I85PREP
⌘ K
CA ANZ Core 2: Risk, Technology and AI study materials
CA ANZ Core 2: Risk, Technology and AI study resources

CA ANZ Core 2: Risk, Technology and AI practice questions

One question at a time. Build your CA ANZ Core 2: Risk, Technology and AI understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk management concepts, frameworks and risk assessment

In risk management terminology, which statement best describes "risk"?

  1. The cost of transferring an exposure to an insurer or other third party
  2. The probability that a hazard will cause physical harm to people or property
  3. Any event that has already caused a measurable financial loss
  4. The effect of uncertainty on objectives Correct answer.

Explanation

Risk is defined in frameworks such as ISO 31000 and COSO ERM as the effect of uncertainty on objectives, and that effect can be positive as well as negative. Because the definition is objective-centred, uncertainty only becomes risk where there is an objective whose achievement may deviate.

Question 2Risk management concepts, frameworks and risk assessment

Which statement best describes an entity's risk appetite?

  1. The process of purchasing insurance to cover identified insurable events
  2. The amount and type of risk an entity is willing to pursue or retain Correct answer.
  3. The documented list of identified risks with their owners and current ratings
  4. The maximum loss the entity could survive without becoming insolvent

Explanation

Risk appetite is set by the governing body and states the amount and type of risk the entity is willing to pursue or retain in pursuit of its objectives. It is expressed in qualitative and quantitative terms and is then translated into tolerance limits and delegated authorities that operational staff apply day to day.

Question 3Risk management concepts, frameworks and risk assessment

Which risk treatment option involves sharing risk with a third party?

  1. Avoidance, by exiting the activity that gives rise to the exposure
  2. Sharing, by insurance or contractual transfer to a third party Correct answer.
  3. Reduction, by applying controls that lower likelihood or consequence
  4. Acceptance, by retaining the exposure without further action and monitoring it

Explanation

Risk sharing passes part of the exposure, and often part of the potential upside, to another party through insurance, contractual indemnities, joint ventures or outsourcing. The entity usually retains some of the exposure, for example through deductibles, exclusions or the risk of counterparty failure.

Question 4Risk management concepts, frameworks and risk assessment

A risk is rated at likelihood 4 and consequence 5 before controls. Existing controls reduce the likelihood to 2 and the consequence to 4. The board has set a risk appetite threshold of 6, above which escalation is required. What is the residual score and the appropriate response?

  1. 6, because residual risk always equals the stated appetite once controls are applied
  2. 8, which exceeds appetite, so further treatment or escalation is required Correct answer.
  3. 8, which is within appetite, so no further treatment is needed
  4. 20, which exceeds appetite and must be reported to the board as the inherent score

Explanation

Residual risk is the exposure remaining after controls and is calculated here as 2 x 4 = 8, which sits above the stated appetite of 6. Any residual exposure above appetite must be escalated to the accountable risk owner and treated further, rather than being reported as an acceptable position.

Question 5Risk management concepts, frameworks and risk assessment

A monthly reconciliation of the accounts payable ledger to supplier statements is best classified as which type of control?

  1. A preventive control that stops errors before they are recorded
  2. A corrective control that repairs errors after they are detected
  3. A detective control Correct answer.
  4. A directive control that instructs staff on how to process payments

Explanation

Detective controls identify errors or irregularities after they have occurred; a reconciliation discovers differences and triggers follow-up action. Preventive controls act before or during processing, corrective controls remediate a problem once identified, and directive controls guide behaviour rather than detect failures.

Question 6Risk management concepts, frameworks and risk assessment

A risk committee plots each identified risk on a 5x5 heat map and concludes that, because no single risk exceeds appetite, the aggregate risk position is acceptable. What is the main weakness in this conclusion?

  1. Heat maps cannot represent likelihood at all, so the conclusion about aggregate risk is unsupported
  2. It ignores correlation, so individually acceptable risks may combine into an unacceptable aggregate Correct answer.
  3. Aggregating individual risks always double-counts the controls that are shared between those risks
  4. Heat maps are purely quantitative tools, so qualitative judgement should never be applied when using them

Explanation

A heat map displays risks one at a time and reveals nothing about correlation, concentration or shared root causes. Aggregation requires explicit analysis of dependencies, because several exposures each within appetite can crystallise simultaneously and produce a combined loss the entity could not absorb.

Question 7Risk management concepts, frameworks and risk assessment

A manufacturer wants a key risk indicator for supply chain disruption. Which measure best qualifies as a key risk indicator?

  1. The number of active suppliers recorded in the vendor master file
  2. The number of purchase orders raised during the last quarter
  3. Total procurement spend for the financial year to date
  4. The percentage of critical components sourced from a single supplier Correct answer.

Explanation

A key risk indicator must be measurable, forward-looking and closely linked to a specific risk, with thresholds that trigger escalation. Supplier concentration directly drives disruption exposure, whereas spend and transaction volumes describe the scale of activity rather than the likelihood or impact of the risk event.

Question 8Risk management concepts, frameworks and risk assessment

Under the Three Lines Model, which function provides independent assurance to the governing body over the effectiveness of risk management and internal control?

  1. The external auditor, which expresses an opinion on the financial report
  2. The risk and compliance function, which sets the risk framework and challenges the business
  3. Operational management, which owns and manages the risk day to day
  4. Internal audit, which provides independent assurance to the governing body Correct answer.

Explanation

In the Three Lines Model the first line owns and manages risk, the second line provides expertise, oversight and challenge, and internal audit as the third line gives independent assurance to the governing body. External audit sits outside the model and reports under auditing standards on the financial report.

Question 9Risk management concepts, frameworks and risk assessment

Two business units each hold a portfolio with a 1% probability of a $10 million loss. If the losses are perfectly positively correlated, how does aggregate risk compare with the position assumed under independence?

  1. Lower, because combining two portfolios always reduces total risk through the offsetting of independent exposures
  2. Unchanged, because expected loss is simply additive across portfolios regardless of how the losses are correlated
  3. Lower, because correlation between portfolios affects only the timing of losses and never their aggregate size
  4. Higher, because perfectly correlated losses occur together and offer no diversification benefit Correct answer.

Explanation

When losses are perfectly positively correlated the exposures add without any offset, so the entity faces the possibility of both losses occurring in the same period. Diversification benefit arises only where exposures are less than perfectly correlated, which is why correlation assumptions materially change economic capital and aggregate appetite testing.

Question 10Risk management concepts, frameworks and risk assessment

An organisation records 40 near misses in a quarter but no actual losses, and management concludes that its controls are effective. Which interpretation is most appropriate?

  1. Because no losses occurred, the risk that generated the near misses has effectively been eliminated
  2. Encouraging near-miss reporting inflates recorded incident rates and should be discouraged in a mature risk culture
  3. Near misses should be excluded from the risk register because they overstate the organisation's actual exposure
  4. A rising trend of near misses may signal weakening controls and warrants root-cause investigation Correct answer.

Explanation

Near misses are unwanted events that did not cause harm and are a leading indicator of control weakness. A cluster or rising trend should trigger root-cause analysis and control improvement even though no loss has yet been recorded, because the same causal chain may produce a loss next time.

Question 11Risk management concepts, frameworks and risk assessment

In the ISO 31000 risk management process, which activity is performed when establishing 'scope, context and criteria'?

  1. Assigning an owner to each risk in the register
  2. Testing whether controls operated as designed throughout the period
  3. Reporting aggregated risk exposures to the board
  4. Defining the external and internal environment and the basis for evaluating risk Correct answer.

Explanation

Scope, context and criteria define the boundaries of the risk management process, the external and internal environment, and the basis on which risks will be evaluated. These elements are established before risks are identified and analysed, so later steps such as control testing and reporting depend on them. Assigning owners and testing controls occur after this step.

Question 12Risk management concepts, frameworks and risk assessment

Which statement best describes the role of a risk owner?

  1. A person accountable for managing a specific risk within assigned authority Correct answer.
  2. A person who provides external assurance over the risk framework
  3. A person who independently audits controls and reports to the board
  4. A person who records incidents and maintains the risk register only

Explanation

A risk owner is accountable for managing an assigned risk, including selecting and monitoring treatments within delegated authority. The role is about ownership and decision-making, not independent assurance or clerical register maintenance. Independence is provided by assurance functions, while the register is a tool the owner uses.

Question 13Risk management concepts, frameworks and risk assessment

Which statement best describes risk capacity?

  1. The amount of risk an entity is willing to accept in pursuit of objectives
  2. The maximum risk an entity can bear before breaching its obligations or viability Correct answer.
  3. The level of risk remaining after controls are applied
  4. The process of transferring risk to an insurer

Explanation

Risk capacity is the maximum risk an entity can bear before it breaches obligations, threatens viability, or suffers unacceptable harm. It is distinct from risk appetite, which is the amount of risk the entity is willing to accept in pursuing objectives. Capacity is a constraint; appetite is a choice within that constraint.

Question 14Risk management concepts, frameworks and risk assessment

A risk team asks experts to submit anonymous estimates of the likelihood of a cyber outage over three rounds, sharing only summarised results between rounds. Which technique is being used?

  1. Fault tree analysis
  2. Delphi technique Correct answer.
  3. Monte Carlo simulation
  4. Control self-assessment

Explanation

The Delphi technique gathers expert judgements through anonymous, iterative rounds with controlled feedback. Anonymity reduces dominance and group pressure, and iteration allows estimates to converge. Fault tree analysis, control self-assessment and Monte Carlo simulation do not rely on anonymous multi-round expert consensus.

Question 15Risk management concepts, frameworks and risk assessment

In a bow-tie analysis, what is the role of barriers placed on the left side of the top event?

  1. They reduce the severity of consequences after the top event
  2. They record the residual risk accepted by the board
  3. They estimate the financial loss from the top event
  4. They prevent or reduce the likelihood of causes leading to the top event Correct answer.

Explanation

In a bow-tie diagram, the top event is the central risk event. Barriers on the left act on causes to prevent or reduce the likelihood of the top event, while barriers on the right mitigate consequences after it occurs. The diagram links causes, preventive controls, the event, mitigating controls and consequences.

Question 16Risk management concepts, frameworks and risk assessment

An internal auditor selects a sample of purchase orders and finds that the required second approval was obtained on 92 of 100 items. The auditor is testing which attribute of the control?

  1. Design effectiveness
  2. Operating effectiveness Correct answer.
  3. Risk appetite
  4. Inherent risk

Explanation

Operating effectiveness concerns whether a control operated consistently and as intended throughout the period under review. Design effectiveness concerns whether the control, as designed, is capable of addressing the risk. Sampling transactions and finding missing approvals tests actual operation, not design or risk appetite.

Question 17Risk management concepts, frameworks and risk assessment

After treatment, a risk's assessed residual exposure remains above the board-approved tolerance. What is the most appropriate next step?

  1. Record the risk as accepted and take no further action
  2. Escalate for a decision on further treatment or acceptance Correct answer.
  3. Remove the risk from the register because controls exist
  4. Lower the likelihood score to fit within tolerance

Explanation

Residual risk that remains above approved tolerance cannot simply be accepted at the operational level. It must be escalated to the authority with power to approve additional treatment or formally accept the exposure, consistent with governance requirements. Adjusting scores to fit tolerance would misstate the risk.

Question 18Risk management concepts, frameworks and risk assessment

A board asks management to model several plausible but uncertain future states, such as a prolonged supply disruption or a rapid regulatory change, to challenge strategic assumptions. This activity is best described as:

  1. Root cause analysis
  2. Scenario analysis Correct answer.
  3. Control testing
  4. Risk transfer

Explanation

Scenario analysis explores plausible future states and their implications to challenge assumptions and inform strategy and risk responses. It is forward-looking and does not test whether existing controls operated. Control testing, risk transfer and root cause analysis address different questions.

Question 19Risk management concepts, frameworks and risk assessment

A procurement officer with significant personal debt bypasses a vendor master file control to create a fictitious supplier. Which fraud triangle elements are most directly evident?

  1. Pressure, opportunity and rationalisation
  2. Pressure and rationalisation
  3. Pressure and opportunity Correct answer.
  4. Opportunity and rationalisation

Explanation

The fraud triangle comprises pressure or incentive, opportunity, and rationalisation. Personal debt supplies pressure, and the ability to bypass a vendor control supplies opportunity. The scenario does not state a belief or justification that would evidence rationalisation.

Question 20Risk management concepts, frameworks and risk assessment

Two risks receive the same score on a 5x5 heat map, but one has a much wider range of plausible outcomes. Which limitation of the heat map does this best illustrate?

  1. Ordinal scoring can hide differences in uncertainty and consequence range Correct answer.
  2. It requires perfect correlation between risk events
  3. It cannot compare risks with different owners
  4. It eliminates the need for management judgement

Explanation

Heat maps commonly use ordinal scales that combine likelihood and consequence into a single rating. Risks with the same rating can differ materially in uncertainty, outcome range and controllability, so the score can obscure distinctions relevant to prioritisation. The map does not require perfect correlation or remove the need for judgement.

Question 21Risk management concepts, frameworks and risk assessment

A chemical manufacturer is introducing a new continuous production process and wants a structured technique that examines each node of the process for deviations from design intent and identifies the associated hazards. Which risk identification technique is most appropriate?

  1. Control self-assessment
  2. Delphi technique
  3. HAZOP Correct answer.
  4. Root cause analysis

Explanation

HAZOP is a structured, team-based technique that systematically examines deviations from design intent at each node of a process to identify hazards and operability issues. Delphi gathers expert consensus, root cause analysis examines causes after an event, and control self-assessment evaluates controls rather than process hazards.

Question 22Risk management concepts, frameworks and risk assessment

In business continuity planning, what does a recovery time objective (RTO) represent?

  1. The period for which a backup site can operate before resupply
  2. The cost that the organisation is willing to incur to recover
  3. The target time to restore a process after disruption Correct answer.
  4. The maximum volume of data that may be lost without material harm

Explanation

The RTO is the target elapsed time within which a business process or system must be restored after a disruption, based on the tolerable period of downtime. It is expressed as time, not as data loss, endurance, or recovery cost.

Question 23Risk management concepts, frameworks and risk assessment

A payments company decides not to launch a new product in a country where it cannot obtain the required licence within its risk appetite. Which risk treatment option has it applied?

  1. Accept
  2. Avoid Correct answer.
  3. Reduce
  4. Transfer

Explanation

Avoidance eliminates the exposure by not undertaking the activity that creates the risk. Transfer shifts consequences to another party, reduction lowers likelihood or impact while proceeding, and acceptance retains the exposure.

Question 24Risk management concepts, frameworks and risk assessment

Which is the best-written entry for a risk register?

  1. The payment system may fail, which would be bad for customers and would reduce revenue significantly.
  2. Because one administrator can approve vendor changes, a fraudulent vendor could be paid. Correct answer.
  3. Cyber risk is high because attacks are increasing, and the board has expressed concern about this area.
  4. There is a risk that staff make mistakes in the new billing system, which is a concern.

Explanation

A well-formed risk statement links a cause, an event, and a consequence, making the risk specific and assessable. The other entries are vague, omit a clear cause, or describe a rating and concern rather than a risk event.

Question 25Risk management concepts, frameworks and risk assessment

After a failed production batch is detected, a manufacturer quarantines the affected output and reprocesses it to meet specification. Which type of control is the quarantine and rework activity?

  1. Detective
  2. Directive
  3. Corrective Correct answer.
  4. Preventive

Explanation

Corrective controls act after an undesirable event has been detected to contain or remediate its effects and restore the process. Preventive controls stop occurrence, directive controls guide behaviour, and detective controls identify that an event has occurred.

Question 26Risk management concepts, frameworks and risk assessment

A bank's business units complete structured questionnaires each quarter to assess the design and operation of their own key controls, and internal audit later reviews a sample of the results. This practice is best described as:

  1. Control self-assessment Correct answer.
  2. Continuous auditing
  3. A walkthrough test
  4. A substantive test of transactions

Explanation

Control self-assessment is a structured process in which process owners evaluate their own controls and identify gaps, often with independent validation by audit or risk functions. It is not a transaction test, a walkthrough, or continuous monitoring.

Question 27Risk management concepts, frameworks and risk assessment

Before onboarding a critical cloud service provider, a company reviews the provider's security certifications, financial stability, incident history, and tested recovery arrangements. This activity is best described as:

  1. Control self-assessment
  2. Residual risk acceptance
  3. Third-party risk due diligence Correct answer.
  4. Risk transfer through outsourcing

Explanation

Third-party risk due diligence evaluates a provider's ability and controls before entering or continuing a relationship, covering security, financial, operational, and continuity factors. Outsourcing does not by itself transfer accountability, and acceptance occurs after assessment.

Question 28Risk management concepts, frameworks and risk assessment

A risk has an estimated 10% probability of occurring in the next year. If it occurs, the estimated loss is $2 million. Using a simple expected-loss calculation, what is the annual expected loss?

  1. $20,000
  2. $1,800,000
  3. $200,000 Correct answer.
  4. $2,000,000

Explanation

Expected loss equals probability multiplied by impact: 0.10 multiplied by $2,000,000 equals $200,000. It is a long-run average, not a prediction that the loss will be exactly that amount.

Question 29Risk management concepts, frameworks and risk assessment

After a widely publicised cyberattack on a peer company, managers sharply increase their estimate of the likelihood of a similar attack on their own organisation, despite no change in its controls or threat profile. Which cognitive bias most likely explains this adjustment?

  1. Confirmation
  2. Hindsight
  3. Anchoring
  4. Availability Correct answer.

Explanation

Availability bias occurs when recent, vivid, or easily recalled events are judged more probable than they are. Anchoring involves over-reliance on an initial value, confirmation involves seeking supporting evidence, and hindsight is the belief after an outcome that it was predictable.

Question 30Risk management concepts, frameworks and risk assessment

A risk team uses a Monte Carlo simulation to model aggregate operational losses. Which statement best describes a key limitation of this technique?

  1. It cannot combine risks that have different probability distributions.
  2. It removes the need to validate the model with historical loss data.
  3. Its reliability depends on the assumed distributions and dependencies. Correct answer.
  4. It always overstates tail risk because random sampling excludes extreme events.

Explanation

Monte Carlo simulation generates outcomes from specified distributions and dependency assumptions, so poor or biased inputs can produce misleading output even when the mathematics is sound. It does not replace validation, back-testing, or expert judgement.

Question 31Risk management concepts, frameworks and risk assessment

Which statement best distinguishes risk appetite from risk tolerance?

  1. Appetite is the maximum loss the entity can survive; tolerance is the risk it prefers to take.
  2. Appetite is the risk the entity will pursue for reward; tolerance is the acceptable variation around a specific limit. Correct answer.
  3. Appetite applies only to financial risks; tolerance applies to all risks.
  4. Appetite is set by regulators; tolerance is set by the board.

Explanation

Risk appetite sets the amount and type of risk an organisation is willing to accept in pursuit of its objectives. Risk tolerance translates that appetite into acceptable variation around specific limits or metrics. Appetite sets direction, while tolerance provides operational boundaries for monitoring and escalation.

Question 32Risk management concepts, frameworks and risk assessment

A risk is assessed at its gross level before existing controls are considered, then reassessed after those controls are applied. What do the two assessments represent?

  1. Inherent risk and residual risk Correct answer.
  2. Control design and control operation
  3. Likelihood and consequence
  4. Risk capacity and risk appetite

Explanation

Inherent risk is assessed before considering the effect of existing controls. Residual risk is the exposure remaining after those controls are applied. Comparing the two helps show how much reliance is placed on controls and where further treatment may be needed.

Question 33Risk management concepts, frameworks and risk assessment

Which feature makes a measure suitable for use as a key risk indicator (KRI)?

  1. It is selected because it is easy to calculate, regardless of its link to a risk.
  2. It is predictive, measurable and linked to a specific risk with defined thresholds. Correct answer.
  3. It is reviewed annually by the external auditor.
  4. It is reported only after a loss event has occurred.

Explanation

A useful KRI is quantifiable, linked to a defined risk, and able to signal rising exposure before a loss occurs. Defined thresholds allow management to escalate when the indicator moves outside tolerance. Easy calculation alone does not make a measure a KRI.

Question 34Risk management concepts, frameworks and risk assessment

In the Three Lines Model, which function provides independent assurance to the governing body on the effectiveness of risk management and internal control?

  1. The risk and compliance function advising and monitoring the first line
  2. Operational management owning and managing risk day to day
  3. Internal audit Correct answer.
  4. The external auditor expressing an opinion on the financial statements

Explanation

The Three Lines Model places operational management in the first line, risk and compliance in the second, and internal audit in the third. Internal audit provides independent, objective assurance to the governing body. External audit serves a different purpose, reporting on the financial statements.

Question 35Risk management concepts, frameworks and risk assessment

A company buys insurance that pays cyber losses above a $5 million deductible, while it funds losses below that amount itself. What is the primary risk treatment for the insured layer?

  1. Reduction
  2. Avoidance
  3. Transfer Correct answer.
  4. Acceptance

Explanation

Insurance transfers the financial consequence of the insured layer to the insurer in exchange for a premium. The deductible means the company retains the lower layer, but the primary treatment of the insured layer is transfer. Avoidance would mean not undertaking the activity, and reduction would lower the likelihood or impact.

Question 36Risk management concepts, frameworks and risk assessment

Why should an organisation define likelihood and consequence scales before assessors score risks?

  1. To satisfy external reporting requirements without further review
  2. To promote consistent and comparable ratings across assessors and periods Correct answer.
  3. To remove the need for management judgement in scoring
  4. To ensure every risk receives the same rating

Explanation

Defined scales give assessors a common language for judging likelihood and consequence. This improves consistency, comparability and the reliability of risk rankings over time. It does not eliminate judgement or force every risk to receive the same score.

Question 37Risk management concepts, frameworks and risk assessment

Which board behaviour most directly strengthens an organisation's risk culture?

  1. Approving every operational decision regardless of size
  2. Challenging management's risk views and rewarding prudent risk-taking Correct answer.
  3. Delegating risk oversight to the external auditor
  4. Setting limits only after a significant loss has occurred

Explanation

Risk culture is shaped by what leaders pay attention to, challenge and reward. Directors who question risk assessments and link incentives to prudent risk-taking reinforce the message that risk management matters. Delegating oversight or acting only after losses weakens that signal.

Question 38Risk management concepts, frameworks and risk assessment

Two business lines each have a 1% annual chance of a $10 million operational loss, and their losses are positively correlated in stress conditions. Compared with assuming independence, what is the main effect on the aggregate risk assessment?

  1. The combined expected loss falls because of diversification.
  2. The combined expected loss is higher than under independence, while tail loss is unchanged.
  3. Correlation affects neither expected loss nor tail loss.
  4. Tail loss is higher, while expected loss is broadly unchanged. Correct answer.

Explanation

Expected loss is the probability-weighted average and remains broadly additive regardless of correlation. Positive correlation increases the chance that large losses occur together, so the aggregate tail loss is higher than under an independence assumption. Diversification benefits are therefore reduced in stress conditions.

Question 39Risk management concepts, frameworks and risk assessment

A manufacturer maps how a single supplier failure could halt production, which could then delay a regulatory filing and damage customer trust. Which risk assessment concept does this sequence best illustrate?

  1. Residual risk after controls
  2. Risk appetite calibration
  3. Control design deficiency
  4. Cascading and interconnected risk Correct answer.

Explanation

Cascading risk occurs when one event triggers secondary events that may be more damaging than the original failure. Mapping these dependencies helps assess risks that are connected rather than isolated. It supports more complete scenario planning and treatment prioritisation.

Question 40Risk management concepts, frameworks and risk assessment

A team is identifying risks for a new online service. Which approach best reduces the chance of important risks being missed?

  1. Reviewing only risks that have caused losses in the past year
  2. Relying on the project sponsor's list of known technical issues
  3. Asking the IT vendor to confirm that no risks exist
  4. Running a cross-functional workshop using structured risk categories and external data Correct answer.

Explanation

Risk identification is stronger when it draws on varied perspectives and a structured prompt list. Cross-functional workshops help surface operational, legal, technology and people risks that one sponsor may overlook. External data can challenge assumptions and reveal risks seen elsewhere.

Question 41Governance, ethics and professional obligations in a technology-enabled environment

Which fundamental principle of the Code of Ethics requires a member to respect the confidentiality of information acquired through professional and business relationships?

  1. Confidentiality Correct answer.
  2. Objectivity
  3. Integrity
  4. Professional behaviour

Explanation

The confidentiality principle requires members to respect the confidentiality of information acquired through professional and business relationships and, subject to limited exceptions, not to disclose it without proper authority. It also prohibits using that information for the member's personal advantage or that of a third party.

Question 42Governance, ethics and professional obligations in a technology-enabled environment

An entity is deploying an AI system that will make credit decisions affecting customers. Which party retains ultimate responsibility for oversight of that system's risks and ethical use?

  1. The external audit partner engaged by the entity
  2. Those charged with governance of the entity Correct answer.
  3. The data science team that built the model
  4. The vendor that supplied the AI platform

Explanation

Governance requirements place ultimate responsibility for risk oversight, including technology and AI risk, on the board or equivalent governing body. Vendors and internal technical teams design and operate the system, but accountability for how the entity uses AI cannot be delegated to them.

Question 43Governance, ethics and professional obligations in a technology-enabled environment

Which Australian Privacy Principle requires an entity to take reasonable steps to protect personal information it holds from misuse, interference, loss and unauthorised access, modification or disclosure?

  1. APP 11 – security of personal information Correct answer.
  2. APP 12 – access to personal information
  3. APP 3 – collection of solicited personal information
  4. APP 6 – use and disclosure of personal information

Explanation

APP 11 imposes the security obligation, requiring reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It also requires destruction or de-identification of information no longer needed, which is directly relevant when data is held in cloud or analytics environments.

Question 44Governance, ethics and professional obligations in a technology-enabled environment

A member wants to paste a client's confidential supplier contract into a free public generative AI chatbot to obtain a summary. Which action best satisfies the member's professional obligations?

  1. Paste it only if a senior manager reviews the resulting summary before use.
  2. Paste it, since summarising a document is not a disclosure of client information.
  3. Use a firm-approved tool with confidentiality protections, or de-identify the data first. Correct answer.
  4. Paste it, because the chatbot does not store or reuse the prompts it receives.

Explanation

The confidentiality principle continues to apply to information entered into technology tools, so client information should not be submitted to services the firm has not assessed and approved. Firms should use vetted tools with contractual confidentiality and data-handling protections and should de-identify information wherever possible. Disclosure to a third-party provider is appropriate only with proper authority, such as informed client consent.

Question 45Governance, ethics and professional obligations in a technology-enabled environment

An audit firm proposes to design, implement and operate an AI system that calculates and posts an audit client's revenue accruals. Which threat to independence arises most directly?

  1. Advocacy threat
  2. Self-review threat Correct answer.
  3. Familiarity threat
  4. Intimidation threat

Explanation

Designing and operating a system that produces figures the firm will later audit creates a self-review threat, because the firm would be evaluating outputs it created itself. Such an engagement also risks assuming management responsibility, which the Code does not permit for an audit client.

Question 46Governance, ethics and professional obligations in a technology-enabled environment

A junior analyst accepts a valuation produced by a machine-learning model without testing its assumptions, reasoning that the model has performed well historically. Which professional failure does this most directly illustrate?

  1. Advocacy for a client's position
  2. Failure to exercise professional scepticism over a technology output Correct answer.
  3. Unauthorised disclosure of confidential information
  4. A self-interest threat arising from dependence on a single large client fee

Explanation

Professional scepticism requires a member to critically evaluate evidence, including outputs generated by technology, rather than treating them as authoritative. Automation bias - the tendency to accept machine output uncritically - undermines that scepticism, especially where the model's assumptions, inputs or training data remain untested.

Question 47Governance, ethics and professional obligations in a technology-enabled environment

A member is asked to use a new AI-based analytics tool on an engagement but has no training in the tool and does not understand its limitations. Under the Code of Ethics, the member should:

  1. Obtain the competence to use it, or decline to rely on it. Correct answer.
  2. Use the tool, because the firm has purchased a licence for it.
  3. Use the tool, because the client has already approved its use.
  4. Use the tool and disclose its limitations in the management letter.

Explanation

Professional competence and due care requires members to attain and maintain the knowledge and skill needed for the work and to act diligently in accordance with applicable technical and professional standards. Where the necessary understanding cannot be obtained, the member should not rely on the tool's output.

Question 48Governance, ethics and professional obligations in a technology-enabled environment

A manager instructs a member to leave a known data breach out of the report to those charged with governance, arguing that it is immaterial. What should the member do first under the Code's framework for resolving ethical conflict?

  1. Refer the matter to those charged with governance or a higher authority. Correct answer.
  2. Resign from the engagement at once and notify the regulator.
  3. Comply, because the manager has judged the matter immaterial.
  4. Document the instruction and raise it at the next annual planning review.

Explanation

The Code's framework for resolving ethical conflict requires the member to consider the issue and escalate internally, first to the immediate superior or next level of management and ultimately to those charged with governance, before contemplating external action. Complying with an improper instruction is never an acceptable resolution of the conflict.

Question 49Governance, ethics and professional obligations in a technology-enabled environment

A bank relies on a vendor's AI model to set customer credit limits. Which arrangement best preserves the bank's own accountability for those decisions?

  1. Relying on the vendor's published model card and annual assurance report.
  2. Model documentation, independent validation and board reporting on model performance. Correct answer.
  3. Including a clause that shifts liability to the vendor if a customer is harmed.
  4. Requiring the vendor to certify that the model meets industry standards at go-live.

Explanation

Outsourcing a model does not transfer the regulated entity's accountability for the decisions it makes using that model. Effective governance therefore requires the entity to obtain sufficient transparency about the model, validate its performance independently of the vendor, and report model risk to the board so that oversight is continuous.

Question 50Governance, ethics and professional obligations in a technology-enabled environment

An accounting firm discovers that client tax file numbers stored in its cloud system were accessed by an unauthorised party, and serious harm to affected individuals is likely. Under the Notifiable Data Breaches scheme, the firm must:

  1. Notify the OAIC and affected individuals within 12 months of the breach.
  2. Notify the police only, since the matter involves unauthorised access.
  3. Notify the OAIC only if 1,000 or more individuals are affected.
  4. Notify the OAIC and affected individuals as soon as practicable. Correct answer.

Explanation

Where an eligible data breach is likely to result in serious harm, the Notifiable Data Breaches scheme requires the entity to prepare a statement and notify the OAIC and affected individuals as soon as practicable after becoming aware. The assessment turns on the likelihood of serious harm, not on how many people are affected, and notification to law enforcement is a separate step.