a culture of integrity but cannot guarantee that misconduct never happens. It complements rather than replaces regulation and training.

Question 31Governance, Risk and Compliance

Which of the following is a key component of a governance framework?

  1. A schedule of staff birthdays
  2. An inventory of office furniture
  3. A list of competitor prices
  4. Clear allocation of roles and responsibilities Correct answer.

Explanation

A governance framework depends on clearly defined roles, responsibilities, and decision rights so that accountability is unambiguous. Operational inventories and personal data are unrelated to governance structure. Clear allocation ensures risks are owned and overseen.

Question 32Governance, Risk and Compliance

What does a compliance monitoring plan primarily describe?

  1. The personal investment holdings of executives
  2. The activities, frequency, and scope of compliance testing Correct answer.
  3. The number of staff in the sales team
  4. The firm's marketing budget

Explanation

A compliance monitoring plan sets out what will be tested, how often, by whom, and within what scope, so oversight is systematic and risk-based. It is distinct from commercial planning and personnel data. Monitoring plans translate the compliance program into scheduled activity.

Question 33Governance, Risk and Compliance

Which term describes the culture in which employees feel safe raising concerns without fear of retaliation?

  1. Sales-driven culture
  2. Outsourcing culture
  3. Speak-up culture Correct answer.
  4. Cost-cutting culture

Explanation

A speak-up culture encourages employees to report concerns and protects them from retaliation, which helps surface issues early. Cultures focused purely on sales or cost reduction can suppress reporting. Speak-up culture is a recognized element of effective compliance programs.

Question 34Governance, Risk and Compliance

A compliance officer finds that a high-risk process has no documented controls. Which action best reflects a risk-based governance response?

  1. Prioritize designing and implementing controls for that process Correct answer.
  2. Reduce the risk rating without evidence
  3. Remove the process from the risk register
  4. Wait for the next annual audit cycle

Explanation

A risk-based approach directs attention and resources to the highest-risk gaps first, so the undocumented high-risk process should be prioritized for control design. Waiting or removing the item from the register leaves the exposure unmanaged. Lowering a rating without evidence misrepresents the risk.

Question 35Governance, Risk and Compliance

A firm's risk register shows a control failure in a payment approval process. Which governance action is most appropriate?

  1. Reassign the issue to the marketing team
  2. Ignore it because payments are routine
  3. Delete the finding from the register
  4. Assign an owner, remediate the control, and track the issue to closure Correct answer.

Explanation

Control failures should be assigned a clear owner, remediated promptly, and tracked through to closure so the issue is not lost. Ignoring or deleting findings leaves the exposure open and weakens accountability. Assigning the issue to an unrelated team creates confusion over ownership.

Question 36Governance, Risk and Compliance

A company wants to ensure its third-party vendors meet compliance standards. Which approach is most effective?

  1. Select vendors solely on lowest price
  2. Conduct risk-based due diligence and ongoing monitoring of vendors Correct answer.
  3. Assume all vendors comply unless a regulator complains
  4. Rely on vendors to self-certify once at onboarding

Explanation

Effective third-party risk management combines risk-based due diligence before engagement with ongoing monitoring during the relationship. One-time self-certification or price-only selection ignores evolving risk. Assuming compliance until a regulator complains is reactive and exposes the firm to liability.

Question 37Governance, Risk and Compliance

A firm's risk appetite states it has low tolerance for bribery risk, yet a business unit proposes entering a high-corruption market. What should governance require?

  1. Silent acceptance without escalation
  2. Delegation of the decision to the local sales team
  3. A documented assessment with enhanced controls and senior approval Correct answer.
  4. Automatic approval because revenue is at stake

Explanation

When a proposal conflicts with stated risk appetite, governance requires a documented assessment, enhanced due diligence and controls, and approval at an appropriate senior level. Automatic approval or silent acceptance undermines the risk appetite framework. Delegating such a decision to the sales team removes independent challenge.

Question 38Governance, Risk and Compliance

What is the main purpose of a compliance training program?

  1. To shift legal liability entirely to employees
  2. To build awareness of obligations and expected behaviors Correct answer.
  3. To replace written policies
  4. To satisfy marketing objectives

Explanation

Compliance training builds employee awareness of legal obligations, policies, and expected conduct so they can act appropriately. It supports but does not replace written policies, and it cannot shift liability away from the firm. Training is a preventive control within the compliance program.

Question 39Governance, Risk and Compliance

A regulator introduces a new reporting requirement. Which sequence best reflects an effective compliance response?

  1. Delegate interpretation entirely to an external consultant
  2. Assess the requirement, update policies and controls, train staff, then monitor adherence Correct answer.
  3. Apply it only to senior managers
  4. Ignore it until an enforcement action occurs

Explanation

An effective response maps the new obligation to policies and controls, communicates and trains affected staff, and monitors adherence. Ignoring the requirement or limiting it to senior staff leaves the firm non-compliant. Outsourcing interpretation without internal ownership weakens accountability.

Question 40Governance, Risk and Compliance

Which practice best supports the independence of a compliance function?

  1. Basing compliance bonuses solely on sales growth
  2. Making compliance staff also run the business units they monitor
  3. Having compliance report to the head of sales
  4. Giving compliance a direct reporting line to the board or a board committee Correct answer.

Explanation

Independence is strengthened when compliance has a direct reporting line to the board or a board committee and is free from commercial pressure. Reporting to the head of sales or tying pay to sales growth creates conflicts. Having compliance run the units it monitors undermines objectivity.

Question 41Governance, Risk and Compliance

What is the role of a risk owner?

  1. To audit the firm's financial statements
  2. To approve all marketing campaigns
  3. To be accountable for managing a specific risk and its controls Correct answer.
  4. To set the firm's tax strategy

Explanation

A risk owner is accountable for managing a defined risk, including ensuring appropriate controls are in place and monitored. This accountability is distinct from independent audit or unrelated commercial functions. Clear risk ownership is a cornerstone of governance.

Question 42Governance, Risk and Compliance

A firm discovers that a senior manager approved a transaction that breached policy. Which governance response best preserves accountability?

  1. Transfer the manager to a different department without review
  2. Waive the policy retroactively for that transaction
  3. Conceal the breach to protect reputation
  4. Investigate, apply the disciplinary process consistently, and remediate the control gap Correct answer.

Explanation

Consistent enforcement, including investigation and application of disciplinary processes regardless of seniority, preserves accountability and credibility. Concealment or quiet transfers undermine the compliance culture. Retroactive waivers erode the integrity of policy.

Question 43Governance, Risk and Compliance

Which metric best indicates the health of a compliance program's reporting channel?

  1. The number of marketing leads generated
  2. The average tenure of the sales director
  3. The size of the office building
  4. The number of concerns raised and the proportion substantiated Correct answer.

Explanation

Tracking the volume of concerns raised alongside substantiation rates helps gauge whether employees trust the reporting channel and whether issues are being identified. Commercial and facilities metrics say nothing about program health. A healthy channel typically shows steady reporting rather than silence.

Question 44Governance, Risk and Compliance

A firm's internal audit function reports administratively to the finance director and has no board access. What governance weakness does this create?

  1. Stronger financial controls by default
  2. Faster remediation of all issues
  3. Improved independence of assurance
  4. Reduced independence and potential impairment of assurance objectivity Correct answer.

Explanation

Independence of internal audit is impaired when it reports to an executive it may need to audit and lacks direct board access. This can compromise the objectivity of assurance and limit the board's visibility. Reporting to the finance director does not automatically strengthen controls or speed remediation.

Question 45Governance, Risk and Compliance

A firm applies a single global compliance policy to all jurisdictions despite stricter local rules in one country. What is the most significant governance risk?

  1. The firm may breach local law and face enforcement action Correct answer.
  2. Employees will require less training
  3. The firm will definitely reduce its costs
  4. The policy will automatically become more effective

Explanation

A single global policy that does not accommodate stricter local requirements can result in legal breaches and enforcement action in that jurisdiction. Cost savings and training reductions are not reliable outcomes. Effective global programs set a global minimum while layering stricter local requirements on top.

Question 46Governance, Risk and Compliance

A board committee receives only summary risk reports prepared by the business units themselves. What is the most significant limitation?

  1. The reports will always be inaccurate
  2. Reports are too detailed to review
  3. The information may lack independent challenge and omit emerging risks Correct answer.
  4. The committee will receive too many documents

Explanation

When the board relies solely on self-reported summaries from the units being overseen, the information may lack independent validation and can omit emerging or uncomfortable risks. Independence and challenge are essential to reliable board oversight. The core issue is not volume or guaranteed inaccuracy but the absence of objective verification.

Question 47Governance, Risk and Compliance

A firm's risk register rates a risk as low, but a near-miss event suggests the rating is understated. What is the most appropriate governance action?

  1. Record the near-miss only in the incident log without review
  2. Dismiss the near-miss as irrelevant
  3. Increase the rating without any documented rationale
  4. Reassess the risk using the near-miss evidence and update controls and ratings Correct answer.

Explanation

Near-miss events are valuable evidence that a risk may be understated, so the rating and associated controls should be reassessed and documented. Dismissing the event or logging it without review misses the learning opportunity. Changing a rating without documented rationale undermines the register's integrity.

Question 48Governance, Risk and Compliance

A firm outsources a critical compliance process to a vendor but retains no oversight capability. Which governance principle is most directly violated?

  1. Oversight is unnecessary once a contract is signed
  2. Vendors are responsible for the firm's regulatory breaches
  3. Outsourcing always transfers regulatory responsibility
  4. The firm remains accountable for outsourced activities and must retain oversight Correct answer.

Explanation

Outsourcing does not transfer regulatory accountability; the firm remains responsible and must retain the capability to oversee and, if needed, take back the activity. Assuming vendors absorb the firm's regulatory responsibility is a common and costly misconception. Contracts alone do not substitute for active oversight.

Question 49Governance, Risk and Compliance

A compliance team proposes a new control, but the business argues it will slow transactions. How should governance resolve this tension?

  1. Implement the control without any consultation
  2. Delegate the decision entirely to the business unit
  3. Abandon the control to preserve speed
  4. Assess the risk against appetite and design proportionate controls that balance risk and efficiency Correct answer.

Explanation

Governance should weigh the risk against the firm's appetite and design proportionate controls that manage exposure without unnecessary friction. Abandoning the control or imposing it without consultation ignores both risk and operational realities. Delegating entirely to the business removes independent challenge.

Question 50Governance, Risk and Compliance

Which element most strengthens the reliability of a firm's risk register?

  1. Entries updated only at year-end
  2. Restricting access to a single junior analyst
  3. Regular review, validation, and clear ownership of entries Correct answer.
  4. Recording risks without any ratings

Explanation

A risk register is most reliable when entries are regularly reviewed, validated, and assigned clear owners so that ratings and mitigations stay current. Annual-only updates allow the register to become stale. Limiting access or omitting ratings reduces its usefulness for decision-making.