I85PREP
⌘ K
CIMA P3 Risk Management study materials
CIMA P3 Risk Management study resources

CIMA P3 Risk Management practice questions

One question at a time. Build your CIMA P3 Risk Management understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Enterprise risk management

In enterprise risk management, which statement best distinguishes risk appetite from risk tolerance?

  1. Risk tolerance is set only by internal audit, while risk appetite is set by external regulators.
  2. Risk tolerance is the maximum risk an organisation can bear before insolvency, while appetite is the daily limit for trading.
  3. Risk appetite applies only to financial risks, while tolerance applies to operational risks.
  4. Risk appetite is the total amount of risk an organisation is willing to accept in pursuit of objectives, while tolerance is the acceptable variation around a specific risk limit. Correct answer.

Explanation

Risk appetite expresses the broad amount and type of risk an entity is willing to pursue to meet its objectives, usually stated qualitatively and quantitatively. Risk tolerance then translates that appetite into measurable boundaries or acceptable variation for individual risks and activities.

Question 2Enterprise risk management

A board states that the company will not accept any risk that could breach its banking covenants. Which component of the risk management framework does this statement primarily represent?

  1. A key risk indicator threshold
  2. A risk appetite boundary Correct answer.
  3. An inherent risk rating
  4. A residual risk score

Explanation

A statement defining risks the organisation will not accept establishes a boundary within its risk appetite. It guides decisions on which risks are acceptable before any measurement or monitoring indicators are applied.

Question 3Enterprise risk management

Which three lines together form the 'three lines model' of governance and assurance in enterprise risk management?

  1. Operational management, a risk and compliance function, and internal audit Correct answer.
  2. Front office, back office and the regulator
  3. Management, internal audit and external audit
  4. The board, the audit committee and the shareholders

Explanation

The three lines model separates management ownership of risk, an independent risk and compliance oversight function, and independent assurance from internal audit. This structure clarifies accountability and avoids conflicts of interest in assurance.

Question 4Enterprise risk management

Under COSO ERM, which component deals with identifying and assessing risks that could affect the achievement of strategy and objectives?

  1. Strategy and objective-setting
  2. Performance Correct answer.
  3. Review and revision
  4. Governance and culture

Explanation

In the COSO ERM framework the performance component covers identifying, assessing and prioritising risks, and then selecting and implementing risk responses. It links day-to-day risk assessment to the strategy set earlier in the framework.

Question 5Enterprise risk management

Which of the following is the most appropriate role for a risk committee of the board?

  1. Overseeing the risk management framework and advising the board on risk appetite and exposures Correct answer.
  2. Preparing detailed risk registers for each operational department
  3. Approving individual customer credit applications
  4. Independently auditing the effectiveness of internal controls

Explanation

A board risk committee provides oversight of the risk framework and advises the board on appetite, exposures and emerging risks. It does not perform operational risk work or independent audit, which would compromise the three lines structure.

Question 6Enterprise risk management

A company identifies a risk that a key supplier may fail. Which response is a 'risk transfer' approach?

  1. Reducing order volumes from that supplier
  2. Purchasing business interruption insurance covering supplier failure Correct answer.
  3. Accepting the risk because the impact is low
  4. Building a second source of supply

Explanation

Risk transfer shifts the financial consequences of a risk to a third party, typically through insurance or contractual arrangements. Buying insurance for supplier failure transfers the loss exposure to the insurer.

Question 7Enterprise risk management

Which of the following best describes inherent risk?

  1. The level of risk before any controls or mitigation are taken into account Correct answer.
  2. The risk remaining after controls have been applied
  3. The risk that arises only from external events
  4. The risk that a control will fail to operate as designed

Explanation

Inherent risk is the gross exposure that exists before any controls or mitigation are applied. Comparing it with residual risk helps show the value added by controls.

Question 8Enterprise risk management

Which statement best explains why enterprise risk management is described as 'portfolio' or 'aggregated'?

  1. It requires all risks to be insured with a single insurer
  2. It aggregates and correlates risks across the organisation to understand total exposure and diversification effects Correct answer.
  3. It limits risk management to the finance function
  4. It treats each risk in isolation so that departments can manage independently

Explanation

Enterprise risk management looks at risks across the whole organisation and considers how they interact and aggregate. This portfolio view reveals concentrations and natural offsets that silo-based risk management would miss.

Question 9Enterprise risk management

A firm's risk register records a risk with a likelihood score of 4 and an impact score of 5 on a 5-point scale. Using a simple multiplication heat map, what is the risk score and how is it typically classified?

  1. 1, classified as negligible
  2. 9, classified as low
  3. 45, classified as extreme
  4. 20, classified as high Correct answer.

Explanation

Multiplying likelihood by impact gives 4 x 5 = 20. On a 5x5 heat map this sits in the top band and is normally treated as a high or significant risk requiring senior attention.

Question 10Enterprise risk management

A company decides to accept a risk because the cost of controlling it exceeds the expected loss. Which concept best justifies this decision?

  1. Control self-assessment
  2. Risk capacity
  3. Risk transfer
  4. Cost-benefit analysis of risk response Correct answer.

Explanation

Comparing the cost of a control with the expected loss it prevents is a cost-benefit analysis, which underpins rational risk response decisions. Where the control costs more than the loss it avoids, retention may be justified within appetite.

Question 11Enterprise risk management

Which of the following best describes a 'key risk indicator' (KRI)?

  1. A list of all risks recorded in the register
  2. A financial ratio used only in annual reporting
  3. A metric that provides early warning of increasing risk exposure relative to appetite Correct answer.
  4. The maximum loss an organisation can absorb

Explanation

A KRI is a forward-looking metric designed to signal rising exposure or deteriorating control environment before losses occur. It is linked to risk appetite thresholds so that breaches trigger escalation.

Question 12Enterprise risk management

In the context of risk governance, what is the primary purpose of a 'risk owner'?

  1. To set the organisation's overall risk appetite
  2. To hold accountability for managing a specific risk and its response within delegated authority Correct answer.
  3. To audit the effectiveness of controls
  4. To provide independent assurance over the risk framework

Explanation

A risk owner is accountable for a particular risk, including monitoring it and ensuring an appropriate response is implemented. This assigns clear responsibility within the first line of defence.

Question 13Enterprise risk management

A bank uses a scenario analysis workshop to estimate the impact of a severe but plausible cyber attack. Which benefit does this technique primarily offer in enterprise risk management?

  1. It guarantees that the event will not occur
  2. It removes the need for a risk register
  3. It replaces the need for internal controls
  4. It helps quantify low-frequency, high-impact risks that historical data may not capture Correct answer.

Explanation

Scenario analysis explores plausible but rare events for which historical loss data is sparse, helping estimate potential impacts. It supports capital planning and response design for tail risks.

Question 14Enterprise risk management

Which of the following is the best example of a 'risk appetite statement' being translated into an operational limit?

  1. The treasury function sets a maximum counterparty exposure of 10% of cash balances Correct answer.
  2. The company publishes its annual report
  3. The board states the company is conservative about reputational risk
  4. The internal audit plan covers all major business units

Explanation

A numerical limit such as a maximum counterparty exposure operationalises the appetite into a measurable boundary that can be monitored. It converts a qualitative appetite into an enforceable control.

Question 15Enterprise risk management

A company's risk register shows a risk with high inherent risk but low residual risk. What does this most likely indicate?

  1. The controls in place are effective at reducing the exposure Correct answer.
  2. The risk appetite has been exceeded
  3. The risk has been incorrectly identified
  4. No controls have been applied

Explanation

A large gap between inherent and residual risk suggests that controls are effectively mitigating the exposure. The residual level reflects the risk remaining after those controls operate.

Question 16Enterprise risk management

Which of the following best explains the concept of 'risk capacity'?

  1. The risk of a control failing
  2. The maximum level of risk an organisation can bear before breaching its objectives or solvency Correct answer.
  3. The amount of risk the board is willing to accept
  4. The risk remaining after mitigation

Explanation

Risk capacity is the maximum risk an entity can absorb given its capital and obligations before it breaches objectives or becomes insolvent. Appetite should be set within, and usually below, that capacity.

Question 17Enterprise risk management

An organisation embeds risk management into its strategic planning cycle so that risks are assessed before major investment decisions. Which benefit does this integration primarily deliver?

  1. It transfers strategic risk to insurers
  2. It removes the need for board oversight
  3. It eliminates all strategic uncertainty
  4. It aligns risk-taking with strategy and appetite at the point decisions are made Correct answer.

Explanation

Integrating risk assessment into strategy ensures that risk appetite informs decisions when they matter most, rather than as an afterthought. This improves the quality of strategic decision-making and alignment with appetite.

Question 18Enterprise risk management

Which of the following is a limitation of using a risk heat map for prioritising risks?

  1. It can only be applied to financial risks
  2. It requires external auditors to construct it
  3. It may give a false sense of precision because scores are subjective and ignore correlations between risks Correct answer.
  4. It cannot display likelihood and impact together

Explanation

Heat maps rely on subjective scoring and typically treat risks independently, which can understate correlated or compounding exposures. The apparent precision of a score can therefore mislead prioritisation.

Question 19Enterprise risk management

A company's risk committee reviews a proposal to enter a new market. The expected return is attractive, but the maximum potential loss would exceed the firm's capital buffer. Which conclusion is most appropriate?

  1. Reject or restructure the proposal because it exceeds risk capacity Correct answer.
  2. Proceed only if the risk is transferred in full to a third party
  3. Proceed because the risk committee can raise appetite after the decision
  4. Proceed because the expected return is positive

Explanation

If the maximum potential loss exceeds the capital buffer, the proposal breaches risk capacity, which is a hard constraint. The proposal should be rejected or restructured so the exposure fits within capacity and appetite.

Question 20Enterprise risk management

Which of the following best describes the purpose of a 'risk appetite framework'?

  1. To calculate the organisation's insurance premiums
  2. To document individual control testing results
  3. To link risk appetite statements to risk limits, monitoring and governance so that risk-taking is managed within agreed boundaries Correct answer.
  4. To replace the risk register with a single score

Explanation

A risk appetite framework connects high-level appetite statements to operational limits, monitoring metrics and escalation routes. It makes appetite actionable and provides a basis for governance and reporting.

Question 21Enterprise risk management

An organisation uses a 'bow-tie' analysis. What does this technique primarily illustrate?

  1. The audit committee's meeting schedule
  2. The causes that could lead to a risk event and the consequences that could follow, together with the barriers between them Correct answer.
  3. The profitability of a business unit
  4. The regulatory capital requirement

Explanation

Bow-tie analysis maps threats and causes on one side, consequences on the other, and the preventive and mitigative barriers in between. It is used to visualise controls around a specific risk event.

Question 22Enterprise risk management

In the three lines model, a compliance function that sets policy and monitors adherence but does not own operational risk decisions is best described as which line?

  1. External assurance provider
  2. Second line Correct answer.
  3. Third line
  4. First line

Explanation

The second line provides independent oversight, policy setting and monitoring of risk and compliance while operational management retains ownership of risk. This separation preserves objectivity in oversight.

Question 23Enterprise risk management

A firm applies a control that reduces the likelihood of a risk but does nothing to reduce its impact. In bow-tie terms, this control is best described as:

  1. A risk transfer arrangement
  2. A residual risk
  3. A preventive barrier acting on causes Correct answer.
  4. A mitigating barrier acting on consequences

Explanation

Controls that reduce likelihood act on the causes or threats before the event and are preventive barriers. Controls that reduce impact act on consequences and are mitigative barriers.

Question 24Enterprise risk management

A board is concerned that its risk register has become a static compliance document. Which change would most improve its value for enterprise risk management?

  1. Restrict access to the register to the audit committee only
  2. Increase the number of risks listed to cover every conceivable event
  3. Replace the register with an annual insurance renewal
  4. Link each risk to objectives, owners, appetite thresholds and monitoring indicators, and review it regularly Correct answer.

Explanation

A register adds value when it connects risks to objectives, accountability, appetite limits and live indicators, and is reviewed as conditions change. This turns it from a static list into an active management tool.

Question 25Enterprise risk management

An organisation's aggregated risk exposure exceeds the sum of individual risk exposures because several risks are positively correlated. What is the main implication for enterprise risk management?

  1. The risk register should be abandoned
  2. Correlation can be ignored because individual risks are managed separately
  3. Correlation always reduces total exposure, so no action is needed
  4. Aggregation must account for correlation, as concentrated exposures can breach capacity even when each risk appears acceptable alone Correct answer.

Explanation

Positive correlation means risks tend to crystallise together, so aggregate exposure can exceed the simple sum of individual exposures. Enterprise risk management must capture these concentrations to assess capacity and appetite breaches.

Question 26Enterprise risk management

Which statement best describes the difference between risk appetite and risk tolerance?

  1. Risk appetite applies only to financial risks, while tolerance applies only to operational risks
  2. Risk appetite is the amount of risk an organisation is willing to seek for reward, while tolerance is the maximum deviation it can absorb before action is triggered Correct answer.
  3. Risk appetite is measured after controls, while tolerance is measured before controls
  4. Risk appetite is set by regulators, while risk tolerance is set internally by the audit committee

Explanation

Risk appetite expresses the level and type of risk an organisation actively wants to take in pursuit of objectives, whereas risk tolerance (or risk limit) defines the acceptable variation around that appetite before escalation is required. The two concepts are complementary: appetite sets direction, tolerance sets boundaries for monitoring.

Question 27Enterprise risk management

A risk manager records the level of risk that exists before any controls are applied. Which term describes this measure?

  1. Inherent risk Correct answer.
  2. Secondary risk
  3. Target risk
  4. Residual risk

Explanation

Inherent (or gross) risk is the exposure that exists in the absence of controls, providing a baseline against which the effectiveness of mitigation can be judged. Residual risk is what remains after controls are applied.

Question 28Enterprise risk management

Which of the following is the clearest example of a risk 'avoidance' response?

  1. Withdrawing from a product market where regulatory penalties are judged unacceptably high Correct answer.
  2. Accepting a small currency exposure because hedging costs exceed likely losses
  3. Installing sprinklers to reduce fire damage in a factory
  4. Purchasing insurance against flood damage to a warehouse

Explanation

Avoidance means exiting the activity that generates the risk entirely, so the exposure is eliminated rather than reduced or shared. Withdrawing from a market removes the source of the regulatory risk.

Question 29Enterprise risk management

In the three lines model, which group is primarily responsible for providing independent assurance to the board on the effectiveness of risk management?

  1. The external auditor appointed by shareholders
  2. The risk and compliance functions in the second line
  3. Operational management in the first line
  4. Internal audit in the third line Correct answer.

Explanation

Internal audit forms the third line and provides independent, objective assurance to the governing body on how effectively risk management and internal control are designed and operating. The second line supports and monitors, while the first line owns and manages risk.

Question 30Enterprise risk management

Which of the following best describes the purpose of a risk register?

  1. To list every control in operation so that auditors can test them individually
  2. To record identified risks with their owners, assessments and responses so they can be monitored and managed Correct answer.
  3. To document the organisation's statutory financial disclosures for external reporting
  4. To provide a single forecast of the organisation's expected future cash flows

Explanation

A risk register is the central record of identified risks, capturing attributes such as cause, consequence, likelihood, impact, owner, existing controls and planned responses. Its value lies in enabling tracking, prioritisation and accountability over time.

Question 31Enterprise risk management

An organisation defines its risk universe by grouping exposures into strategic, operational, financial and compliance categories. What is the main benefit of this classification?

  1. It ensures all risks receive identical treatment regardless of materiality
  2. It allows risks to be allocated to the specialist functions best placed to manage them and supports consistent reporting Correct answer.
  3. It guarantees that no risk can ever be omitted from the register
  4. It removes the need to assess likelihood and impact for each risk

Explanation

Categorising the risk universe supports ownership by the most relevant function and enables consistent aggregation and reporting by category to the board. It is a structuring device, not a guarantee of completeness.

Question 32Enterprise risk management

Which statement best explains the concept of 'risk culture' within an enterprise risk management framework?

  1. The software system used to record and report risk data
  2. The documented set of risk policies approved by the board
  3. The shared values, attitudes and behaviours that determine how people identify and respond to risk in practice Correct answer.
  4. The process of quantifying risk using statistical models

Explanation

Risk culture concerns the behavioural reality of how risk is treated day to day, including tone from the top, incentives and willingness to escalate bad news. Policies and systems are artefacts that support culture but do not define it.

Question 33Enterprise risk management

Which of the following is the best example of a 'risk owner' discharging their responsibility?

  1. The board approving the annual report and accounts
  2. The finance director monitoring a currency exposure and reporting movement against its approved limit Correct answer.
  3. The internal auditor testing whether a control operates as designed
  4. The external consultant designing a risk register template

Explanation

A risk owner is accountable for managing a specific risk, which includes monitoring exposure against limits and escalating when thresholds are breached. This is an active management activity, not assurance or design work.

Question 34Enterprise risk management

A company's risk committee wants to express its appetite for health and safety risk in a way that can be monitored monthly. Which approach best achieves this?

  1. Delegating all safety decisions to site supervisors without further reporting
  2. Setting a quantitative limit such as zero serious injuries and a maximum number of lost-time incidents per 1,000 employees Correct answer.
  3. Adopting a qualitative statement that the company 'takes safety seriously'
  4. Reviewing safety performance once every three years at the strategy away-day

Explanation

An operational limit converts appetite into a measurable threshold that can be tracked against actual performance and triggers escalation on breach. Qualitative aspirations alone are not monitorable.

Question 35Enterprise risk management

A risk has a likelihood of 2 and an impact of 5 on a 5-point scale. Controls are then applied that reduce impact to 2 while likelihood stays at 2. Which statement is correct?

  1. The inherent score is 10 and the residual score is 4 Correct answer.
  2. The inherent score falls from 10 to 4 and the residual score is 4
  3. Both inherent and residual scores are 10 because likelihood is unchanged
  4. The inherent score is 4 and the residual score is 10

Explanation

Inherent risk uses the pre-control ratings, giving 2 × 5 = 10, while residual risk uses the post-control ratings, giving 2 × 2 = 4. The reduction shows the effect of the controls on impact.

Question 36Enterprise risk management

A treasury team identifies that a proposed hedging strategy would itself create a new exposure to counterparty default. Which term describes this exposure?

  1. Secondary risk Correct answer.
  2. Inherent risk
  3. Compliance risk
  4. Residual risk

Explanation

Secondary risk is a new risk created as a direct consequence of implementing a risk response. Hedging reduces currency exposure but introduces counterparty exposure to the hedging instrument provider.

Question 37Enterprise risk management

A risk manager is selecting a technique to examine how combinations of small operational failures could together produce a major service outage. Which technique is most appropriate?

  1. A credit scoring model applied to the customer base
  2. A cost-benefit analysis of a proposed marketing campaign
  3. A fault tree analysis starting from the outage event and working back to combinations of causes Correct answer.
  4. A single risk's expected value calculation using historical loss data

Explanation

Fault tree analysis works deductively from a defined top event and maps the logical combinations of underlying failures that could cause it, making it well suited to modelling compounding operational failures.

Question 38Enterprise risk management

Which of the following best describes the role of a board risk committee?

  1. To prepare the organisation's financial statements for external audit
  2. To oversee the risk management framework and advise the board on risk appetite and major exposures Correct answer.
  3. To manage day-to-day operational risks on behalf of business units
  4. To conduct independent audits of internal controls

Explanation

A board risk committee provides oversight of the risk framework, challenges management on major exposures and recommends appetite to the board. It does not take on the management of operational risks or assurance work.

Question 39Enterprise risk management

An organisation decides to centralise its risk reporting so that all business units use the same risk categories, scoring scales and reporting templates. Which benefit does this standardisation primarily deliver?

  1. It transfers accountability for risks from business units to the central risk function
  2. It enables aggregation and comparison of risks across the enterprise Correct answer.
  3. It guarantees that all identified risks are fully controlled
  4. It eliminates the need for judgement in risk assessment

Explanation

Common taxonomies and scales allow risks from different units to be compared and combined into an enterprise-level view, which is central to enterprise risk management. Judgement and ownership remain with the business.

Question 40Enterprise risk management

A risk practitioner is assessing the effectiveness of an existing control over a key financial process. Which question is most relevant to evaluating whether the control is adequate?

  1. Whether the control is documented in the longest section of the risk policy
  2. Whether the control was recommended by an external consultant
  3. Whether the control is designed to address the specific cause of the risk and operates consistently Correct answer.
  4. Whether the control adds to the number of controls recorded in the register

Explanation

Control adequacy depends on whether the control actually addresses the identified cause or consequence and whether it operates reliably over time. Design fit and consistent operation are the substantive tests.

Question 41Enterprise risk management

A company identifies a risk of key staff leaving during a major systems implementation. Which response is best classified as 'reduce' rather than 'transfer' or 'avoid'?

  1. Introducing retention bonuses and cross-training so critical knowledge is shared Correct answer.
  2. Accepting the risk because recruitment markets may improve
  3. Buying key-person insurance covering the cost of replacement
  4. Deciding to postpone the implementation indefinitely

Explanation

Reduction (mitigation) lowers the likelihood or impact of the risk through actions within the organisation's control, such as retention incentives and knowledge sharing. Insurance transfers the financial consequence rather than lowering the risk itself.

Question 42Enterprise risk management

Which of the following best explains why emerging risks are difficult to manage within a conventional risk register?

  1. They lack reliable historical data and may not yet be recognised as risks Correct answer.
  2. They are always too small to warrant management attention
  3. They can only be identified by external auditors
  4. They are excluded by definition from enterprise risk management frameworks

Explanation

Emerging risks are new or evolving and therefore have little or no loss history, making likelihood and impact assessment highly uncertain and identification itself challenging. Techniques such as horizon scanning and scenario analysis are used to address this.

Question 43Enterprise risk management

A firm uses a risk matrix with likelihood and impact axes but finds that many risks cluster in the same cell, making prioritisation difficult. Which improvement is most appropriate?

  1. Add a third dimension such as velocity or control effectiveness and define the scale descriptors precisely Correct answer.
  2. Ask each business unit to use its own bespoke scale
  3. Remove the impact axis and prioritise on likelihood alone
  4. Increase the matrix to a 100-point scale without changing the descriptors

Explanation

Clustering reflects coarse or ambiguous scales; refining descriptors and adding a relevant dimension such as velocity of onset or control effectiveness improves discrimination between risks. Simply enlarging the scale without better descriptors does not solve the ambiguity.

Question 44Enterprise risk management

A company's internal audit function reports directly to the audit committee and has no operational responsibilities. Which principle of the three lines model does this arrangement best illustrate?

  1. Independence of the third line from management Correct answer.
  2. Reliance on external auditors for internal assurance
  3. Centralisation of all controls within the second line
  4. Delegation of risk ownership to assurance providers

Explanation

Reporting to the audit committee and avoiding operational duties preserves the objectivity and independence that allow internal audit to provide unbiased assurance. Independence is the defining attribute of the third line.

Question 45Enterprise risk management

An organisation defines a risk as 'the effect of uncertainty on objectives'. Which implication follows most directly from this definition?

  1. Risk includes both threats and opportunities relative to objectives Correct answer.
  2. Risk is limited to hazards that can be insured
  3. Risk can only be negative and should always be minimised
  4. Risk is solely a matter of financial volatility

Explanation

Because risk is defined in relation to objectives and uncertainty, it encompasses both downside threats and upside opportunities. Enterprise risk management therefore considers potential gains as well as losses.

Question 46Enterprise risk management

A group operates in several countries and wants to set risk appetite at group level while allowing local variation. Which design is most consistent with good practice?

  1. Group appetite set only after each year's results are known
  2. Local management setting appetite independently with no group oversight
  3. A single group limit applied identically in every country with no local discretion
  4. Group-level appetite statements supported by local limits calibrated to local conditions and reported upward Correct answer.

Explanation

Effective frameworks set appetite at group level and translate it into limits appropriate to local circumstances, with upward reporting so the group can monitor aggregate exposure. This balances consistency with local relevance.

Question 47Enterprise risk management

A risk committee observes that a business unit consistently reports low residual risk for projects that subsequently experience large losses. Which explanation is most plausible?

  1. The unit is overstating the effectiveness of its controls when assessing residual risk Correct answer.
  2. The committee has delegated too much authority to internal audit
  3. The risk matrix has too many likelihood bands
  4. The unit's inherent risk assessments are systematically too high

Explanation

A persistent gap between reported residual risk and actual outcomes points to optimistic assessment of control effectiveness, producing understated residual ratings. Validation, independent challenge and loss-event back-testing are appropriate responses.

Question 48Enterprise risk management

A firm wants to combine a set of risks that are not perfectly correlated into a single enterprise view. Which approach best reflects the portfolio effect?

  1. Summing the individual worst-case losses to give a conservative total
  2. Taking the highest single risk score as the enterprise exposure
  3. Averaging the individual risk scores to produce a single rating
  4. Using a correlation-aware aggregation such as a Monte Carlo simulation of the combined distribution Correct answer.

Explanation

Correlation-aware simulation captures diversification, so the combined loss distribution differs from the simple sum of individual exposures. This provides a more realistic enterprise view than arithmetic aggregation.

Question 49Enterprise risk management

A board is reviewing whether its risk appetite statement is effective. Which characteristic most strongly indicates a well-designed statement?

  1. It is reviewed only when a loss event occurs
  2. It lists every risk in the register with an identical tolerance
  3. It specifies the types and levels of risk acceptable in pursuit of strategy and links to measurable limits Correct answer.
  4. It contains aspirational language that cannot be measured

Explanation

An effective appetite statement is specific about the risk types the organisation will accept, is aligned to strategy and is expressed through limits that can be monitored. This makes it operational rather than merely aspirational.

Question 50Enterprise risk management

An organisation wishes to strengthen its risk culture after several near-misses were not escalated. Which intervention addresses the root cause most directly?

  1. Introducing protected upward escalation channels and rewarding staff who raise concerns early Correct answer.
  2. Increasing the number of risk reports submitted to the board
  3. Outsourcing risk assessment to an external adviser
  4. Adding more detailed risk scoring scales to the register

Explanation

Failure to escalate near-misses typically reflects fear of blame or unclear channels, so psychological safety and recognised escalation routes address the behavioural root cause. More reporting or scoring does not change incentives to speak up.