I85PREP
⌘ K
RCSA APRCSA Exam study materials
RCSA APRCSA Exam study resources

RCSA APRCSA Exam practice questions

One question at a time. Build your RCSA APRCSA Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk and Control Self-Assessment Fundamentals and Governance

What is the primary purpose of a risk and control self-assessment (RCSA) program?

  1. To have business units identify, assess, and document their own risks and the controls that mitigate them Correct answer.
  2. To transfer all operational risk to an external insurer
  3. To replace the internal audit function with self-review activities
  4. To calculate the organization's regulatory capital requirement

Explanation

An RCSA is a structured process in which the business itself, rather than an independent party, identifies its risks, rates their likelihood and impact, and evaluates the design and performance of related controls. It produces an owned inventory of risk and control information that supports management decisions and later assurance work.

Question 2Risk and Control Self-Assessment Fundamentals and Governance

In RCSA terminology, what does the 'residual risk' refer to?

  1. The risk that a control will fail to operate as designed
  2. The risk retained by an insurer under a deductible
  3. The risk that remains after existing controls are taken into account Correct answer.
  4. The total risk before any controls are applied

Explanation

Residual risk is the exposure that persists once the mitigating effect of current controls is considered. It is distinguished from inherent risk, which is the exposure before controls. Management compares residual risk with its tolerance to decide whether further action is needed.

Question 3Risk and Control Self-Assessment Fundamentals and Governance

A risk register entry records an inherent risk rating of high and a residual risk rating of low. What does this most likely indicate?

  1. The risk has been fully eliminated and can be removed from the register
  2. The inherent rating was entered incorrectly because ratings cannot differ
  3. The controls in place are assessed as effective at reducing the exposure Correct answer.
  4. No controls have yet been identified for this risk

Explanation

A large gap between inherent and residual ratings implies that the identified controls are believed to substantially reduce likelihood or impact. The assessor should confirm that this mitigation is real and evidenced, since an unsupported downgrade overstates control effectiveness.

Question 4Risk and Control Self-Assessment Fundamentals and Governance

Which characteristic most clearly distinguishes inherent risk from residual risk?

  1. Inherent risk applies only to financial risks; residual risk applies to all risk types
  2. Inherent risk is qualitative; residual risk is always quantitative
  3. Inherent risk is owned by the board; residual risk is owned by front-line staff
  4. Inherent risk is measured before controls; residual risk is measured after controls Correct answer.

Explanation

The defining difference is the point of measurement relative to controls. Inherent risk captures the exposure assuming no controls or only the natural environment, while residual risk reflects what remains after the current control set is applied. Both can be assessed qualitatively or quantitatively and both are owned within the business.

Question 5Risk and Control Self-Assessment Fundamentals and Governance

Which item is a preventive control rather than a detective control?

  1. A post-implementation review of a completed project
  2. A review of exception reports by the operations manager
  3. A system rule that blocks a payment above an approved limit Correct answer.
  4. A monthly reconciliation of the general ledger

Explanation

Preventive controls stop an error or unauthorized event before it occurs, such as a hard system limit that rejects an out-of-policy transaction. Detective controls identify problems after the fact. Reconciliations, exception reviews, and post-implementation reviews all operate after the event and are therefore detective.

Question 6Risk and Control Self-Assessment Fundamentals and Governance

What is the key difference between a key control and a secondary control in an RCSA?

  1. A key control is performed by internal audit, while a secondary control is performed by the business
  2. A key control is tested annually, while a secondary control is never tested
  3. A key control is essential to keeping residual risk within tolerance, while a secondary control provides supplementary support Correct answer.
  4. A key control is always automated, while a secondary control is always manual

Explanation

Key controls are the ones on which the risk assessment most depends; if they fail, residual risk rises above tolerance. Secondary or compensating controls add support but are not individually decisive. Control criticality is about reliance for risk mitigation, not about who performs the control or whether it is automated.

Question 7Risk and Control Self-Assessment Fundamentals and Governance

In a typical three lines model, which group owns and performs the RCSA?

  1. The first line, meaning the business areas that take and manage risk Correct answer.
  2. The board risk committee acting alone
  3. The third line, meaning internal audit
  4. The second line, meaning the independent external auditor

Explanation

Under the three lines model, the first line owns and manages risk day to day, so it performs the self-assessment of its own processes and controls. The second line sets frameworks and challenges, and the third line provides independent assurance. Ownership of the assessment rests with those who run the process.

Question 8Risk and Control Self-Assessment Fundamentals and Governance

What is the primary role of the second line in relation to RCSA activity?

  1. Approving individual customer transactions within policy limits
  2. Delivering the independent audit opinion on control effectiveness
  3. Setting the methodology and challenging first-line risk and control assessments Correct answer.
  4. Performing the day-to-day control activities recorded in the register

Explanation

The second line designs the risk framework, defines rating scales and templates, aggregates results, and provides credible challenge to first-line assessments. It does not execute the operational controls or issue independent audit opinions. That separation preserves objectivity across the lines.

Question 9Risk and Control Self-Assessment Fundamentals and Governance

A risk owner in an RCSA program is best described as which of the following?

  1. The auditor who tests the control on an annual basis
  2. The vendor that supplies the risk management software
  3. The regulator that supervises the institution
  4. The individual accountable for managing a specific risk and its related controls Correct answer.

Explanation

A risk owner is a named person with accountability for a defined risk, including ensuring controls operate and remediation occurs. Clear ownership is a core governance requirement because unassigned risks tend to go unmanaged. The role is internal and accountable, not an assurance or vendor function.

Question 10Risk and Control Self-Assessment Fundamentals and Governance

Which governance body typically approves the enterprise RCSA policy and the overall risk appetite against which assessments are judged?

  1. The external assurance provider
  2. The board of directors or its delegated risk committee Correct answer.
  3. The internal audit team
  4. The first-line operations supervisors

Explanation

The board, often through a risk committee, approves the risk management policy and the risk appetite statement that give meaning to RCSA ratings. Management then implements the framework within those limits. Audit and first-line supervisors operate under the approved framework rather than setting it.

Question 11Risk and Control Self-Assessment Fundamentals and Governance

What does a risk appetite statement contribute to the RCSA process?

  1. It provides the thresholds against which assessed residual risk is judged acceptable or unacceptable Correct answer.
  2. It specifies the exact wording of audit findings
  3. It lists every control that must be tested during the year
  4. It replaces the need for a risk register

Explanation

Risk appetite expresses how much risk the organization is willing to accept in pursuit of its objectives. RCSA results become meaningful when compared with these thresholds, so that a 'medium' rating can be judged within or beyond tolerance. Without appetite, ratings are relative and hard to act on.

Question 12Risk and Control Self-Assessment Fundamentals and Governance

Which rating approach is most consistent with a five-point likelihood and impact matrix?

  1. Adding the two scores and dividing by the number of controls
  2. Multiplying likelihood and impact scores to produce a combined risk rating Correct answer.
  3. Averaging the likelihood and impact scores to produce a combined rating
  4. Selecting whichever of the two scores is lower as the combined rating

Explanation

In a typical matrix, likelihood and impact are scored on ordinal scales and combined, often by multiplication, to place the risk in a heat-map cell. The combination reflects that a frequent low-impact event and a rare high-impact event can produce similar concern. Dividing by control counts has no basis in risk measurement.

Question 13Risk and Control Self-Assessment Fundamentals and Governance

An assessor rates a risk as high likelihood and low impact. What is the most reasonable next step in the RCSA workflow?

  1. Reclassify the risk as low likelihood to align with the impact rating
  2. Remove the risk from the register because impact is low
  3. Escalate immediately to the regulator
  4. Document the rationale and identify controls that reduce the frequency of the event Correct answer.

Explanation

Each rating should be supported by a documented rationale, and controls should be linked to the dimension they affect; here, controls that reduce frequency address the high likelihood. Low impact does not make a frequent event irrelevant, and ratings should never be altered merely to fit a desired pattern.

Question 14Risk and Control Self-Assessment Fundamentals and Governance

Which sequence best reflects a standard RCSA cycle?

  1. Assess control effectiveness, identify risks, determine residual risk, map controls, assess inherent risk
  2. Determine residual risk, identify risks, assess inherent risk, map controls, agree actions
  3. Identify risks, assess inherent risk, map controls, assess control effectiveness, determine residual risk, agree actions Correct answer.
  4. Map controls, agree actions, identify risks, assess inherent risk, determine residual risk

Explanation

The logical flow starts with identifying the risk, rating it before controls, then documenting the controls and evaluating how well they work. Only then can residual risk be derived and remediation actions agreed. Reversing these steps produces conclusions unsupported by evidence.

Question 15Risk and Control Self-Assessment Fundamentals and Governance

What is the main advantage of a workshop-based RCSA over a questionnaire-only approach?

  1. It removes the need to document results in a register
  2. It guarantees that no risk will be missed
  3. It enables structured discussion and challenge that surface risks individuals may overlook alone Correct answer.
  4. It eliminates the need for second-line oversight

Explanation

Workshops bring process owners together so that risks can be debated, assumptions tested, and cross-functional dependencies revealed. Questionnaires are efficient but tend to capture individual views without challenge. Neither method guarantees completeness, and both still require documentation and oversight.

Question 16Risk and Control Self-Assessment Fundamentals and Governance

A control is described as 'the reconciliation is performed monthly by the accounting team.' Which element is missing for the control description to be complete?

  1. The evidence of performance and the review or sign-off by a second person Correct answer.
  2. The name of the software used by the accounting team
  3. The number of staff in the accounting team
  4. The budget allocated to the reconciliation process

Explanation

A well-written control description states who performs it, what is done, when, and how performance is evidenced and reviewed. The absence of documented evidence and independent sign-off makes the control hard to test and weakens its reliability. Software, headcount, and budget are context, not defining attributes.

Question 17Risk and Control Self-Assessment Fundamentals and Governance

What is the purpose of identifying a 'control gap' during an RCSA?

  1. To record that a control was tested and passed
  2. To document the auditor's sampling methodology
  3. To confirm that residual risk equals inherent risk
  4. To highlight a risk with insufficient or missing controls so remediation can be planned Correct answer.

Explanation

A control gap exists where a risk lacks adequate mitigation, leaving residual exposure above tolerance. Identifying gaps drives the action plan, with owners and dates, to design or strengthen controls. A passing test result or an audit sampling note is not a gap.

Question 18Risk and Control Self-Assessment Fundamentals and Governance

A business unit's RCSA shows a residual risk above appetite with no planned action. What governance response is most appropriate?

  1. Ask internal audit to operate the missing control
  2. Escalate the exposure to senior management or the risk committee for a decision Correct answer.
  3. Delete the entry to keep the register within appetite
  4. Accept the result silently because the business unit owns the risk

Explanation

When residual risk exceeds appetite and no remediation is planned, the decision to accept, treat, or escalate must be made at a level with authority for that exposure. Silence is not acceptance. Deleting entries distorts reporting, and internal audit cannot take on management's control responsibilities.

Question 19Risk and Control Self-Assessment Fundamentals and Governance

Which factor most affects how frequently a key control should be tested?

  1. The seniority of the person who wrote the procedure
  2. The age of the software platform hosting the register
  3. The number of pages in the control description
  4. The criticality of the risk it mitigates and the control's own risk of failure Correct answer.

Explanation

Monitoring frequency should be risk-based, reflecting the severity of the risk being mitigated and the likelihood that the control could fail or be bypassed. High-risk, judgment-heavy, or manual controls generally warrant more frequent testing. Documentation length, author seniority, and platform age are not determinants.

Question 20Risk and Control Self-Assessment Fundamentals and Governance

What distinguishes a risk taxonomy from a risk register?

  1. A taxonomy provides a common classification structure, while a register records specific assessed risks and controls Correct answer.
  2. A taxonomy is confidential, while a register is always public
  3. A taxonomy applies to audit, while a register applies to finance
  4. A taxonomy lists individual control test results, while a register lists only inherent risks

Explanation

A risk taxonomy is the agreed hierarchy of risk categories used to classify and aggregate exposures consistently across the organization. The register holds the individual risk entries, with owners, ratings, controls, and actions. The taxonomy gives structure; the register gives substance.

Question 21Risk and Control Self-Assessment Fundamentals and Governance

Why should RCSA results be aggregated across business units?

  1. To satisfy the requirement that all risks be rated low
  2. To reduce the number of controls that must be documented
  3. To reveal enterprise-wide and cross-unit exposures that individual assessments may not show Correct answer.
  4. To ensure every unit receives an identical risk rating

Explanation

Aggregation shows concentrations and correlated risks, such as the same vendor or system relied on by several units, that are invisible at the local level. It supports enterprise reporting and capital and strategy decisions. It does not aim to standardize ratings or reduce documentation.

Question 22Risk and Control Self-Assessment Fundamentals and Governance

Which statement best describes the concept of 'credible challenge' in an RCSA?

  1. The regulator sets the ratings for each risk
  2. An independent party questions the evidence and reasoning behind a first-line assessment Correct answer.
  3. The first line approves its own assessment without review
  4. The auditor rewrites the risk register on behalf of management

Explanation

Credible challenge means that someone with sufficient expertise and standing tests the assumptions, evidence, and conclusions of the assessment. It strengthens reliability by exposing optimism bias and unsupported ratings. It is not self-approval, nor does it transfer authorship or rating authority to auditors or regulators.

Question 23Risk and Control Self-Assessment Fundamentals and Governance

A process owner claims a manual control is 'very effective' but cannot produce evidence of performance for the last six months. How should the assessment treat this control?

  1. Remove the control from the register to avoid an untested rating
  2. Rate its effectiveness as weak or unproven until evidence is provided Correct answer.
  3. Accept the claim because the owner is accountable for the process
  4. Rate it effective and note the missing evidence as a minor point

Explanation

Control effectiveness ratings must be supported by evidence; an assertion without proof cannot justify reliance. The prudent treatment is to record the control as unproven or ineffective and raise an action to establish evidence. Removing the control would understate the mitigation actually intended.

Question 24Risk and Control Self-Assessment Fundamentals and Governance

Which outcome best demonstrates that an RCSA program is mature rather than merely compliant?

  1. The template has not changed since it was introduced
  2. The register contains more entries than the prior year
  3. Every unit submits its template on the deadline each year
  4. Assessment results are used to prioritize remediation and inform risk appetite decisions Correct answer.

Explanation

Maturity is shown when RCSA output actually drives decisions, such as targeting resources at the highest residual risks and refining appetite. Timely submission and growing entry counts reflect activity, not necessarily value. A frozen template may signal stagnation rather than stability.

Question 25Risk and Control Self-Assessment Fundamentals and Governance

What is the main risk of relying solely on a self-assessment with no independent validation?

  1. Controls will become over-documented
  2. The register will contain too many risk categories
  3. The assessment will take too long to complete
  4. Optimism bias may cause risks and control weaknesses to be understated Correct answer.

Explanation

Self-assessment is inherently exposed to optimism bias, where owners rate their own controls more favorably than the evidence supports. Independent validation by the second or third line counteracts this tendency. Timing, taxonomy size, and documentation volume are separate design issues.

Question 26Risk and Control Self-Assessment Fundamentals and Governance

Which statement best defines inherent risk in an RCSA context?

  1. The risk exposure that remains after existing controls are applied and their effectiveness is rated
  2. The maximum loss a firm could absorb without breaching its capital or liquidity requirements
  3. The portion of risk transferred to a third party through insurance or outsourcing arrangements
  4. The gross exposure of a process before any controls are considered, used as the starting point of the assessment Correct answer.

Explanation

Inherent risk is the gross level of exposure a process or activity carries before any mitigating controls are taken into account. Assessors record it first so that the effect of controls can be isolated and residual risk derived afterwards. It is not a capital threshold and it is not the risk that has been transferred away.

Question 27Risk and Control Self-Assessment Fundamentals and Governance

An RCSA program requires every risk statement in the register to be written in a consistent structure. Which format best supports that requirement?

  1. A numeric score combining likelihood and impact into one composite rating
  2. A list of the controls currently in place, followed by the name of the control owner
  3. Cause, then event, then consequence, expressed as a complete sentence about the process Correct answer.
  4. A single noun phrase naming the risk category, such as 'fraud risk' or 'technology risk'

Explanation

A well-formed risk statement links the underlying cause to the risk event and then to the business consequence, which makes the risk assessable and testable. Category labels alone are too vague to rate, and control lists describe mitigation rather than the risk itself. The cause-event-consequence structure also lets different units be compared and aggregated.

Question 28Risk and Control Self-Assessment Fundamentals and Governance

A process owner rates a control as 'partially effective' because it operates as designed but is performed only quarterly on a high-volume transaction stream. Which conclusion is most defensible?

  1. The design is sound, but the operating frequency leaves the exposure insufficiently covered between runs Correct answer.
  2. The control effectiveness rating should be raised to effective because no performance failures were found
  3. The control should be removed from the register because it functions as intended without exception
  4. The control should be reclassified as a key control because it operates exactly as documented

Explanation

Effectiveness has two dimensions: whether the control is designed to address the risk and whether it operates often enough to keep exposure within appetite. A control that works as written but runs too infrequently for the volume involved has a design limitation, so a partial rating is justified. Absence of failures does not prove the frequency is adequate.

Question 29Risk and Control Self-Assessment Fundamentals and Governance

An RCSA policy states that assessments must be refreshed when significant change occurs. Which event most clearly triggers that requirement?

  1. A control owner transfers internally but the process and controls remain unchanged
  2. A new core processing system goes live and replaces the prior manual workflow Correct answer.
  3. The annual review calendar reaches its scheduled refresh date for the business unit
  4. The internal audit plan is finalized for the coming year without changes to scope

Explanation

A significant-change trigger is an event that alters the risk profile, such as a new system, a new product, or a restructured process. Replacing a manual workflow with a new platform changes both the risks and the controls, so the assessment must be refreshed. Calendar dates and personnel moves that leave the process intact do not by themselves change the risk profile.

Question 30Risk and Control Self-Assessment Fundamentals and Governance

A business unit reports that all its assessed risks are within appetite and that every control is fully effective, yet its loss experience has risen sharply over the same period. What does this pattern most likely indicate about the RCSA?

  1. The assessment process is producing optimistic ratings that are not calibrated to actual outcomes Correct answer.
  2. The unit has too many key controls relative to the number of risks it has documented
  3. The risk appetite statement is set too conservatively relative to the industry benchmark
  4. The loss events are unrelated to the assessed processes and can be excluded from review

Explanation

When self-assessed ratings consistently diverge from observed outcomes, the assessment is not calibrated and is likely biased toward optimistic scoring. Loss data provide an objective benchmark that should feed back into ratings and control effectiveness conclusions. Persistent divergence signals a need for recalibration and stronger validation rather than a change in appetite.

Question 31Risk Identification, Taxonomy, and Risk Language

Which statement best defines a risk taxonomy?

  1. A structured classification scheme that groups risks into consistent categories using defined criteria Correct answer.
  2. A list of every incident that occurred during the prior fiscal year
  3. A narrative summary of management's risk appetite statement
  4. A quantitative model that computes expected loss for each product line

Explanation

A taxonomy is a classification framework: it organizes risks into categories with explicit definitions and rules so that different people classify the same exposure the same way. It is not an incident log, a loss model, or an appetite narrative, although it supports all three.

Question 32Risk Identification, Taxonomy, and Risk Language

A bank organizes its risk register so that every risk must be assigned to exactly one level-one category, with sub-categories beneath it. What property of a taxonomy does this requirement most directly enforce?

  1. Mutual exclusivity of categories Correct answer.
  2. Volatility of risk ratings
  3. Frequency of reporting
  4. Independence of internal audit

Explanation

Requiring exactly one top-level assignment forces categories to be mutually exclusive so a single risk is not double-counted across the register. This supports aggregation and consistent reporting because each exposure has one home.

Question 33Risk Identification, Taxonomy, and Risk Language

In a common financial-services taxonomy, credit risk, market risk, and liquidity risk are best described as which type of category?

  1. Control deficiencies
  2. Residual risk ratings
  3. Level-one risk types Correct answer.
  4. Key risk indicators

Explanation

Credit, market, and liquidity risk are foundational risk types that typically sit at the top level of an enterprise taxonomy. Controls, indicators, and residual ratings are attributes applied to risks rather than risk types themselves.

Question 34Risk Identification, Taxonomy, and Risk Language

Which element is essential for a risk statement to be usable in a taxonomy-driven register?

  1. A named owner, a defined cause, an event, and a consequence Correct answer.
  2. A projected share price impact only
  3. A reference to the auditor who raised the issue
  4. A single adjective such as high or low

Explanation

A well-formed risk statement links cause, event, and consequence and assigns accountability, which makes it classifiable and actionable. Cause-event-consequence structure also allows consistent mapping to taxonomy categories.

Question 35Risk Identification, Taxonomy, and Risk Language

What is the primary purpose of a common risk language within an organization?

  1. To ensure different functions describe and interpret the same risk consistently Correct answer.
  2. To guarantee that no risk event will occur
  3. To eliminate the need for risk committees
  4. To replace quantitative risk measurement entirely

Explanation

A common risk language standardizes terms and definitions so that functions such as finance, operations, and compliance mean the same thing when they say a risk is high or that a control is ineffective. This enables comparable reporting and aggregation across the enterprise.

Question 36Risk Identification, Taxonomy, and Risk Language

An institution defines inherent risk as the exposure before controls and residual risk as the exposure after controls. A risk owner reports 'high inherent, low residual.' What does this indicate?

  1. No controls are in place for the process
  2. The risk has been eliminated from the register
  3. Controls are assessed as effectively reducing the exposure Correct answer.
  4. The inherent rating was recorded incorrectly

Explanation

A large gap between inherent and residual ratings indicates that controls are believed to meaningfully reduce exposure. The risk remains on the register because residual exposure is still assessed and monitored.

Question 37Risk Identification, Taxonomy, and Risk Language

Which of the following best describes a risk driver?

  1. The documented evidence that a control operated
  2. The final rating assigned after mitigation
  3. The person accountable for the risk
  4. An underlying condition or factor that causes or increases the likelihood of a risk event Correct answer.

Explanation

Risk drivers are the root conditions or forces, such as process complexity or staff turnover, that raise the likelihood or impact of an event. Identifying drivers supports targeted mitigation rather than treating symptoms.

Question 38Risk Identification, Taxonomy, and Risk Language

A firm's taxonomy separates 'strategic risk' from 'operational risk.' Which characteristic most reliably distinguishes strategic risk?

  1. It always results from failed internal processes
  2. It arises from business decisions, competitive positioning, or the external environment affecting objectives Correct answer.
  3. It is limited to technology outages
  4. It is only measured through credit losses

Explanation

Strategic risk stems from choices about markets, business models, and competitive or environmental shifts that affect the ability to achieve objectives. Operational risk, by contrast, concerns people, processes, systems, and external events in day-to-day execution.

Question 39Risk Identification, Taxonomy, and Risk Language

A risk manager is mapping a new third-party payment arrangement into the enterprise taxonomy. Which approach best supports consistent classification?

  1. Assign it to the category with the largest historical losses
  2. Apply the taxonomy's defined criteria for third-party and operational risk and document the rationale Correct answer.
  3. Let each business unit choose the category it prefers
  4. Classify it as market risk because payments involve currency

Explanation

Consistency comes from applying documented taxonomy criteria and recording the reasoning so that reviewers can verify and replicate the decision. Loss history or individual preference would produce inconsistent placement across units.

Question 40Risk Identification, Taxonomy, and Risk Language

Two business units both report 'high' operational risk. Unit A uses a five-point scale with 'high' as the fourth level; Unit B uses a three-point scale with 'high' as the top level. What is the main weakness this reveals?

  1. High ratings should be prohibited in registers
  2. Both units must be using the wrong taxonomy
  3. Operational risk should never be rated qualitatively
  4. Inconsistent rating scales prevent meaningful aggregation of the ratings Correct answer.

Explanation

When scales differ in granularity, the same label carries different meaning, so aggregating 'high' across units distorts the enterprise view. A common language requires aligned scale definitions and calibration.

Question 41Risk Identification, Taxonomy, and Risk Language

A taxonomy includes the category 'conduct risk' with the definition 'risk of detriment to customers or markets from inappropriate behavior or business practices.' A trader deliberately misprices a product to customers. How should this be classified?

  1. Strategic risk
  2. Liquidity risk
  3. Model risk
  4. Conduct risk Correct answer.

Explanation

The definition centers on harm to customers or market integrity from inappropriate behavior, which directly matches deliberate mispricing. Liquidity, strategic, and model risk categories describe different sources of exposure.

Question 42Risk Identification, Taxonomy, and Risk Language

An analyst classifies a risk as 'cyber' rather than 'operational' because the taxonomy has a dedicated cyber sub-category under operational risk. What taxonomy principle is the analyst applying?

  1. Volatility: choose the category that changes most often
  2. Materiality: choose the category with the largest financial exposure
  3. Specificity: use the most precise applicable category within the hierarchy Correct answer.
  4. Simplicity: always use the broadest category available

Explanation

Hierarchical taxonomies expect risks to be placed in the most specific applicable node so that detailed analysis and reporting are possible while still rolling up to the parent category. Choosing a broader category would lose valuable granularity.

Question 43Risk Identification, Taxonomy, and Risk Language

Which pair of terms is most often confused in risk language, requiring explicit definition in a taxonomy glossary?

  1. Audit and assurance
  2. Control and owner
  3. Register and committee
  4. Likelihood and probability Correct answer.

Explanation

Likelihood and probability are frequently used interchangeably even though some frameworks treat likelihood as broader qualitative judgment and probability as a quantified measure. A glossary must define both to avoid inconsistent scoring.

Question 44Risk Identification, Taxonomy, and Risk Language

A firm's taxonomy has 'people risk' and 'process risk' as separate sub-categories. A key employee resigns, causing errors because procedures were undocumented. How should this be classified most appropriately?

  1. Strategic risk, because staffing affects strategy
  2. Market risk, because labor markets tightened
  3. Process risk only, because errors occurred
  4. People risk, with process weakness noted as a contributing driver Correct answer.

Explanation

The triggering event is loss of a key person, which fits people risk, while the undocumented procedures are a contributing condition that should be captured as a driver. Recording the driver preserves the linkage without misplacing the primary category.

Question 45Risk Identification, Taxonomy, and Risk Language

What distinguishes a risk cause from a risk consequence in a risk statement?

  1. The cause and consequence are synonyms in standard risk language
  2. The cause is always financial; the consequence is always reputational
  3. The cause is the condition that produces the event; the consequence is the outcome if the event occurs Correct answer.
  4. The cause is recorded after the event; the consequence is recorded before

Explanation

Cause precedes the event and explains why it might happen, while consequence describes the resulting impact. Keeping them distinct prevents vague statements that mix drivers with outcomes.

Question 46Risk Identification, Taxonomy, and Risk Language

A taxonomy review finds that 30 percent of register entries are tagged 'other.' What is the most appropriate interpretation?

  1. The 'other' category should be deleted without further analysis
  2. The taxonomy may be incomplete or its definitions unclear, warranting review Correct answer.
  3. The entries should be reclassified as strategic risk by default
  4. The register is functioning well because all risks are captured

Explanation

A large share of residual 'other' entries signals that categories do not fit actual exposures or that definitions are ambiguous. Reviewing definitions and adding needed categories improves classification quality.

Question 47Risk Identification, Taxonomy, and Risk Language

Which statement correctly describes the relationship between a risk taxonomy and a risk appetite framework?

  1. The taxonomy provides the categories against which appetite limits and tolerances are expressed Correct answer.
  2. The two frameworks are unrelated and never interact
  3. The appetite framework determines the taxonomy's category names
  4. The taxonomy replaces the need for appetite statements

Explanation

Appetite and tolerance statements are typically expressed by risk category, so the taxonomy supplies the structure that makes those limits meaningful and reportable. The two frameworks are complementary rather than substitutes.

Question 48Risk Identification, Taxonomy, and Risk Language

A risk is described as 'loss of customer data due to a vendor outage.' Which taxonomy dimension does 'due to a vendor outage' primarily capture?

  1. The cause or driver of the event Correct answer.
  2. The risk owner's accountability
  3. The control effectiveness score
  4. The residual risk rating

Explanation

The phrase identifies the originating condition, a vendor outage, which is the cause or driver leading to the data loss event. Ratings, control scores, and ownership are separate attributes recorded alongside the risk.

Question 49Risk Identification, Taxonomy, and Risk Language

Which practice best supports a consistent risk language across a large, multi-jurisdictional organization?

  1. Publishing a glossary with approved definitions and providing training on its use Correct answer.
  2. Updating definitions informally whenever convenient
  3. Allowing each region to invent its own terminology
  4. Relying on verbal understanding among senior managers

Explanation

A formally published glossary plus training gives staff shared reference points and reduces definitional drift across regions. Informal or region-specific terminology reintroduces the inconsistency the framework is meant to solve.

Question 50Risk Identification, Taxonomy, and Risk Language

An operational risk event is caused by an external fraudster. Under a taxonomy that separates internal fraud from external fraud, why does this distinction matter?

  1. It drives different control expectations and reporting, since external fraud requires preventive and detective controls against outsiders Correct answer.
  2. It has no effect because both are fraud
  3. It converts the event into a market risk
  4. It determines the accounting treatment of the loss

Explanation

Internal and external fraud involve different actors and therefore different control responses, such as segregation of duties for insiders versus authentication and monitoring for outsiders. The taxonomy distinction supports targeted mitigation and meaningful reporting.