I85PREP
⌘ K
AIRAF study materials
AIRAF study resources

AIRAF practice questions

One question at a time. Build your AIRAF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Framework and Governance

Which document establishes the overall direction and authority for an organization's risk management activities?

  1. The risk management policy Correct answer.
  2. The audit work program
  3. The incident register
  4. The control testing schedule

Explanation

A risk management policy is the governing document that sets objectives, scope, roles, and authority for how risk is identified, assessed, and treated across the organization. Registers, work programs, and testing schedules are operational artifacts that operate under that policy rather than creating it.

Question 2Risk Management Framework and Governance

In the standard three-lines model, which group provides independent assurance over risk management to the governing body?

  1. The board risk committee
  2. The operational business units
  3. The internal audit function Correct answer.
  4. The risk and compliance function

Explanation

The third line, internal audit, gives independent and objective assurance on the effectiveness of governance, risk management, and controls. It reports to the governing body and is organizationally separate from management activities in the first and second lines.

Question 3Risk Management Framework and Governance

A risk register entry records a likelihood of 4 and an impact of 5 on a 5-point scale. Using a simple multiplicative scoring method, what is the inherent risk score?

  1. 20 Correct answer.
  2. 45
  3. 1.25
  4. 9

Explanation

A multiplicative risk score is the product of likelihood and impact, so 4 multiplied by 5 yields 20. Scores are then compared against thresholds to determine whether the exposure falls within appetite or requires escalation.

Question 4Risk Management Framework and Governance

What distinguishes residual risk from inherent risk?

  1. Residual risk applies only to third-party relationships
  2. Residual risk is the exposure before any controls exist
  3. Residual risk is measured only in financial terms
  4. Residual risk is the exposure remaining after controls are applied Correct answer.

Explanation

Inherent risk is the exposure that exists before controls are considered, while residual risk reflects what remains once existing controls are taken into account. Comparing the two shows how much risk reduction the control environment actually delivers.

Question 5Risk Management Framework and Governance

Which statement best describes risk appetite?

  1. The list of risks recorded in the corporate register
  2. The maximum loss an insurer will pay on a single claim
  3. The amount and type of risk an organization is willing to accept to pursue its objectives Correct answer.
  4. The frequency with which controls are tested by audit

Explanation

Risk appetite expresses the level and nature of risk the organization chooses to accept in pursuit of its strategy. It is set by the governing body and translated into tolerances and limits that guide decision-making.

Question 6Risk Management Framework and Governance

Which of the following is a key responsibility of a board-level risk committee?

  1. Performing the annual financial statement audit
  2. Preparing individual transaction journal entries
  3. Overseeing the risk profile and approving risk tolerances Correct answer.
  4. Executing daily control activities in business units

Explanation

A board risk committee provides oversight by reviewing the aggregate risk profile, approving appetite and tolerances, and challenging management on risk decisions. It does not perform operational control execution or independent audit work.

Question 7Risk Management Framework and Governance

A control that requires two authorized approvers before a payment is released is best classified as which type of control?

  1. Corrective
  2. Directive
  3. Detective
  4. Preventive Correct answer.

Explanation

Preventive controls stop an error or unauthorized action before it occurs, and dual authorization blocks a payment until both approvals exist. Detective controls would find the issue afterward, and corrective controls would remediate it after detection.

Question 8Risk Management Framework and Governance

What is the primary purpose of a risk treatment plan?

  1. To list every employee who has access to the building
  2. To record customer complaints received during the year
  3. To specify actions, owners, and timelines for reducing identified risk Correct answer.
  4. To document the organization's audited financial results

Explanation

A treatment plan translates the chosen response, such as mitigate, transfer, avoid, or accept, into concrete actions with accountable owners and target dates. It provides the traceability needed to monitor whether risk has actually been reduced.

Question 9Risk Management Framework and Governance

An organization accepts a low-rated risk without further action but documents the decision and its rationale. Which risk response has been applied?

  1. Mitigation
  2. Transfer
  3. Avoidance
  4. Acceptance Correct answer.

Explanation

Acceptance means the organization consciously retains the exposure, usually because the cost of treatment exceeds the benefit or the risk sits within appetite. Documenting the decision preserves accountability and supports later review if conditions change.

Question 10Risk Management Framework and Governance

A risk heat map plots likelihood against impact. What is the main limitation of relying on a heat map alone for risk prioritization?

  1. It is only valid for financial reporting risks
  2. It can obscure the reliability of estimates and combine unrelated risks in one cell Correct answer.
  3. It requires quantitative loss data to be produced at all
  4. It cannot display more than three individual risks at once

Explanation

Heat maps aggregate risks into qualitative bands, which can hide uncertainty in the underlying estimates and merge exposures with very different drivers. They are useful for communication but should be supported by more granular analysis for key decisions.

Question 11Risk Management Framework and Governance

Which practice best demonstrates a strong risk culture within an organization?

  1. Performance targets override control requirements when deadlines are tight
  2. Risk issues are documented solely to satisfy the auditor
  3. Staff at all levels escalate concerns without fear of blame Correct answer.
  4. Only senior executives are permitted to discuss risk

Explanation

A healthy risk culture encourages open escalation and treats risk information as decision input rather than a compliance formality. Psychological safety and consistent tone from leadership are what make early warning actually reach decision-makers.

Question 12Risk Management Framework and Governance

An organization sets a tolerance of no more than five high-severity incidents per quarter. At quarter end it has recorded seven. What is the most appropriate governance response?

  1. Take no action because tolerances are only advisory
  2. Escalate the breach to the risk committee with a remediation plan Correct answer.
  3. Wait until the annual audit to disclose the position
  4. Recalculate the tolerance so that seven becomes acceptable

Explanation

A tolerance breach is a governance trigger that should be escalated with an explanation and a plan to return within limits. Retrospectively adjusting the limit without justification undermines the credibility of the framework.

Question 13Risk Management Framework and Governance

A risk owner is accountable for a specific risk. Which activity falls most directly within that role?

  1. Independently auditing the controls that address the risk
  2. Setting the organization's overall risk appetite
  3. Deciding and funding the response to bring the risk within tolerance Correct answer.
  4. Approving the annual external audit plan

Explanation

A risk owner is accountable for managing the assigned risk, which includes selecting and resourcing a response and monitoring the exposure. Independence is preserved because the owner does not audit their own controls or set enterprise-level appetite.

Question 14Risk Management Framework and Governance

Which characteristic makes a key risk indicator most useful for governance monitoring?

  1. It is calculated only once at year end
  2. It is predictive and linked to a defined threshold that triggers action Correct answer.
  3. It is selected because the data is easy to collect
  4. It measures a metric that management cannot influence

Explanation

A useful key risk indicator provides early warning and is tied to thresholds that specify when escalation or action is required. Predictive linkage to the risk it monitors is what gives it governance value rather than mere descriptive interest.

Question 15Risk Management Framework and Governance

What is the primary role of a risk committee in the escalation process?

  1. Preparing the underlying data extracts used in risk reports
  2. Performing first-line control execution on behalf of business units
  3. Reviewing escalated exposures and directing decisions within delegated authority Correct answer.
  4. Conducting the independent assurance review of the risk function

Explanation

A risk committee receives escalations and makes or endorses decisions within its delegated authority, ensuring issues are resolved at the right level. Data preparation and control execution remain management responsibilities, and independent assurance sits with internal audit.

Question 16Risk Management Framework and Governance

An organization defines a risk taxonomy. What is the main governance benefit of doing so?

  1. It eliminates the requirement for internal audit coverage
  2. It guarantees that no risk will ever be realized
  3. It provides consistent categories so risks are aggregated and reported comparably Correct answer.
  4. It replaces the need for a risk appetite statement

Explanation

A taxonomy creates a common language so that risks from different units can be rolled up, compared, and reported consistently to the board. It supports aggregation and analysis but does not substitute for appetite setting or assurance.

Question 17Risk Management Framework and Governance

An organization uses a three-year strategic plan that assumes stable interest rates. Rates rise sharply and the plan is not updated. Which governance weakness does this most directly illustrate?

  1. Insufficient documentation of employee training records
  2. Excessive reliance on internal audit findings
  3. Overinvestment in control automation
  4. Failure to reassess risk assumptions when the external environment changes Correct answer.

Explanation

Risk management is a continuous process that must respond to changes in assumptions and the external environment. Leaving a strategy built on outdated assumptions in place means the risk profile is no longer accurately reflected to decision-makers.

Question 18Risk Management Framework and Governance

A business unit wants to launch a product that falls outside its approved risk limits. Under a sound governance framework, what should happen first?

  1. Launch and disclose the position at the next annual review
  2. Proceed because commercial opportunity always outweighs limits
  3. Reduce the recorded risk rating so the product falls within limits
  4. Seek formal approval through the delegated risk authority before launch Correct answer.

Explanation

Activities outside approved limits require explicit authorization from the body holding delegated authority, supported by an assessment of the exposure. Self-adjusting ratings or after-the-fact disclosure bypasses the control that limits are meant to provide.

Question 19Risk Management Framework and Governance

Which statement best describes the relationship between a risk framework and a control framework?

  1. The control framework replaces the need for risk assessment
  2. The risk framework sets direction while the control framework provides the means to treat risk Correct answer.
  3. The two frameworks are identical and interchangeable in practice
  4. The risk framework applies only after controls have failed

Explanation

The risk framework establishes how risk is identified, assessed, and governed, while the control framework supplies the specific mechanisms that reduce those risks. Effective governance links the two so each identified risk maps to controls and each control maps to a risk.

Question 20Risk Management Framework and Governance

An organization reports that a control is 'operating effectively' based solely on a walkthrough performed by the process owner. What is the main governance concern?

  1. Self-assessment by the owner lacks independent evidence of operating effectiveness Correct answer.
  2. Effectiveness conclusions require no supporting evidence at all
  3. Process owners are prohibited from describing their own processes
  4. Walkthroughs always produce more reliable evidence than sample testing

Explanation

Concluding that a control operates effectively requires objective evidence, such as testing a sample of instances over time, rather than the owner's own description of a single instance. Independence and sufficient evidence are both needed before such an assertion can be relied upon.

Question 21Risk Management Framework and Governance

A regulator requires the board to attest annually that the risk management framework is effective. Which activity most directly supports that attestation?

  1. Reviewing the marketing plan for the coming year
  2. Receiving evidence-based assurance over the design and operation of the framework Correct answer.
  3. Attending an industry conference on emerging technology
  4. Approving the travel and expense policy for staff

Explanation

An attestation of effectiveness must rest on documented, evidence-based assurance covering both design and operation of the framework. Other board activities may be worthwhile but do not provide the basis for a formal effectiveness statement.

Question 22Risk Management Framework and Governance

Two risks each score 16 on a 5x5 matrix. Risk A has high estimation uncertainty and a short lead time to impact; Risk B is well understood with a long lead time. How should a governance-minded analyst treat them?

  1. Reclassify Risk B as low risk to create separation
  2. Prioritize Risk A for closer monitoring despite the identical score Correct answer.
  3. Treat them as identical because the numeric scores match
  4. Deprioritize both because neither exceeds the maximum score

Explanation

Identical point scores can conceal very different urgency, because uncertainty and speed to impact affect how much time exists to respond. Governance should weight these factors so that fast-moving, poorly understood exposures receive closer attention.

Question 23Risk Management Framework and Governance

An organization's risk appetite statement says it has 'low tolerance for compliance breaches' but its sales incentive scheme rewards volume with no compliance weighting. What is the most significant governance issue?

  1. Compliance breaches should be removed from the risk register
  2. Incentive schemes are unrelated to risk management by definition
  3. The incentive structure conflicts with the stated appetite and undermines it Correct answer.
  4. The appetite statement is too short to be approved by the board

Explanation

When rewards encourage behavior contrary to the declared appetite, staff rationally follow the incentive and the statement loses credibility. Aligning performance and remuneration with risk objectives is a core governance expectation.

Question 24Risk Management Framework and Governance

A board delegates risk oversight to a committee but retains no reporting line back to the full board. What governance principle is most at risk?

  1. Timeliness of monthly bank reconciliations
  2. Accountability of the full board for oversight of the risk framework Correct answer.
  3. Accuracy of the fixed asset register
  4. Segregation of duties within the accounts payable team

Explanation

Delegation to a committee does not transfer the full board's ultimate accountability, which requires a clear reporting line and escalation path. Without that channel, the board cannot demonstrate effective oversight of the framework.

Question 25Risk Management Framework and Governance

An organization treats a risk by purchasing insurance but later discovers the policy excludes the exact scenario that occurred. What does this reveal about the treatment decision?

  1. Acceptance would have provided broader coverage than transfer
  2. The transfer was assumed without validating the policy terms against the risk Correct answer.
  3. Insurance transfer always eliminates residual risk completely
  4. The risk should never have been assessed in the first place

Explanation

Transfer only works to the extent the contract actually covers the identified scenario, so policy terms and exclusions must be verified against the risk description. Assuming coverage without that validation leaves the exposure effectively retained.

Question 26Risk Management Framework and Governance

Which document typically defines the boundaries within which management may accept risk while pursuing strategic objectives?

  1. The vendor onboarding checklist
  2. The business continuity plan
  3. The internal audit charter
  4. The risk appetite statement approved by the board Correct answer.

Explanation

A risk appetite statement is the board-approved articulation of how much risk the organization is willing to accept in pursuit of its objectives, and it sets boundaries for management decisions. Other documents support risk work but do not define the acceptable level of risk-taking.

Question 27Risk Management Framework and Governance

In a three-lines model, which group provides independent assurance over the effectiveness of risk management and controls?

  1. The first line, which owns and manages risk day to day
  2. The second line, which sets frameworks and monitors compliance
  3. The third line, which performs internal audit Correct answer.
  4. The external customer support function

Explanation

The third line, internal audit, provides independent and objective assurance to the board on the effectiveness of governance, risk management, and control. The first line owns risk and the second line provides oversight and challenge, so neither can supply independent assurance.

Question 28Risk Management Framework and Governance

Which statement best describes the purpose of a risk register in governance reporting?

  1. It guarantees that no identified risk will materialize
  2. It records identified risks with owners, ratings, and treatment status for tracking Correct answer.
  3. It replaces the need for board-level risk discussion
  4. It documents only risks that have already caused losses

Explanation

A risk register is a structured record of identified risks, typically capturing ownership, assessment ratings, controls, and treatment status so that risks can be monitored and reported. It supports governance oversight but does not eliminate risk or substitute for judgment.

Question 29Risk Management Framework and Governance

Which activity is the clearest example of the second line of defense performing its role?

  1. An external auditor issuing an opinion on the financial statements
  2. A compliance function issuing an enterprise risk policy and monitoring adherence Correct answer.
  3. An internal audit team testing control design and operating effectiveness
  4. A trading desk applying its own position limits during the day

Explanation

The second line designs risk frameworks, sets policy, and monitors whether the first line adheres to them, so a compliance function issuing policy and monitoring adherence fits that role. It provides oversight and challenge while remaining separate from day-to-day risk-taking.

Question 30Risk Management Framework and Governance

A firm's board approves a risk appetite statement, but business units continue to operate under limits set two years earlier that conflict with the new statement. Which governance weakness does this most directly illustrate?

  1. A breakdown in cascading risk appetite into operational limits Correct answer.
  2. Excessive reliance on quantitative modeling
  3. Insufficient internal audit coverage of financial reporting
  4. Overinvestment in risk training for front-line staff

Explanation

Risk appetite must be translated into delegated limits and thresholds that align with the board's statement; if legacy limits remain in force, the cascade from appetite to operations has failed. Governance requires periodic realignment of limits whenever appetite changes.

Question 31Risk Management Framework and Governance

A risk committee receives a quarterly report showing a key risk indicator has breached its threshold for the second consecutive period, but no action is recorded. What is the most appropriate governance response?

  1. Reassign the indicator to internal audit for resolution
  2. Wait for a third breach before taking action
  3. Remove the indicator from the report to avoid recurring breaches
  4. Require the risk owner to present a remediation plan with dates and escalate to the board Correct answer.

Explanation

A threshold breach is a trigger for action, and repeated breaches without response indicate weak escalation discipline. The committee should require an owned remediation plan with timelines and ensure the board is informed, since unresolved breaches signal appetite may be exceeded.

Question 32Risk Management Framework and Governance

An organization adopts a new enterprise risk framework but issues no guidance on how business units should apply it. Which outcome is most likely?

  1. Immediate reduction in the organization's inherent risk profile
  2. Automatic alignment of risk appetite with operational limits
  3. Inconsistent application and uneven risk reporting across units Correct answer.
  4. Consistent implementation across all units because the framework is self-explanatory

Explanation

A framework provides structure, but consistent use depends on supporting guidance, training, and templates that translate principles into practice. Without that support, units interpret requirements differently, producing inconsistent assessments and reports that hamper comparability.

Question 33Risk Management Framework and Governance

Which factor most strengthens the independence of a chief risk officer's reporting line?

  1. Reporting jointly to the sales and marketing directors
  2. Reporting to the internal audit director
  3. Reporting directly to the board risk committee with administrative line to the chief executive Correct answer.
  4. Reporting to the head of the largest revenue-generating division

Explanation

Independence is reinforced when the chief risk officer has a direct reporting line to a board-level committee, ensuring risk concerns reach the board without being filtered by business interests. An administrative line to the chief executive preserves operational practicality while the board link protects objectivity.

Question 34Risk Management Framework and Governance

An organization's risk policy states that all high-rated risks must be reported to the board quarterly. A business unit re-rates a high risk as medium without documented justification shortly before reporting. What control weakness is most evident?

  1. The risk assessment methodology uses too many rating levels
  2. Changes to risk ratings lack documented rationale and challenge Correct answer.
  3. The board receives reports too frequently
  4. The policy requires too few risk categories

Explanation

Rating changes are consequential because they determine escalation and reporting, so they should require documented rationale and independent challenge. An undocumented downgrade just before reporting creates a risk of under-reporting to the board and undermines the integrity of the escalation process.

Question 35Risk Management Framework and Governance

Which practice best supports board oversight of emerging risks that are not yet captured in historical loss data?

  1. Relying solely on backward-looking incident statistics
  2. Restricting board risk discussions to audited financial figures
  3. Scheduling periodic horizon-scanning discussions with management and external input Correct answer.
  4. Delegating all emerging risk assessment to front-line staff without reporting

Explanation

Emerging risks by definition lack historical loss data, so oversight depends on forward-looking horizon scanning, scenario discussion, and diverse external input. Structured board dialogue allows directors to challenge management's assumptions before risks crystallize.

Question 36Risk Management Framework and Governance

A board risk committee has 12 members, meets twice a year, and its agenda is dominated by routine compliance updates. Which change would most improve its effectiveness?

  1. Reducing membership to a focused size, meeting more often, and prioritizing principal and emerging risks Correct answer.
  2. Increasing membership to 16 to broaden representation
  3. Delegating the agenda entirely to the external auditor
  4. Replacing all risk content with a review of prior meeting minutes

Explanation

Committee effectiveness depends on a workable size, sufficient meeting frequency, and an agenda focused on the organization's principal and emerging risks rather than routine updates. A smaller, more focused committee with a risk-centric agenda can deliberate and challenge management meaningfully.

Question 37Risk Management Framework and Governance

An organization's risk appetite is expressed only as a qualitative statement that it is 'conservative'. Which consequence most directly impairs governance?

  1. Risk training becomes mandatory for all employees
  2. Managers cannot determine whether specific exposures fall within acceptable bounds Correct answer.
  3. The board must approve the statement annually
  4. The statement becomes legally binding on customers

Explanation

Qualitative appetite statements need quantification or clear thresholds to guide decisions; otherwise managers cannot judge whether a given exposure is acceptable. Without measurable boundaries, limit-setting, monitoring, and escalation lose their reference point.

Question 38Risk Management Framework and Governance

A subsidiary operates under a group risk framework, but local regulators require additional capital buffers and stricter reporting. How should the subsidiary's governance adapt?

  1. Ignore local requirements because the group framework takes precedence
  2. Seek an exemption from all group risk policies
  3. Adopt only local requirements and abandon group reporting
  4. Apply the stricter of group and local requirements and document the rationale Correct answer.

Explanation

Where local regulation is stricter than group policy, the subsidiary must comply with the more demanding standard while still meeting group obligations. Documenting the reconciliation preserves both regulatory compliance and group-level consistency.

Question 39Risk Management Framework and Governance

A board delegates detailed risk oversight to a committee, but the committee's charter is silent on reporting back to the full board. What is the most significant governance consequence?

  1. The organization must dissolve the committee immediately
  2. The committee automatically loses its authority to review risks
  3. Management gains direct control over board agendas
  4. The full board may lack the information needed to discharge its oversight duty Correct answer.

Explanation

Delegation does not transfer the full board's ultimate oversight responsibility, so a clear reporting line back to the board is essential. Without it, directors cannot challenge or act on risk information and may fail in their fiduciary duties.

Question 40Risk Management Framework and Governance

An organization's risk framework requires annual risk assessments, but a major acquisition significantly changes its exposure profile mid-year. What is the soundest governance action?

  1. Keep the existing assessment because the methodology is unchanged
  2. Suspend risk reporting until the acquisition is fully integrated
  3. Wait until the next scheduled annual cycle to reassess
  4. Trigger an out-of-cycle reassessment of affected risks and update limits and reporting Correct answer.

Explanation

Risk frameworks should include triggers for reassessment when significant changes occur, such as acquisitions, so that ratings, limits, and reporting reflect current exposure. A purely calendar-driven cycle leaves the board overseeing stale information during periods of elevated change.

Question 41Risk Identification and Assessment

In enterprise risk management, which term describes the level of risk remaining after controls and mitigations have been applied?

  1. Residual risk Correct answer.
  2. Risk capacity
  3. Risk appetite
  4. Inherent risk

Explanation

Residual risk is the exposure that persists once existing controls and mitigation measures are in place. It is what the organization actually carries and should be compared against tolerance limits when reporting to management.

Question 42Risk Identification and Assessment

A risk register entry records likelihood as 4 and impact as 5 on a 1-5 scale, and the matrix multiplies the two values. What is the resulting risk score?

  1. 9
  2. 20 Correct answer.
  3. 25
  4. 16

Explanation

A multiplicative scoring matrix combines likelihood and impact by multiplying them, so 4 multiplied by 5 gives 20. This score is then mapped to a rating band that drives escalation and treatment decisions.

Question 43Risk Identification and Assessment

Which statement best describes the purpose of a risk appetite statement?

  1. It lists every identified risk with its owner
  2. It records the audit findings from the previous year
  3. It defines how much risk the organization is willing to accept in pursuit of objectives Correct answer.
  4. It specifies the insurance policies the firm must buy

Explanation

A risk appetite statement articulates the amount and type of risk the organization is willing to accept to achieve its objectives. It guides decision-making and provides a benchmark against which actual exposure is judged.

Question 44Risk Identification and Assessment

An analyst classifies a supplier's financial failure as a risk. Which risk category does this most directly represent?

  1. Compliance risk
  2. Operational risk
  3. Strategic risk
  4. Credit or counterparty risk Correct answer.

Explanation

Counterparty or credit risk arises when another party fails to meet its financial obligations, such as a supplier becoming insolvent. Operational risk concerns failed processes or people, and strategic risk concerns business direction.

Question 45Risk Identification and Assessment

What is the primary role of a risk owner?

  1. To independently audit the risk management program
  2. To calculate actuarial loss distributions
  3. To set the organization's overall risk appetite
  4. To hold accountability for managing a specific risk and its response Correct answer.

Explanation

A risk owner is accountable for a specific risk, including monitoring it and ensuring an appropriate response is executed. Ownership assigns responsibility so that risks are not left unmanaged between functions.

Question 46Risk Identification and Assessment

Which technique gathers a group of experts to reach consensus on risk estimates through multiple anonymous questionnaire rounds?

  1. Delphi technique Correct answer.
  2. Monte Carlo simulation
  3. Root cause analysis
  4. Bow-tie analysis

Explanation

The Delphi technique uses repeated anonymous rounds of expert input with controlled feedback until estimates converge. Anonymity reduces the influence of dominant personalities and status effects during estimation.

Question 47Risk Identification and Assessment

In a bow-tie diagram, what do the elements on the left side of the central event represent?

  1. Residual risk ratings
  2. Threats and their preventive barriers Correct answer.
  3. Consequences of the event
  4. Detection controls only

Explanation

The left side of a bow-tie shows threats that could cause the central event, along with preventive barriers that block them. The right side shows consequences and mitigating or recovery barriers.

Question 48Risk Identification and Assessment

Which of the following is a key characteristic of a key risk indicator (KRI)?

  1. It replaces the need for a risk register
  2. It is set exclusively by external regulators
  3. It is forward-looking and tracks exposure against thresholds Correct answer.
  4. It is measured only after a loss event occurs

Explanation

A KRI is a metric designed to give early warning of rising risk exposure and is monitored against defined thresholds. Effective KRIs are predictive and tied to the drivers of the risk they monitor.

Question 49Risk Identification and Assessment

A firm uses a heat map that plots risks by likelihood and impact. A risk sitting in the top-right corner should generally be treated how?

  1. Accepted without further action
  2. Prioritized for immediate treatment and escalation Correct answer.
  3. Monitored annually with no owner
  4. Removed from the register

Explanation

The top-right region represents high likelihood and high impact, which exceeds most appetite thresholds. Such risks warrant priority treatment and escalation to senior management or the board.

Question 50Risk Identification and Assessment

A team assesses a risk as high severity but very low frequency. Which approach is most appropriate for the analysis?

  1. Treat it as an operational loss already incurred
  2. Reduce the impact rating to match the frequency
  3. Ignore the risk because it is unlikely
  4. Model it using frequency-severity analysis and scenario stress testing Correct answer.

Explanation

Rare but severe risks are poorly captured by historical averages, so scenario analysis and frequency-severity modeling are used. Stress testing explores the consequences if the event occurs despite its low probability.