I85PREP
⌘ K
CERP study materials
CERP study resources

CERP practice questions

One question at a time. Build your CERP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Enterprise Risk Management Frameworks and Governance

Which characteristic most clearly distinguishes enterprise risk management from traditional, silo-based risk management?

  1. It concentrates exclusively on financial and insurable hazard risks.
  2. It aggregates and manages risks across the whole organization as an integrated portfolio. Correct answer.
  3. It transfers the day-to-day management of risk to the internal audit function.
  4. It is performed only after a material loss event has been recorded.

Explanation

ERM takes a portfolio view, aggregating risk types, business units and time horizons and linking the result to strategy and performance. Silo-based risk management treats each risk separately within the function that owns it, so correlations and concentrations go unseen.

Question 2Enterprise Risk Management Frameworks and Governance

Within the Three Lines Model, which function provides independent, objective assurance to the governing body on the effectiveness of risk management and internal controls?

  1. The senior management risk committee
  2. Internal audit Correct answer.
  3. Front-line business units that own and manage risk
  4. The risk and compliance oversight function

Explanation

The model separates risk ownership (first line), oversight and challenge (second line), and independent assurance (third line). Internal audit is the third line and reports to the governing body so that its assessment is not compromised by operational responsibilities.

Question 3Enterprise Risk Management Frameworks and Governance

Who holds the ultimate authority to approve an organization's enterprise risk appetite statement?

  1. The director of internal audit
  2. The chief risk officer
  3. The board of directors Correct answer.
  4. The heads of the business units

Explanation

Risk appetite expresses how much risk the organization is willing to accept in pursuit of its strategy, which is a decision reserved to the board. Management recommends and implements, but approval and periodic reaffirmation rest with the board.

Question 4Enterprise Risk Management Frameworks and Governance

How did the COSO ERM 2017 framework depart most significantly from the 2004 version?

  1. It more fully embedded risk in strategy-setting and performance. Correct answer.
  2. It limited application to the reliability of financial reporting.
  3. It removed governance and culture from the framework's scope.
  4. It replaced internal control concepts with a dedicated fraud risk focus.

Explanation

The 2017 framework reframed ERM around the integration of risk with strategy and performance, organized under five components and twenty principles. Governance and culture were elevated rather than removed, and the scope extends well beyond financial reporting.

Question 5Enterprise Risk Management Frameworks and Governance

Which statement best describes ISO 31000:2018?

  1. It prescribes a mandatory risk taxonomy for financial institutions.
  2. It sets quantitative capital requirements for operational risk.
  3. It certifies organizations that meet minimum risk management requirements.
  4. It provides principles and guidelines for managing risk that can be adapted to any organization. Correct answer.

Explanation

ISO 31000 is a guidance standard setting out principles, a framework and a process for managing risk; it is generic and intended for adaptation to any sector or size of organization. It is not a certifiable management system standard and imposes no capital requirements.

Question 6Enterprise Risk Management Frameworks and Governance

In risk governance, "tone at the top" refers to:

  1. The ranking of risks in the enterprise risk register
  2. The frequency with which risk reports are sent to regulators
  3. The opening paragraph of the risk appetite statement
  4. The example set by the board and senior management through their decisions and actions Correct answer.

Explanation

Tone at the top is demonstrated behavior: the board and executives visibly prioritize risk considerations, resource the risk function, and respond consistently when risk and commercial pressure conflict. Written statements matter far less than what staff observe leadership actually doing.

Question 7Enterprise Risk Management Frameworks and Governance

An organization states it will accept no more than $50 million of aggregate credit losses in a year, and permits a business unit's planned loss level to vary by 10% around target. Which pairing is correct?

  1. The $50 million is risk appetite; the 10% variance is risk tolerance. Correct answer.
  2. The $50 million is a risk limit; the 10% variance is risk capacity.
  3. The $50 million is risk tolerance; the 10% variance is risk appetite.
  4. Both figures are examples of risk capacity.

Explanation

Risk appetite is the aggregate amount and type of risk the organization is willing to accept, while tolerance is the acceptable variation around a specific objective or metric. The aggregate loss ceiling therefore expresses appetite and the unit-level variance expresses tolerance.

Question 8Enterprise Risk Management Frameworks and Governance

Risk capacity is best described as:

  1. The maximum risk the entity can bear before breaching constraints Correct answer.
  2. The permitted variation around a specific risk metric or target
  3. The amount of risk the board chooses to pursue in pursuit of its strategy
  4. The total of all risk limits delegated to individual business units

Explanation

Capacity is the outer boundary set by capital, liquidity, regulatory and stakeholder constraints, and it cannot be exceeded. Appetite is chosen within capacity, and limits and tolerances translate appetite into operating constraints.

Question 9Enterprise Risk Management Frameworks and Governance

To preserve the independence of the risk function, the chief risk officer should typically:

  1. Serve concurrently as the chief financial officer
  2. Have direct access to the board or its risk committee and an independent reporting line Correct answer.
  3. Be appointed and evaluated solely by the internal audit function
  4. Report to the head of the largest revenue-producing business line

Explanation

The CRO needs an escalation route to the board that does not run through the business leaders whose risk-taking is being challenged. Reporting into the CEO with direct board access, and being measured on risk outcomes rather than revenue, preserves that independence.

Question 10Enterprise Risk Management Frameworks and Governance

Which activity is most appropriate for a board risk committee?

  1. Approving individual commercial loan applications above a set threshold
  2. Overseeing the risk governance framework and the enterprise risk appetite Correct answer.
  3. Performing independent validation of pricing models
  4. Setting daily trading limits for the treasury desk

Explanation

Board committees oversee the design and effectiveness of the framework, the appetite, and the profile of top and emerging risks, and they challenge management. Transaction approvals and model validation are management-level activities that belong within the framework being overseen.

Question 11Enterprise Risk Management Frameworks and Governance

Which approach is most effective for identifying emerging risks that have little or no historical loss data?

  1. Relying primarily on recent regulatory examination findings
  2. Reviewing internal audit findings from prior audit cycles
  3. Scenario analysis and forward-looking workshops with subject matter experts Correct answer.
  4. Extrapolating from the prior year's loss experience

Explanation

Risks without loss history require forward-looking techniques such as scenario analysis, horizon scanning and expert workshops that explore plausible drivers and impacts. Historical analysis is by construction blind to risks that have not yet produced recorded losses.

Question 12Enterprise Risk Management Frameworks and Governance

Why does an ERM program aggregate risks across business units rather than reviewing each risk in isolation?

  1. Aggregation reveals concentrations and correlations that appear acceptable unit by unit. Correct answer.
  2. Aggregation transfers residual risk to the second line of defense.
  3. Aggregation guarantees that total losses cannot exceed the sum of individual limits.
  4. Aggregation eliminates the need for business-unit risk limits.

Explanation

Risks that look modest in isolation can combine into a material exposure when several units share the same counterparty, market factor or process dependency. Aggregation exposes those concentrations and correlations so that appetite can be managed at the enterprise level.

Question 13Enterprise Risk Management Frameworks and Governance

In the Three Lines Model, which statement best describes the first line?

  1. It provides independent assurance to the governing body.
  2. It sets the enterprise risk appetite on behalf of the board.
  3. It owns and manages risk as part of delivering products and services. Correct answer.
  4. It monitors and challenges risk-taking without owning the risk.

Explanation

The first line comprises the operational management that takes risk in pursuit of organizational objectives and is accountable for managing it. Oversight and challenge sit in the second line, and independent assurance sits in the third.

Question 14Enterprise Risk Management Frameworks and Governance

Which observation is the strongest indicator that an organization's risk culture is weak?

  1. Internal audit reports to the audit committee.
  2. Compensation rewards volume growth with no risk adjustment. Correct answer.
  3. Business units maintain their own risk registers.
  4. Risk appetite is reviewed annually by the board.

Explanation

Incentives reveal what an organization actually rewards, so pay that ignores risk outcomes encourages excessive risk-taking regardless of stated values. Sound risk culture aligns compensation with risk-adjusted performance and can claw back rewards when risks materialize.

Question 15Enterprise Risk Management Frameworks and Governance

Board-level risk reporting is most useful when it:

  1. Focuses only on risks that materialized during the quarter
  2. Combines current exposures with forward-looking indicators, limit breaches and concentrations Correct answer.
  3. Is restricted to risks owned by the second line of defense
  4. Reproduces every entry in the operational loss database

Explanation

Effective board reporting is concise, forward-looking and decision-oriented, pairing current exposure with indicators, breaches and concentrations so directors can challenge management. Exhaustive detail obscures the few facts that require board attention.

Question 16Enterprise Risk Management Frameworks and Governance

A sound risk governance framework should be:

  1. Approved by the board and reviewed periodically for continued relevance Correct answer.
  2. Kept confidential from regulators and external auditors
  3. Drafted and owned exclusively by internal audit
  4. Replaced whenever a new chief executive is appointed

Explanation

The framework documents how risk is governed, who is accountable, and how appetite is set and monitored, so it requires board approval and periodic refresh as strategy and the environment change. Review keeps it a living instrument rather than a static document.

Question 17Enterprise Risk Management Frameworks and Governance

Which practice best shows that stress testing is integrated into ERM rather than performed as a standalone compliance exercise?

  1. Results are reviewed only by the modeling team that produced them.
  2. Scenarios are fixed once and reused every year for comparability.
  3. Results inform risk appetite calibration, capital planning and limit setting. Correct answer.
  4. Only regulator-prescribed adverse scenarios are run.

Explanation

Integration is demonstrated when stress results actually change decisions about appetite, capital and limits, and when management and the board use them as a forward-looking risk tool. Scenarios, review and challenge should evolve with the risk profile and feed directly into planning.

Question 18Enterprise Risk Management Frameworks and Governance

A board approves a risk appetite statement, but no limits, tolerances or reporting are linked to it. The most likely consequence is that:

  1. The statement becomes a symbolic document with little influence on risk-taking decisions Correct answer.
  2. Risk capacity automatically rises to match the approved statement
  3. Internal audit assumes ownership of the risk appetite
  4. Business units will interpret appetite consistently because the statement is board-approved

Explanation

Appetite only shapes behavior when it cascades into limits, tolerances, monitoring and reporting at the level where risk is taken. Without that translation, the statement has no operative effect on decisions or escalation.

Question 19Enterprise Risk Management Frameworks and Governance

Which division of risk governance responsibilities between the board and management is most consistent with sound practice?

  1. Management sets the appetite and the board executes the resulting risk decisions
  2. The board delegates all risk oversight to the chief risk officer with no reporting back
  3. The board approves the framework and appetite and oversees management's implementation Correct answer.
  4. The board operates the framework day to day while management approves the risk appetite

Explanation

The board sets the parameters and oversees, while management designs, implements and operates the framework within those parameters and reports back. Keeping approval and execution separate preserves accountability and allows the board to challenge management.

Question 20Enterprise Risk Management Frameworks and Governance

For a material risk model, independent validation should be performed by:

  1. The business line that consumes the model's output
  2. The model development team, immediately before deployment
  3. The external auditor during the financial statement audit
  4. An independent function with the expertise to assess it, reporting to senior management or the board Correct answer.

Explanation

Effective model risk management separates development from validation so that conceptual soundness, data quality and performance are assessed by parties without a stake in the outcome. The validator needs technical expertise and a reporting line that lets findings escalate unimpeded.

Question 21Risk Appetite, Strategy and Risk Culture

In enterprise risk management, what does the term risk appetite most precisely describe?

  1. The amount and type of risk an organization is willing to accept in pursuing its objectives Correct answer.
  2. The minimum level of risk that supervisors require an institution to maintain
  3. The maximum loss the organization could absorb before its capital is exhausted and it becomes insolvent
  4. The set of risks identified during the annual enterprise-wide risk assessment process

Explanation

Risk appetite is a forward-looking statement of how much and what kinds of risk the organization chooses to take in pursuit of strategy. It is a deliberate choice, bounded above by risk capacity, and is expressed through tolerances and limits.

Question 22Risk Appetite, Strategy and Risk Culture

A regional bank's board determines that, before breaching regulatory capital minimums, the bank could absorb 400 million dollars of unexpected losses. This figure represents the bank's:

  1. Risk limit
  2. Risk tolerance
  3. Risk capacity Correct answer.
  4. Risk appetite

Explanation

Risk capacity is the maximum risk an organization can bear before breaching binding constraints such as regulatory capital or solvency thresholds. Appetite is the amount the organization chooses to accept within that capacity, and tolerances and limits give it operational expression.

Question 23Risk Appetite, Strategy and Risk Culture

Which statement best describes a risk tolerance?

  1. The total capital held against a given risk type
  2. The acceptable variation in outcomes the organization is willing to bear around a given risk-appetite objective Correct answer.
  3. The minimum return required before a business line may accept new risk
  4. The maximum amount the board is willing to spend in a fiscal year on risk-mitigation tools and insurance across the enterprise

Explanation

Risk tolerance translates a broad appetite statement into an acceptable level of risk or deviation for a specific risk category. Appetite sets overall direction, tolerance sets the acceptable boundary, and limits make the tolerance operational at desk or unit level.

Question 24Risk Appetite, Strategy and Risk Culture

Which board and senior management behavior most directly reinforces a strong risk culture?

  1. Limiting risk discussions to the annual risk report circulated to the board
  2. Rewarding business unit leaders strictly on volume and revenue growth without any risk adjustment to their incentive pay
  3. Delegating all risk-acceptance decisions to the second line of defense and internal audit
  4. Consistently making decisions that favor stated risk limits over short-term revenue opportunities Correct answer.

Explanation

Risk culture is revealed by what leaders do when risk and reward conflict, not by what policies say. Visible decisions that honor limits, even at a cost to short-term revenue, signal that the appetite framework is genuinely binding.

Question 25Risk Appetite, Strategy and Risk Culture

In the three lines of defense model, which group owns and manages risk on a day-to-day basis?

  1. The board risk committee
  2. Compliance and risk functions in the second line
  3. Internal audit
  4. Business line management in the first line Correct answer.

Explanation

The first line takes risk in pursuit of strategy and therefore owns and manages it, including operating within approved limits. The second line sets frameworks, monitors and challenges, and internal audit provides independent assurance to the board.

Question 26Risk Appetite, Strategy and Risk Culture

A well-developed risk appetite framework should link the approved risk appetite to which of the following?

  1. The organization's strategic plan and business objectives Correct answer.
  2. The external audit fee schedule
  3. Published industry average risk levels
  4. Individual employee performance ratings and annual merit increase decisions

Explanation

Risk appetite exists to ensure that the risks taken in executing strategy stay within boundaries the board deems acceptable. Anchoring it to the strategic plan and business objectives keeps it decision-useful rather than a standalone compliance artifact.

Question 27Risk Appetite, Strategy and Risk Culture

A bank's board approves an enterprise-wide appetite to keep credit losses below 60 basis points of loans in a stress scenario. Management then assigns credit-loss limits to each lending division. This process is best described as:

  1. Cascading the risk appetite through the organization via risk limits Correct answer.
  2. Calibrating the enterprise risk appetite to the regulatory capital requirement and buffer
  3. Conducting a risk culture assessment across the lending divisions
  4. Backtesting the risk appetite statement against prior-year results

Explanation

Cascading translates enterprise-level appetite into tolerances and then into granular limits allocated to business units and desks. This allocation is what makes appetite operational and enforceable at the point where risk is actually taken.

Question 28Risk Appetite, Strategy and Risk Culture

Which characteristic makes a metric most useful as a key risk indicator within a risk appetite framework?

  1. It is calculated only once a year to reduce reporting noise
  2. It is reported only after a loss event has been confirmed
  3. It moves ahead of the risk it is meant to signal and is tied to defined escalation thresholds Correct answer.
  4. It is chosen because the data is readily available rather than because it reflects a material risk driver

Explanation

Useful indicators are predictive, relevant to a material risk, and connected to pre-agreed thresholds that trigger action. A metric that only reports history or lacks an escalation rule cannot support timely risk-taking decisions.

Question 29Risk Appetite, Strategy and Risk Culture

Which is the board of directors' most appropriate role in the risk appetite framework?

  1. Independently auditing the risk models and reporting the results directly to regulators
  2. Setting the daily trading limits for the treasury and derivatives desks
  3. Designing the risk-appetite data warehouse and reporting architecture
  4. Approving the enterprise risk appetite and reviewing it at least annually Correct answer.

Explanation

The board sets and approves the appetite and oversees that it remains aligned with strategy and capacity, typically with at least annual review. Setting granular limits, auditing models, and building data infrastructure are management and assurance responsibilities.

Question 30Risk Appetite, Strategy and Risk Culture

A financial institution discovers that a top-performing sales team exceeded risk limits but was still awarded maximum bonuses. What is the most likely cultural consequence?

  1. Erosion of risk culture, because incentives signaled that limit breaches are tolerated Correct answer.
  2. Improved risk appetite calibration across the sales function
  3. Strengthened risk culture, because strong results were rewarded even when the stated limits were exceeded
  4. A lower risk appetite, because limits were proven to be flexible

Explanation

Compensation is one of the strongest transmitters of cultural expectations. When limit breaches carry no consequence and bonuses still flow, staff rationally conclude that limits are advisory, which undermines the entire framework.

Question 31Risk Appetite, Strategy and Risk Culture

Which combination best describes the core elements of an organization's risk culture?

  1. Audit findings, regulatory examination results, and open remediation plans
  2. Risk registers, loss-event databases, and the scenario library used in stress testing
  3. Shared values, attitudes, and behaviors toward risk, reinforced by governance and incentives Correct answer.
  4. Capital ratios, liquidity buffers, and the volatility of reported quarterly earnings and returns

Explanation

Risk culture is about the norms and behaviors that determine how risk is actually identified, escalated, and acted upon. Governance structures and incentive design are the levers that shape and sustain those behaviors over time.

Question 32Risk Appetite, Strategy and Risk Culture

Which element is most essential to include in a board-approved risk appetite statement?

  1. The projected quarterly earnings guidance issued to the market
  2. A comprehensive list of every individual risk identified in the prior year's enterprise-wide risk assessment
  3. The names and affiliations of the members of the board risk committee
  4. A clear articulation of risk types the organization will and will not accept, with measurable boundaries Correct answer.

Explanation

An appetite statement must express intent about which risks are sought, avoided, or constrained, and it must attach measurable boundaries so it can be monitored. Without both the directional and measurable elements, the statement cannot guide decisions.

Question 33Risk Appetite, Strategy and Risk Culture

A business unit proposes a new product that fits the strategic plan but would push the firm's market-risk exposure beyond its stated appetite. Under a sound risk appetite framework, the appropriate response is to:

  1. Reject, modify, or escalate the proposal for approval only after the appetite is reconsidered Correct answer.
  2. Reject all new products until the next annual appetite review is completed
  3. Proceed with the launch and adjust the risk appetite retroactively once the exposure is known
  4. Proceed, because a strong strategic fit of the product always overrides the stated risk appetite

Explanation

Appetite is binding unless and until the board formally changes it after considering capacity and strategy. The proper path is to modify the proposal, decline it, or escalate for a governed reconsideration of the appetite.

Question 34Risk Appetite, Strategy and Risk Culture

Beyond the scheduled annual cycle, which circumstance most clearly warrants a review of the risk appetite statement?

  1. A routine change to the monthly risk reporting calendar, distribution list, and report template
  2. A material change in strategy, such as a major acquisition or exit from a business line Correct answer.
  3. The hiring of a new front-line analyst in a regional lending office
  4. A minor formatting update to the quarterly risk report

Explanation

Appetite must remain aligned with strategy and capacity, so material strategic shifts such as acquisitions, divestitures, or new business models are triggers for review. Routine reporting or staffing changes do not alter the risk profile enough to require it.

Question 35Risk Appetite, Strategy and Risk Culture

A risk limit breach occurs at the business-unit level. Which sequence best reflects sound practice?

  1. Wait until the next scheduled quarterly risk committee meeting before logging the breach in the incident-management system and notifying anyone
  2. Record and escalate the breach promptly, take corrective action, and report to senior management or the board as prescribed Correct answer.
  3. Close the business line permanently without documenting the event
  4. Silently widen the limit and then inform the board of the change in the following annual report

Explanation

Breaches must be captured, escalated on a timely basis, remediated, and reported through the governance chain defined in policy. Prompt escalation preserves the board's ability to oversee adherence and to decide whether appetite remains appropriate.

Question 36Risk Appetite, Strategy and Risk Culture

If an organization's current risk profile materially exceeds its approved risk appetite, the most appropriate interpretation is that:

  1. The organization should immediately release capital reserves to offset the higher exposure
  2. No action is needed because risk profiles naturally fluctuate around any target
  3. Corrective action is needed to reduce risk, or the board must formally reconsider the appetite Correct answer.
  4. The appetite statement must have been written correctly, so the current risk profile should be disregarded

Explanation

Comparing profile with appetite is the core control loop of the framework. A material excess requires either de-risking to return within the approved boundary or a formal, board-level decision to change the appetite.

Question 37Risk Appetite, Strategy and Risk Culture

Which statement about the qualitative and quantitative components of a risk appetite framework is most accurate?

  1. Qualitative statements replace the need for quantitative limits because they express the organization's culture
  2. Quantitative measures must be identical across all risk types so that results remain comparable over time
  3. Quantitative measures alone are sufficient, because qualitative statements of intent cannot be governed, measured, or reported
  4. Qualitative statements set direction and intent, while quantitative measures make appetite measurable and enforceable Correct answer.

Explanation

The two components are complementary: qualitative language conveys what the organization seeks and avoids, while metrics and limits make those intentions testable and enforceable. Removing either element leaves the framework either unmeasurable or directionless.

Question 38Risk Appetite, Strategy and Risk Culture

An organization wants to assess its risk culture. Which approach provides the most robust evidence?

  1. Counting the number of risk policies published during the year and treating that count as a proxy for cultural strength
  2. Triangulating survey results, focus groups, and behavioral indicators such as escalation rates Correct answer.
  3. Reviewing the code of conduct once at inception and confirming that employees have signed it
  4. Relying solely on the chief risk officer's personal opinion of how staff at head office behave toward risk

Explanation

Culture is best evidenced by converging signals from what people say and what they actually do. Combining perception data with observed behaviors such as escalation patterns and exception rates reduces the bias inherent in any single method.

Question 39Risk Appetite, Strategy and Risk Culture

Which situation best indicates that a risk appetite framework is operating as intended rather than as a compliance artifact?

  1. The risk function alone knows the appetite thresholds
  2. Strategic initiatives are screened against appetite thresholds before approval, and breaches trigger documented action Correct answer.
  3. Business units regularly request limit increases without supporting analysis or a documented rationale
  4. The appetite statement is approved annually by the board and is never referenced again in any subsequent management decision

Explanation

A live framework is used at the point of decision and closes the loop when boundaries are crossed. Screening proposals against thresholds and requiring documented action on breaches shows appetite is embedded in how the business is run.

Question 40Risk Appetite, Strategy and Risk Culture

For a risk type such as reputational or conduct risk, which approach to expressing risk appetite is most defensible?

  1. Declaring a zero appetite for conduct risk and therefore requiring no ongoing monitoring
  2. Relying on financial loss thresholds alone, because reputational damage cannot be measured directly or reliably
  3. Setting a single monetary limit equal to the largest regulatory fine ever imposed on a peer bank
  4. Defining qualitative boundaries supported by metrics and event triggers, with a stated low tolerance Correct answer.

Explanation

Non-financial risks are hard to capture in a single monetary figure, so appetite is typically expressed through qualitative boundaries backed by indicative metrics and escalation triggers. A stated low tolerance plus monitoring gives management actionable guidance.

Question 41Risk Identification, Assessment and Aggregation

Which format best expresses a risk in a risk register?

  1. Because of [cause], [event] may occur, resulting in [impact] Correct answer.
  2. The name of the risk owner together with the due date of the next scheduled review
  3. A single numeric score with no supporting narrative, rationale, or owner
  4. A list of every control mapped to the risk, the owner, and the next test date

Explanation

A well-formed risk statement links a cause to an uncertain event and its consequence, which makes the risk testable and helps identify controls. Control listings and administrative metadata support the register but do not describe the risk itself.

Question 42Risk Identification, Assessment and Aggregation

Which identification technique gathers anonymous expert views over successive rounds with controlled feedback until views converge?

  1. Value at risk
  2. Delphi technique Correct answer.
  3. Bow-tie analysis
  4. Fault tree analysis

Explanation

The Delphi technique uses anonymous questionnaires administered over several rounds, with summarized feedback between rounds, so that expert judgement converges without dominance by senior or vocal participants. It is a structured elicitation method rather than a causal or statistical model.

Question 43Risk Identification, Assessment and Aggregation

What is the minimum content normally expected of an entry in a risk register?

  1. Employee names and their most recent performance review scores
  2. The organizational chart and the annual budget of the business unit
  3. Risk statement, owner, rating, and controls Correct answer.
  4. Only the financial impact and the latest internal audit rating

Explanation

A risk register records what the risk is, who is accountable for it, how it has been assessed, and what controls or responses exist, so that the exposure can be monitored and reported. Additional fields such as indicators and review dates are useful but secondary to these core elements.

Question 44Risk Identification, Assessment and Aggregation

Which statement best describes inherent risk?

  1. The possibility that a designed control fails to operate as intended
  2. The exposure that remains after existing controls have operated
  3. Risk before controls are applied Correct answer.
  4. The possibility that a quantitative model produces inaccurate outputs

Explanation

Inherent risk is the gross exposure of an activity assuming no controls are in place, which provides a baseline for judging how much risk controls and mitigants actually remove. Residual risk is the exposure remaining once those controls are taken into account.

Question 45Risk Identification, Assessment and Aggregation

How do risk appetite and risk tolerance relate to each other?

  1. Appetite is risk accepted; tolerance is allowed variation around it Correct answer.
  2. Tolerance is set exclusively by internal audit and reported to the board
  3. Appetite applies only to credit risk exposures, while tolerance covers market risk
  4. They are identical concepts and the terms are fully interchangeable

Explanation

Risk appetite expresses the amount and type of risk the entity is willing to accept in pursuit of its objectives, while tolerance defines the acceptable range of variation around that appetite before action is required. Tolerances make appetite operational through limits and thresholds.

Question 46Risk Identification, Assessment and Aggregation

Which characteristic is essential for a key risk indicator?

  1. The ratio of audit fees to total revenue, used to size the audit budget
  2. A lagging indicator that is drawn only from audited annual financial statements
  3. A control test performed once every three years by the external auditor
  4. A metric with a defined threshold that signals rising risk exposure Correct answer.

Explanation

A key risk indicator is a measurable metric linked to a specific risk, with pre-set thresholds that trigger attention or escalation when breached. Its value lies in early warning, so it should be monitored frequently and tied to the risk it represents.

Question 47Risk Identification, Assessment and Aggregation

What is the primary purpose of a risk heat map?

  1. It documents the design and operating effectiveness of internal controls
  2. It calculates the regulatory capital required for credit risk
  3. It plots likelihood against impact to prioritize risks Correct answer.
  4. It replaces the need to maintain a risk register or risk owners

Explanation

A heat map presents risks on a grid of likelihood and impact so that management can see which exposures fall in high-priority zones and focus attention accordingly. It is a communication and prioritization tool that depends on, rather than replaces, the underlying register.

Question 48Risk Identification, Assessment and Aggregation

What does a risk and control self-assessment typically involve?

  1. Business units identify risks and assess the controls over them Correct answer.
  2. The model validation team recalibrates the credit scorecards each year
  3. Internal audit independently tests every key control each quarter
  4. The board of directors formally approves the annual operating budget and capital plan

Explanation

A risk and control self-assessment is performed by the process owners themselves, who identify the risks in their area and judge whether the controls in place are designed and operating effectively. It is a management tool that complements, but does not replace, independent assurance from internal audit.

Question 49Risk Identification, Assessment and Aggregation

A firm aggregates its top ten risks by simply adding their individual risk scores. What is the main conceptual flaw in this approach?

  1. It requires Monte Carlo simulation to be valid
  2. It can only be applied to credit risk
  3. It assumes perfect positive correlation across risks Correct answer.
  4. It ignores risk owners entirely

Explanation

Simple summation treats every risk as if it moves in lockstep with every other, which is equivalent to assuming a correlation of one and ignores any diversification. As a result, aggregate exposure is generally overstated relative to a correlation-aware aggregation.

Question 50Risk Identification, Assessment and Aggregation

When does diversification benefit arise in risk aggregation?

  1. Diversification benefit is available only to insurance companies and not to banks
  2. Aggregated risk always equals the single largest risk in the portfolio regardless of correlation
  3. Aggregation mechanically increases total risk whenever pairwise correlations fall below one
  4. Aggregated risk is lower than the sum when risks are not perfectly correlated Correct answer.

Explanation

Because imperfectly correlated risks do not all peak at the same time, the aggregate exposure is less than the arithmetic sum of the individual exposures, and that difference is the diversification benefit. The benefit grows as correlations fall and disappears when correlation is one.