I85PREP
⌘ K
CRM56 study materials
CRM56 study resources

CRM56 practice questions

One question at a time. Build your CRM56 understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Fundamentals and Governance

Which statement best describes the primary purpose of a risk management framework within an organization?

  1. It provides a structured, consistent approach for identifying, assessing, and treating risks. Correct answer.
  2. It replaces the need for internal controls by transferring all risk to external parties.
  3. It guarantees that no identified risk will ever materialize into a loss event.
  4. It documents only financial risks so that auditors can verify accounting accuracy.

Explanation

A risk management framework supplies the governance structure, processes, and vocabulary that let an organization handle risk consistently across all units. It does not eliminate risk or replace controls; it organizes how risks are identified, evaluated, and treated. Frameworks typically cover all risk categories, not just financial ones.

Question 2Risk Management Fundamentals and Governance

In risk governance, what does the concept of 'risk appetite' refer to?

  1. The maximum number of risks a risk register can hold before it is archived.
  2. The speed at which a risk team can close outstanding remediation actions.
  3. The amount and type of risk an organization is willing to accept in pursuit of its objectives. Correct answer.
  4. The total insurance coverage purchased to offset potential losses.

Explanation

Risk appetite expresses the level and types of risk an entity is willing to pursue or retain to achieve its goals. It is set by the board or senior leadership and guides decision-making throughout the organization. It is distinct from risk capacity, which is the maximum risk the entity can bear.

Question 3Risk Management Fundamentals and Governance

Which element is typically considered part of the 'governance' component of an enterprise risk management program?

  1. Drafting the wording of individual customer contracts.
  2. Calculating the annual depreciation of physical assets.
  3. Running automated vulnerability scans on production servers.
  4. Defining board-level oversight roles and risk committee responsibilities. Correct answer.

Explanation

Governance covers oversight structures such as board responsibilities, risk committees, and clearly assigned accountability for risk decisions. Technical scanning, asset accounting, and contract drafting are operational activities that sit beneath the governance layer. Governance sets direction and accountability rather than performing day-to-day tasks.

Question 4Risk Management Fundamentals and Governance

What is the main distinction between a risk and an issue in risk management practice?

  1. A risk has already occurred, while an issue is a future possibility.
  2. A risk applies only to projects, while an issue applies only to operations.
  3. A risk is always financial, while an issue is always non-financial.
  4. A risk is a potential future event, while an issue is a problem that has already occurred. Correct answer.

Explanation

A risk is an uncertain future event that may affect objectives if it occurs, whereas an issue is a problem that has already materialized and requires management action. Issues are typically tracked separately from the risk register. Both can arise in projects or operations and in any risk category.

Question 5Risk Management Fundamentals and Governance

An organization assigns a risk owner for each entry in its risk register. What is the primary accountability of a risk owner?

  1. Approving the organization's overall annual budget.
  2. Monitoring the risk and ensuring appropriate response actions are carried out. Correct answer.
  3. Personally funding any losses that result from the risk.
  4. Conducting external audits of third-party suppliers.

Explanation

A risk owner is accountable for monitoring a specific risk, keeping its assessment current, and ensuring agreed response actions are implemented and effective. The role is about ownership and follow-through, not personal financial liability. Budget approval and external audit are unrelated responsibilities.

Question 6Risk Management Fundamentals and Governance

Which of the following best defines 'inherent risk'?

  1. The level of risk before any controls or mitigations are considered. Correct answer.
  2. The risk that arises solely from external regulatory changes.
  3. The risk remaining after all controls and mitigations have been applied.
  4. The risk that a control will fail to operate as designed.

Explanation

Inherent risk is assessed before taking account of existing controls, giving a view of exposure in the absence of mitigation. Comparing inherent and residual risk helps show the value of controls. Residual risk, by contrast, is what remains after controls are applied.

Question 7Risk Management Fundamentals and Governance

In a typical risk assessment, what does 'likelihood' represent?

  1. The estimated probability that a given risk event will occur. Correct answer.
  2. The total financial value of the assets exposed to a risk.
  3. The date on which a risk was first entered in the register.
  4. The number of controls currently protecting an asset.

Explanation

Likelihood is the assessed probability or frequency that a risk event will actually happen within a defined period. It is usually combined with impact to derive an overall risk rating. Asset value, control counts, and register dates are separate attributes.

Question 8Risk Management Fundamentals and Governance

A risk manager is combining likelihood and impact scores to prioritize risks. Which statement best reflects the standard practice?

  1. The two scores are multiplied or mapped on a matrix to produce an overall risk rating. Correct answer.
  2. Only impact should be used, because likelihood cannot be estimated.
  3. Likelihood and impact should be ignored once a risk owner is assigned.
  4. The two scores should be added so that every risk receives a unique total.

Explanation

Risk ratings are commonly derived by multiplying likelihood by impact or by plotting both on a risk matrix that yields a rating band such as low, medium, or high. This combined rating supports prioritization and comparison across the portfolio. Likelihood can be estimated qualitatively or quantitatively, so discarding it is inappropriate.

Question 9Risk Management Fundamentals and Governance

Under a common risk treatment taxonomy, which option describes 'risk transfer'?

  1. Shifting the financial consequence of a risk to a third party, such as through insurance. Correct answer.
  2. Reducing the likelihood of the risk through additional controls.
  3. Eliminating the activity that creates the risk entirely.
  4. Accepting the risk without taking any action.

Explanation

Risk transfer shifts some or all of the financial impact of a risk to another party, typically via insurance, contracts, or outsourcing arrangements. It does not usually eliminate the underlying risk itself. Avoidance, acceptance, and mitigation are the other common treatment options.

Question 10Risk Management Fundamentals and Governance

An organization decides to stop offering a particular product line because the associated regulatory risk is unacceptable. Which risk treatment option has been applied?

  1. Risk sharing
  2. Risk transfer
  3. Risk acceptance
  4. Risk avoidance Correct answer.

Explanation

Risk avoidance means not undertaking the activity that generates the risk, thereby removing the exposure entirely. Discontinuing a product line eliminates the regulatory exposure rather than mitigating or shifting it. Transfer and sharing would involve another party bearing part of the risk.

Question 11Risk Management Fundamentals and Governance

A company purchases a cyber insurance policy to cover potential breach costs. Which risk treatment approach does this represent?

  1. Risk transfer Correct answer.
  2. Risk acceptance
  3. Risk mitigation
  4. Risk avoidance

Explanation

Buying insurance transfers the financial consequence of a defined risk to the insurer in exchange for a premium. The underlying risk of a breach still exists, but the financial impact is shifted. Mitigation would instead reduce the likelihood or impact through controls.

Question 12Risk Management Fundamentals and Governance

Which of the following is the best example of a preventive control?

  1. Mandatory approval before a payment is released. Correct answer.
  2. A quarterly review of past audit findings.
  3. A reconciliation performed after month-end to detect errors.
  4. An incident response plan invoked after a breach.

Explanation

Preventive controls are designed to stop an unwanted event before it occurs, such as requiring approval before a payment is released. Detective controls identify problems after the fact, and corrective controls respond once an event has happened. The other options operate after the event or review history.

Question 13Risk Management Fundamentals and Governance

A risk has been assessed with a high inherent rating, but strong existing controls reduce the exposure substantially. What should the risk register show?

  1. Only the residual rating, with the inherent rating deleted.
  2. Neither rating, because the risk is now fully eliminated.
  3. Only the inherent rating, since controls are irrelevant to assessment.
  4. Both the inherent rating and the lower residual rating after controls. Correct answer.

Explanation

Good practice records both inherent and residual ratings so readers can see the exposure before controls and the remaining exposure after controls. The gap between them demonstrates the effectiveness of mitigation. Strong controls reduce risk but rarely eliminate it entirely.

Question 14Risk Management Fundamentals and Governance

What is the primary role of a risk committee in a governance structure?

  1. Executing daily operational transactions on behalf of business units.
  2. Overseeing the risk management framework and escalating significant risks to the board. Correct answer.
  3. Managing the recruitment of front-line operational staff.
  4. Preparing statutory financial statements for external filing.

Explanation

A risk committee provides oversight of the risk framework, reviews significant exposures, and escalates material matters to the board or its audit committee. It sets direction and monitors performance rather than executing transactions. Financial reporting and staffing are separate management functions.

Question 15Risk Management Fundamentals and Governance

Which statement best explains the 'three lines model' in risk governance?

  1. It divides risks into exactly three severity levels only.
  2. It requires three separate external auditors to sign off on each risk.
  3. It separates management, risk oversight, and independent assurance into distinct roles. Correct answer.
  4. It mandates that every risk be reviewed three times before closure.

Explanation

The three lines model distinguishes operational management (first line), a risk and compliance oversight function (second line), and independent internal audit (third line). This separation clarifies accountability and provides independent assurance. It is about roles and independence, not the number of auditors or reviews.

Question 16Risk Management Fundamentals and Governance

An organization sets a tolerance threshold for a key risk indicator. What is the purpose of such a threshold?

  1. To calculate the depreciation of the related control assets.
  2. To define the point at which the risk exceeds acceptable levels and triggers escalation. Correct answer.
  3. To permanently close the risk once the indicator is measured.
  4. To replace the need for any qualitative risk assessment.

Explanation

A tolerance threshold defines the boundary of acceptable variation for a risk indicator; breaching it signals that exposure is outside appetite and prompts escalation or action. It supports monitoring and timely response. It does not close the risk or replace broader assessment.

Question 17Risk Management Fundamentals and Governance

Which of the following best describes a key risk indicator (KRI)?

  1. A metric that provides early warning of increasing risk exposure. Correct answer.
  2. A financial statement line item required by accounting standards.
  3. A summary of past audit opinions issued to the company.
  4. A list of all employees authorized to approve payments.

Explanation

A key risk indicator is a metric tracked to give early warning that risk exposure is rising or approaching tolerance limits. It is forward-looking and linked to specific risks. It is not an accounting line item, an authorization list, or a summary of audit opinions.

Question 18Risk Management Fundamentals and Governance

A risk register entry shows a risk with very low likelihood but catastrophic potential impact. How should such a risk generally be handled in prioritization?

  1. Give it attention proportionate to the severe impact, potentially through contingency planning. Correct answer.
  2. Remove it from the register to reduce clutter.
  3. Ignore it entirely because the likelihood is low.
  4. Treat it as insignificant because impact only matters when likelihood is high.

Explanation

Low-likelihood, high-impact risks can still be significant because a single occurrence could be catastrophic, so they warrant proportionate attention such as contingency planning and transfer where feasible. Dismissing them purely on low likelihood ignores the severity dimension. Prioritization should weigh both likelihood and impact.

Question 19Risk Management Fundamentals and Governance

An organization's risk appetite statement says it has a 'low tolerance for compliance breaches' but continues to accept repeated minor regulatory exceptions. What does this situation most likely indicate?

  1. The exceptions prove that compliance risk does not exist.
  2. The organization has eliminated all compliance risk.
  3. There is a misalignment between stated risk appetite and operational behavior. Correct answer.
  4. The risk appetite statement is being applied consistently with actual decisions.

Explanation

When stated appetite says one thing but decisions and tolerated exceptions say another, the appetite is not being operationalized, signaling a governance gap. Effective governance aligns decisions, escalation, and metrics with the declared appetite. Repeated exceptions contradict a low-tolerance stance rather than confirming it.

Question 20Risk Management Fundamentals and Governance

A control is documented as operating effectively, but testing reveals it was bypassed during a peak period. What is the most appropriate governance response?

  1. Assume the bypass was a one-time event requiring no further review.
  2. Treat the bypass as a control failure, reassess residual risk, and address the root cause. Correct answer.
  3. Delete the control from the register to avoid future findings.
  4. Record the control as effective because documentation confirms its design.

Explanation

A control that is bypassed is not operating effectively, regardless of its documented design, so residual risk must be reassessed and the root cause remediated. Governance requires distinguishing design from operating effectiveness. Removing the control or assuming no recurrence would leave the exposure unmanaged.

Question 21Risk Management Fundamentals and Governance

Two business units assess an identical risk using different scales and criteria, producing incomparable ratings. Which governance improvement best addresses this issue?

  1. Increase the number of risk owners assigned to the risk.
  2. Adopt a common risk assessment methodology with defined scales and criteria. Correct answer.
  3. Allow each unit to keep its own scale to preserve flexibility.
  4. Remove the risk from the register until the units agree informally.

Explanation

Inconsistent ratings across units usually stem from the absence of a shared methodology, so standardizing scales, definitions, and criteria restores comparability and supports aggregation. A common framework is a core governance control. Preserving divergent scales or adding owners does not fix the measurement inconsistency.

Question 22Risk Management Fundamentals and Governance

An organization wants to determine whether its risk management framework is achieving its objectives. Which approach best supports this evaluation?

  1. Assuming the framework works because it was approved once by the board.
  2. Measuring only the length of time since the last reported incident.
  3. Periodically reviewing risk metrics, control testing results, and incident trends against defined objectives. Correct answer.
  4. Relying solely on the number of entries in the risk register.

Explanation

Evaluating framework effectiveness requires evidence such as risk metrics, control testing outcomes, and incident trends compared against stated objectives. A one-time approval or a single count does not demonstrate ongoing performance. Effective monitoring combines multiple indicators over time.

Question 23Risk Management Fundamentals and Governance

Which of the following best describes 'residual risk'?

  1. The risk that remains after existing controls and treatments have been applied. Correct answer.
  2. The risk that arises only from natural disasters.
  3. The risk that a control will be designed incorrectly.
  4. The risk present before any controls are considered.

Explanation

Residual risk is the exposure that remains once existing controls and treatments are taken into account. It is compared with inherent risk to judge control effectiveness and with risk appetite to decide whether further action is needed. It is not limited to any single risk source.

Question 24Risk Management Fundamentals and Governance

A risk practitioner is documenting the rationale for why a particular risk was accepted without further action. Which governance principle does this best support?

  1. Eliminating the need for future monitoring of the risk.
  2. Delegating all accountability to the external auditor.
  3. Avoiding any record of the decision to reduce legal exposure.
  4. Ensuring decisions are documented and accountable for audit and oversight. Correct answer.

Explanation

Documenting the rationale for accepting a risk supports accountability, transparency, and the ability of oversight functions to review decisions later. Governance depends on a clear decision trail. It does not remove the need for continued monitoring or shift accountability to auditors.

Question 25Risk Identification and Risk Assessment

Which statement best defines risk within an operational risk framework?

  1. A control weakness identified during an internal audit
  2. The probability that a project will finish ahead of schedule
  3. The effect of uncertainty on objectives, combining likelihood and impact Correct answer.
  4. Any event that has already caused a financial loss

Explanation

Risk is conventionally defined as the effect of uncertainty on objectives, expressed through the combination of likelihood and impact. It is forward-looking and includes potential opportunity as well as threat, so it is broader than realized losses or audit findings.

Question 26Risk Identification and Risk Assessment

In a standard risk matrix, which pair of dimensions is typically plotted against each other?

  1. Asset value and depreciation rate
  2. Likelihood and impact Correct answer.
  3. Frequency and duration of audit testing
  4. Control cost and control benefit

Explanation

A risk matrix plots likelihood (or probability) on one axis against impact (or consequence) on the other, producing a combined risk rating. This allows risks to be ranked and prioritized for treatment.

Question 27Risk Identification and Risk Assessment

What is the primary purpose of a risk register?

  1. To document the annual financial statements
  2. To store signed contracts with third parties
  3. To list all employees and their reporting lines
  4. To record identified risks with owners, ratings, and treatment status Correct answer.

Explanation

A risk register is the central log of identified risks, capturing attributes such as risk owner, inherent and residual ratings, controls, and treatment actions. It supports monitoring and reporting across the organization.

Question 28Risk Identification and Risk Assessment

What distinguishes inherent risk from residual risk?

  1. Inherent risk is measured in currency; residual risk is measured in days
  2. Inherent risk applies only to credit exposures; residual risk applies to operations
  3. Inherent risk is set by regulators; residual risk is set by auditors
  4. Inherent risk is assessed before controls; residual risk is assessed after controls Correct answer.

Explanation

Inherent risk reflects the exposure assuming no controls are in place, while residual risk is the exposure remaining once existing controls are applied. Comparing the two helps evaluate control effectiveness.

Question 29Risk Identification and Risk Assessment

Which of the following is a qualitative risk assessment technique?

  1. Expected loss calculation using historical frequency data
  2. Monte Carlo simulation of loss distributions
  3. Value-at-risk modeling of market positions
  4. Facilitated risk workshop with subject-matter experts Correct answer.

Explanation

Qualitative techniques rely on expert judgment, structured discussion, and descriptive scales rather than numerical modeling. Facilitated workshops elicit and rank risks using such judgment.

Question 30Risk Identification and Risk Assessment

A key risk indicator (KRI) is best described as which of the following?

  1. A regulatory capital charge applied to banks
  2. A financial ratio used to value a company
  3. A metric that provides early warning of increasing risk exposure Correct answer.
  4. A control that prevents fraud from occurring

Explanation

A KRI is a forward-looking metric tracked to signal rising or falling risk exposure before losses materialize. It is a monitoring tool, not a control activity or a capital measure.

Question 31Risk Identification and Risk Assessment

Which risk response involves accepting the risk without taking action to reduce it?

  1. Risk transfer
  2. Risk mitigation
  3. Risk acceptance Correct answer.
  4. Risk avoidance

Explanation

Risk acceptance means the organization retains the exposure, often because the cost of treatment exceeds the benefit or the risk is within appetite. The other responses modify or shift the exposure.

Question 32Risk Identification and Risk Assessment

A firm's risk appetite statement primarily communicates which of the following?

  1. The amount and type of risk the organization is willing to pursue or retain Correct answer.
  2. The accounting policies used to value inventory
  3. The schedule for external audits during the year
  4. The list of employees authorized to sign contracts

Explanation

Risk appetite expresses the level and nature of risk the organization is willing to accept in pursuit of its objectives. It provides boundaries against which risk assessments and decisions are calibrated.

Question 33Risk Identification and Risk Assessment

A risk assessment team rates a process as high impact and high likelihood. According to standard practice, what should happen next?

  1. Record the risk and review it at the next annual cycle
  2. Escalate the risk for priority treatment and assign an owner Correct answer.
  3. Remove the risk from the register to avoid duplication
  4. Close the risk because it is already known

Explanation

Risks rated high on both dimensions typically exceed appetite and require prioritized treatment, escalation, and a clearly assigned owner. Deferring action or closing a known high risk leaves the exposure unmanaged.

Question 34Risk Identification and Risk Assessment

A company buys an insurance policy to cover a specific operational loss. Which risk response has it applied?

  1. Risk avoidance
  2. Risk reduction through controls
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Insurance shifts the financial consequences of a defined risk to the insurer, which is risk transfer. The underlying activity still occurs, so it is not avoidance or acceptance.

Question 35Risk Identification and Risk Assessment

Why is a bow-tie analysis useful in risk assessment?

  1. It replaces the need for a risk register
  2. It determines the statutory audit opinion
  3. It calculates the exact monetary value of a future loss
  4. It links multiple causes and consequences to a central risk event and its controls Correct answer.

Explanation

Bow-tie analysis maps threats and causes on one side and consequences on the other, with preventive and mitigating controls shown against the central event. This makes control gaps visible across both pathways.

Question 36Risk Identification and Risk Assessment

A risk owner's core responsibility in the assessment process is to do which of the following?

  1. Own the assessment, monitoring, and treatment of an assigned risk Correct answer.
  2. Approve the external audit fee
  3. Set the organization's overall risk appetite
  4. Independently audit the risk function's work

Explanation

A risk owner is accountable for assessing, monitoring, and treating a specific risk within delegated authority. Independence in assurance and appetite setting sit with other roles.

Question 37Risk Identification and Risk Assessment

Which factor most likely increases the inherent risk of a manual payment process?

  1. Segregation of duties between preparer and approver
  2. High transaction volume handled with manual keying Correct answer.
  3. Regular reconciliation by an independent team
  4. Automated three-way matching of invoices

Explanation

Manual keying of high volumes raises error and fraud exposure before controls are considered, increasing inherent risk. The other options are controls that reduce risk rather than elevate it.

Question 38Risk Identification and Risk Assessment

A risk heat map is used primarily to do which of the following?

  1. Visualize the distribution of risks across likelihood and impact bands Correct answer.
  2. Calculate the net present value of a capital project
  3. Document the chart of accounts
  4. Record employee training completion rates

Explanation

A heat map displays risks plotted by likelihood and impact, often color-coded, to show concentration and priority visually. It supports communication and prioritization of the risk profile.

Question 39Risk Identification and Risk Assessment

In scenario analysis, what is the role of a plausible but severe scenario?

  1. It replaces the need for historical loss data
  2. It guarantees the event will occur within the year
  3. It stress-tests exposure to low-frequency, high-impact events Correct answer.
  4. It measures only routine, high-frequency losses

Explanation

Scenario analysis explores plausible severe events that historical data may not capture, helping estimate tail exposure and preparedness. It informs assessment but does not predict occurrence.

Question 40Risk Identification and Risk Assessment

A risk assessment identifies that a single employee both initiates and approves vendor payments. Which risk is most directly indicated?

  1. Liquidity risk arising from funding mismatches
  2. Strategic risk arising from a competitor's new product
  3. Market risk arising from interest rate movements
  4. Fraud risk arising from inadequate segregation of duties Correct answer.

Explanation

Combining initiation and approval in one person removes a key preventive control, creating opportunity for error or fraud. This is a control design weakness tied to segregation of duties.

Question 41Risk Identification and Risk Assessment

Which statement best describes the relationship between risk tolerance and risk appetite?

  1. Tolerance is always larger than the appetite and unrelated to it
  2. Appetite applies to financial risks; tolerance applies to operational risks
  3. Tolerance is the acceptable variation around the appetite level Correct answer.
  4. Tolerance is set by regulators while appetite is set by auditors

Explanation

Risk appetite sets the desired level of risk-taking, while tolerance defines the acceptable deviation from that level before action is triggered. Tolerance operates within and around the appetite boundary.

Question 42Risk Identification and Risk Assessment

A control self-assessment (CSA) program primarily helps an organization to do which of the following?

  1. Have process owners evaluate the design and effectiveness of their controls Correct answer.
  2. Replace financial reporting with narrative commentary
  3. Eliminate the need for independent assurance
  4. Outsource all risk assessment to external consultants

Explanation

CSA engages process owners in assessing their own controls, building ownership and surfacing weaknesses early. It supplements but does not replace independent assurance.

Question 43Risk Identification and Risk Assessment

An analyst is estimating the frequency of a rare operational loss event with very few historical observations. Which approach is most appropriate?

  1. Assume the event will never occur because there is no history
  2. Set frequency equal to the average of all event types
  3. Combine internal data with external loss data and expert judgment Correct answer.
  4. Use only the most recent year's internal losses

Explanation

When internal data are sparse, combining external loss data with expert judgment improves the estimate of frequency. Ignoring the tail or pooling unrelated events distorts the assessment.

Question 44Risk Identification and Risk Assessment

A firm's residual risk rating equals its inherent risk rating after controls are applied. What is the most likely interpretation?

  1. The risk is below the organization's appetite
  2. The risk has been fully transferred to a third party
  3. The existing controls are assessed as ineffective or absent Correct answer.
  4. The controls are highly effective at reducing exposure

Explanation

If residual risk is unchanged from inherent risk, the controls in place are judged to provide little or no reduction. Effective controls would lower the residual rating relative to inherent.

Question 45Risk Identification and Risk Assessment

Why might a risk assessment team weight impact more heavily than likelihood for certain risks?

  1. Because likelihood is impossible to estimate for any risk
  2. Because impact is always easier to measure than likelihood
  3. Because regulators prohibit likelihood assessment for those risks
  4. Because a low-probability event could cause catastrophic, irreversible harm Correct answer.

Explanation

For risks with potentially catastrophic or irreversible consequences, severity dominates the decision even if probability is low. Weighting impact captures the asymmetric cost of such tail events.

Question 46Risk Identification and Risk Assessment

An organization aggregates individual risk ratings into an enterprise view and finds the portfolio rating far exceeds the sum of individual ratings. What does this most likely indicate?

  1. Concentration or correlation among risks that compounds their combined effect Correct answer.
  2. That diversification has reduced overall exposure
  3. That individual risk ratings were all set too low
  4. A calculation error that should always be corrected to equal the sum

Explanation

Aggregation can exceed the simple sum when risks are correlated or concentrated, since losses may occur together. This reflects interdependence rather than arithmetic error.

Question 47Risk Identification and Risk Assessment

A risk assessment uses a five-point likelihood scale but defines no criteria for each point. What is the most significant consequence?

  1. The organization must abandon qualitative assessment entirely
  2. Assessors apply inconsistent judgments, making ratings unreliable and hard to compare Correct answer.
  3. All risks will automatically be rated as high
  4. The risk register cannot store numeric ratings

Explanation

Without defined scale criteria, different assessors interpret each point differently, undermining consistency and comparability. Clear descriptors anchor judgment and improve reliability.

Question 48Risk Identification and Risk Assessment

A newly identified risk has high impact but the organization has no data on its likelihood. What is the most defensible assessment approach?

  1. Assign the lowest likelihood score because no event has been observed
  2. Exclude it from the register until data become available
  3. Assign the highest likelihood score to force immediate action
  4. Record it with an explicit uncertainty flag and gather evidence before finalizing the rating Correct answer.

Explanation

When likelihood is genuinely unknown, transparently flagging the uncertainty and gathering evidence is more defensible than defaulting to an extreme score. This preserves the integrity of the assessment and supports informed decisions.

Question 49Risk Measurement and Quantification

A risk analyst is calculating the expected loss for a portfolio of unsecured consumer loans. Which combination of factors is used in the basic expected loss formula?

  1. Exposure at default, probability of default, and loss given default Correct answer.
  2. Exposure at default, maturity, and interest rate
  3. Loss given default, recovery rate, and discount rate
  4. Probability of default, loss given default, and recovery rate

Explanation

Expected loss is conventionally computed as exposure at default multiplied by probability of default multiplied by loss given default. Each factor captures a distinct dimension: how much is owed, how likely default is, and how much would be lost if default occurs. Recovery rate and maturity are not direct multiplicative inputs to this basic formula.

Question 50Risk Measurement and Quantification

A bank's risk team wants a single summary number that answers 'how much could we lose on a bad day at a given confidence level?' Which measure directly answers this question?

  1. Expected shortfall
  2. Value at risk Correct answer.
  3. Sharpe ratio
  4. Standard deviation of returns

Explanation

Value at risk states the loss threshold that will not be exceeded with a specified probability over a defined horizon. It is expressed as a single dollar or percentage figure at a chosen confidence level. Expected shortfall answers a different question about the average loss beyond that threshold.