I85PREP
⌘ K
CISI Risk in Financial Services study materials
CISI Risk in Financial Services study resources

CISI Risk in Financial Services practice questions

One question at a time. Build your CISI Risk in Financial Services understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk and Risk Management in Financial Services

A bank's board approves a statement setting out how much loss the firm is willing to absorb from its lending activities over a one-year horizon. This statement is best described as which component of the risk management framework?

  1. The internal audit charter
  2. The compliance monitoring plan
  3. The business continuity policy
  4. The risk appetite statement Correct answer.

Explanation

A risk appetite statement quantifies the type and amount of risk the board is prepared to accept in pursuit of strategy, and it is expressed in measurable terms such as maximum acceptable loss over a defined horizon. It is set at board level and cascades into limits and tolerances used by business units.

Question 2Risk and Risk Management in Financial Services

An investment firm identifies the risk that a counterparty will fail to settle a trade on the agreed date, leaving the firm exposed to a cash shortfall. This is most precisely classified as which type of risk?

  1. Strategic risk
  2. Settlement risk Correct answer.
  3. Reputational risk
  4. Market risk

Explanation

Settlement risk, sometimes treated as a form of counterparty credit risk, arises when one party delivers value but the other does not deliver the counter-value at the expected time. Market risk concerns adverse price movements, while reputational and strategic risks relate to stakeholder perception and business decisions.

Question 3Risk and Risk Management in Financial Services

Under the three lines model, which group is primarily responsible for independently challenging and reporting on the effectiveness of a firm's risk management controls?

  1. The front-office trading desk
  2. The risk committee of the board
  3. External legal counsel
  4. Internal audit Correct answer.

Explanation

In the three lines model the first line owns and manages risk, the second line provides oversight and frameworks, and internal audit forms the third line, giving independent assurance to the board on the adequacy of controls. Its independence from management is what makes that assurance credible.

Question 4Risk and Risk Management in Financial Services

A fund manager holds a large position that could not be liquidated quickly without moving the market price. Which risk is most directly illustrated?

  1. Conduct risk
  2. Credit risk
  3. Operational risk
  4. Liquidity risk Correct answer.

Explanation

Liquidity risk has two forms: funding liquidity risk and market liquidity risk, the latter being the inability to unwind a position at or near the prevailing price. A position whose sale would depress prices is a classic market liquidity exposure.

Question 5Risk and Risk Management in Financial Services

Which control is an example of a detective control rather than a preventive control?

  1. Segregation of duties between trade entry and confirmation
  2. Daily reconciliation of client money balances against the ledger Correct answer.
  3. Dual authorisation required to release a payment
  4. Password controls restricting access to the trading system

Explanation

Detective controls identify errors or breaches after they occur, and reconciliation is the standard example because it compares records and flags differences for follow-up. Preventive controls, by contrast, are designed to stop an event happening in the first place.

Question 6Risk and Risk Management in Financial Services

A firm records a near-miss in which a dealer entered a trade at the wrong price but the error was caught before confirmation. Why is capturing near-misses valuable in operational risk management?

  1. They transfer the risk to the counterparty
  2. They remove the need to hold operational risk capital
  3. They reveal weaknesses in controls before an actual loss is suffered Correct answer.
  4. They must be reported to the regulator as reportable incidents

Explanation

Near-miss data provides early warning of control failures and shows where processes are fragile, allowing remediation before a loss event occurs. Because no loss arises, near-misses are often under-reported, so a strong culture of capturing them materially improves the quality of the risk profile.

Question 7Risk and Risk Management in Financial Services

Which statement best describes the purpose of stress testing in a financial firm?

  1. To verify that individual trade confirmations are correct
  2. To calculate the daily mark-to-market value of the trading book
  3. To assess the impact of severe but plausible scenarios on capital and liquidity Correct answer.
  4. To forecast next quarter's earnings for analyst guidance

Explanation

Stress testing explores how a portfolio or the whole firm performs under extreme but plausible conditions, including combined market, credit and funding shocks. It supports capital planning, limit setting and contingency planning rather than routine valuation or earnings forecasting.

Question 8Risk and Risk Management in Financial Services

The risk that a firm's staff sell a product that is unsuitable for a client's stated objectives, leading to redress and regulatory censure, is best classified as which risk category?

  1. Conduct risk Correct answer.
  2. Model risk
  3. Country risk
  4. Interest rate risk

Explanation

Conduct risk is the risk that the firm's behaviour towards customers and markets causes harm, leading to complaints, redress, fines and reputational damage. Suitability failures are a core conduct exposure because they arise from how products are designed and sold.

Question 9Risk and Risk Management in Financial Services

A firm's risk register records a risk as having a likelihood score of 4 on a 5-point scale and an impact score of 5. Using a simple 5x5 heat map, how should this risk be treated relative to one scored 2 and 2?

  1. It should be accepted without action because impact scores above 4 are rare
  2. It should be removed from the register once mitigation is planned
  3. It should be treated identically because both fall within the same matrix
  4. It should be prioritised for treatment because its inherent score is much higher Correct answer.

Explanation

Multiplying likelihood by impact gives an inherent score of 20 against 4, placing the first risk in a high or critical band that warrants priority treatment. Heat maps rank risks so that limited mitigation resources are directed where exposure is greatest.

Question 10Risk and Risk Management in Financial Services

A treasury team estimates that a 100 basis point rise in interest rates would reduce the value of its bond portfolio by GBP 2.4 million. Which measure is being used?

  1. The Sharpe ratio of the portfolio
  2. Expected shortfall at the 97.5% confidence level
  3. Value at risk at the 99% confidence level
  4. DV01 multiplied by the size of the rate shock Correct answer.

Explanation

DV01, the dollar value of a basis point, measures the change in value for a one basis point move, so scaling it by 100 gives the effect of a 100 basis point shift. VaR and expected shortfall are probabilistic tail measures, not deterministic sensitivity measures.

Question 11Risk and Risk Management in Financial Services

A bank holds a diversified portfolio of unsecured loans to small businesses in one region. Which change would most increase its credit concentration risk?

  1. Doubling exposure to a single large borrower in the same sector Correct answer.
  2. Shortening the average maturity of the loan book
  3. Adding loans to borrowers spread across several unrelated industries
  4. Requiring additional collateral on new lending

Explanation

Concentration risk rises when exposure is clustered in one borrower, sector or geography, because a single adverse event can affect a large share of the book at once. Diversifying across unrelated industries, taking collateral and shortening maturity all reduce, rather than increase, loss potential.

Question 12Risk and Risk Management in Financial Services

A firm's operational risk capital model relies on internal loss data, but the firm has only three years of history and few large-loss events. What is the most appropriate risk management response?

  1. Rely solely on the regulator's prescribed multiplier without adjustment
  2. Supplement internal data with external loss data and scenario analysis, and flag the limitation Correct answer.
  3. Reduce the capital estimate because the data show few losses
  4. Exclude the business line from the capital calculation

Explanation

Sparse internal loss data understates tail risk, so firms combine internal data with external consortium data, scenario analysis and business environment factors to build a more complete loss distribution. Documenting the data limitation supports governance and model validation.

Question 13Risk and Risk Management in Financial Services

A portfolio has a 1-day 99% VaR of GBP 5 million. Which interpretation is correct?

  1. The maximum possible loss on any single day is GBP 5 million
  2. The portfolio will lose exactly GBP 5 million on 99 days out of 100
  3. Losses are expected to exceed GBP 5 million on about one trading day in a hundred Correct answer.
  4. There is a 99% chance the portfolio will be profitable over the year

Explanation

VaR states that, at the given confidence level and horizon, losses should exceed the threshold only in the remaining tail of outcomes, here roughly 1% of days. It is not a worst-case loss and says nothing about the size of losses beyond the threshold.

Question 14Risk and Risk Management in Financial Services

A firm outsources its client onboarding checks to a third-party provider. Which action best reflects sound outsourcing risk management?

  1. Performing due diligence, agreeing service levels and retaining oversight of the outsourced activity Correct answer.
  2. Transferring full regulatory responsibility for onboarding to the provider
  3. Relying on the provider's own audit reports without further review
  4. Removing the activity from the operational risk register once contracted

Explanation

Outsourcing transfers the activity but not the accountability, so the firm must conduct due diligence, set contractual service levels, monitor performance and retain exit plans. Regulators expect firms to treat material outsourcing as an extension of their own control environment.

Question 15Risk and Risk Management in Financial Services

A risk manager wants to reduce the chance that a single trader can conceal a large unauthorised position. Which combination of controls is most effective?

  1. Removing the trade blotter from the reconciliation process
  2. Increasing the trader's position limit and relying on self-certification
  3. Requiring the trader to sign an annual attestation of compliance
  4. Independent limit monitoring plus mandatory leave and rotation of duties Correct answer.

Explanation

Concealment typically requires both an unchecked limit breach and continuous presence to manage the records, so independent monitoring combined with mandatory leave and rotation attacks both conditions. Self-certification and attestations rely on the honesty of the person whose behaviour is being controlled.

Question 16Risk and Risk Management in Financial Services

A firm's risk committee reviews a report showing that residual risk for a key process exceeds the approved tolerance. What is the most appropriate immediate action?

  1. Suspend publication of the risk report until the next quarter
  2. Transfer the process to a third party to remove the exposure
  3. Adjust the tolerance upward so the residual risk falls within appetite
  4. Escalate the breach, require a remediation plan with owners and dates, and monitor until within tolerance Correct answer.

Explanation

A breach of tolerance should be escalated to the appropriate governance body with a documented remediation plan, clear accountability and target dates, and tracked until the residual position returns within appetite. Changing the tolerance simply to fit the exposure undermines the credibility of the framework.

Question 17Risk and Risk Management in Financial Services

Which scenario best illustrates model risk in a financial institution?

  1. A cyber-attack disrupts the payment system for several hours
  2. A pricing model calibrated on pre-crisis data materially understates losses in a market downturn Correct answer.
  3. A client defaults on a mortgage after losing employment
  4. A dealer exceeds an approved trading limit during a volatile session

Explanation

Model risk arises when a model's outputs are wrong or misused, for example because assumptions or calibration data no longer reflect the environment. It is distinct from limit breaches, credit defaults and technology failures, although those may interact with model weaknesses.

Question 18Risk and Risk Management in Financial Services

A firm is deciding how to treat a risk that has low likelihood but catastrophic potential impact, such as a major cyber breach of client data. Which approach is most consistent with sound risk management?

  1. Accept the risk because the likelihood is low
  2. Avoid recording it on the register to prevent alarm
  3. Transfer or mitigate through insurance and robust controls, while retaining a contingency plan Correct answer.
  4. Rely on the low probability as sufficient justification for no action

Explanation

Low-likelihood, high-impact risks are poorly handled by simple expected-loss reasoning, so firms reduce them through controls, transfer part of the financial consequence through insurance, and maintain contingency and recovery plans. Acceptance without mitigation is rarely defensible for catastrophic tail events.

Question 19Risk and Risk Management in Financial Services

A bank's lending to a foreign sovereign is affected by a sudden imposition of capital controls that prevent repayment in hard currency. Which risk is this?

  1. Operational risk
  2. Settlement risk
  3. Transfer risk Correct answer.
  4. Basis risk

Explanation

Transfer risk is a subset of country risk in which a borrower cannot obtain foreign currency to service cross-border obligations, even if it is solvent in local currency. It is distinct from settlement timing failures, hedging basis mismatches and process failures.

Question 20Risk and Risk Management in Financial Services

A firm's key risk indicator for IT incidents shows a rising trend in failed log-in attempts followed by successful access from unusual locations. What does this pattern most likely indicate?

  1. A deterioration in the firm's liquidity position
  2. A routine seasonal increase in staff working remotely
  3. A possible credential compromise requiring immediate investigation Correct answer.
  4. An error in the reconciliation of client money

Explanation

Repeated failed attempts followed by successful access from unusual locations is a recognised indicator of credential stuffing or account takeover. Treating it as a trigger event for investigation and escalation is exactly how key risk indicators are meant to function.

Question 21Risk and Risk Management in Financial Services

Which arrangement best demonstrates effective segregation between the first and second lines of defence in a trading firm?

  1. A risk team whose head reports to the head of trading and whose bonuses depend on trading profit
  2. A risk function that reports independently of the trading business and has authority to challenge limits Correct answer.
  3. A risk team staffed temporarily by traders rotated from the desk
  4. A risk team that prepares the trading desk's position reports for it

Explanation

Independence in reporting lines, objectives and remuneration is what allows the second line to challenge the first line credibly. If risk staff report to, are paid by, or are staffed from the business they oversee, the challenge becomes compromised.

Question 22Risk and Risk Management in Financial Services

A firm's risk culture is weak despite comprehensive policies. Which indicator most strongly suggests this?

  1. Staff routinely escalate concerns, and near-misses are openly discussed
  2. The board reviews the risk appetite annually
  3. Risk training completion rates exceed the target
  4. Senior managers are seen to override limits without consequence Correct answer.

Explanation

Risk culture is revealed by behaviour rather than documentation, and tolerated overrides by senior staff signal that limits and policies can be ignored. Open escalation, training completion and board review are positive indicators rather than warning signs.

Question 23Risk and Risk Management in Financial Services

A firm applies a 99% one-day VaR model that has been backtested with an unusually high number of exceptions over the past year. What is the most appropriate conclusion?

  1. The confidence level should be lowered to reduce exceptions
  2. The model may understate risk and should be reviewed, with capital or limits adjusted pending validation Correct answer.
  3. The model is conservative and capital can be released
  4. The exceptions can be ignored because VaR is only an estimate

Explanation

Too many exceptions relative to the expected tail frequency suggest the model is not capturing the risk, so the firm should investigate, recalibrate and consider interim conservatism. Lowering the confidence level to suppress exceptions would mask rather than resolve the problem.

Question 24Risk and Risk Management in Financial Services

An operational risk manager is aggregating loss data across business lines. Which practice best supports a reliable operational risk capital estimate?

  1. Using only the largest single loss ever recorded as the capital figure
  2. Combining internal losses, external data, scenario analysis and business environment factors with documented assumptions Correct answer.
  3. Relying on the previous year's capital figure without recalculation
  4. Applying the average industry loss without adjustment for the firm's profile

Explanation

Sound operational risk measurement blends multiple data sources and forward-looking factors so that the tail of the loss distribution is captured, with assumptions documented for validation. Single-loss or unadjusted industry averages fail to reflect the firm's own exposure and control environment.

Question 25Risk and Risk Management in Financial Services

A firm's recovery plan identifies a severe combined shock: a market crash, a ratings downgrade and a sudden withdrawal of wholesale funding. Why is a combined scenario more useful than testing each shock separately?

  1. Because combined scenarios remove the need for a liquidity buffer
  2. Because regulators require only single-factor tests to be disclosed
  3. Because separate tests always overstate the total loss
  4. Because risks are correlated in stress, and combined shocks can exhaust liquidity and capital simultaneously Correct answer.

Explanation

In a crisis, market losses, downgrades and funding withdrawals tend to reinforce one another, so single-factor tests can understate the combined drain on capital and liquidity. Integrated scenarios reveal whether the firm's recovery options are sufficient when several pressures occur at once.

Question 26Risk and Risk Management in Financial Services

A bank's board delegates day-to-day risk oversight to a committee that reviews exposures, limits and emerging threats, while the board retains ultimate accountability for the risk framework. Which governance arrangement does this describe?

  1. A board risk committee operating under delegated authority from the board Correct answer.
  2. A first-line business unit self-assessment of its own trading limits
  3. An external regulator setting the firm's risk appetite on its behalf
  4. An internal audit function reporting directly to the chief executive

Explanation

Boards commonly delegate detailed risk oversight to a dedicated board risk committee, but accountability for the overall risk framework stays with the board. Internal audit provides independent assurance rather than managing risk, and the first line owns risk in the business. Regulators set expectations but do not set a firm's risk appetite for it.

Question 27Risk and Risk Management in Financial Services

An investment firm defines its risk appetite in terms of the maximum loss it is willing to accept in a year before its strategic objectives would be threatened. Which statement best describes the role of risk appetite in the risk management framework?

  1. It replaces the need for quantitative risk measurement across the firm
  2. It applies only to credit risk and excludes market and operational risk
  3. It sets the boundary within which the firm accepts risk in pursuit of its objectives Correct answer.
  4. It guarantees that the firm will not incur losses above the stated amount

Explanation

Risk appetite articulates how much and what types of risk a firm is willing to take to meet its objectives, and it guides limit-setting and decision-making. It is a statement of tolerance, not a guarantee against loss, and it does not remove the need for measurement. It normally spans all material risk types, not just credit risk.

Question 28Risk and Risk Management in Financial Services

A retail bank classifies the risk that a sudden surge in customer withdrawals exhausts its cash resources before assets can be sold at fair value. Under which risk category is this most appropriately recorded?

  1. Market risk
  2. Reputational risk
  3. Liquidity risk Correct answer.
  4. Strategic risk

Explanation

Liquidity risk is the risk that a firm cannot meet its obligations as they fall due without incurring unacceptable losses, including the need to sell assets at a discount. Market risk concerns adverse price movements in traded positions. Strategic and reputational risks relate to business decisions and stakeholder perception respectively.

Question 29Risk and Risk Management in Financial Services

A firm's risk function describes an event that could occur but whose probability is very low, while its potential impact is severe. Which characteristic of risk does this illustrate?

  1. That severity is determined solely by the frequency of past losses
  2. That impact is irrelevant when likelihood is negligible
  3. That likelihood and impact are separate dimensions that must both be assessed Correct answer.
  4. That low-probability events can be excluded from the risk register

Explanation

Risk is commonly assessed on two dimensions, likelihood and impact, and a low-likelihood event can still carry severe consequences. Excluding such events from the register would leave the firm blind to tail risks. Historical frequency alone is an inadequate measure of severity for rare events.

Question 30Risk and Risk Management in Financial Services

A firm's risk committee wants to compare inherent risk with residual risk for a key process. Which pair of concepts does this comparison involve?

  1. The risk before controls and the risk remaining after controls operate Correct answer.
  2. The risk disclosed to regulators and the risk disclosed to shareholders
  3. The risk measured by models and the risk measured by expert judgement
  4. The risk in the trading book and the risk in the banking book

Explanation

Inherent risk is the level of risk before any controls are applied, while residual risk is what remains once controls are in place and assessed for effectiveness. The gap between them indicates how much the controls are relied upon to reduce exposure. The other pairings describe different distinctions unrelated to control effectiveness.

Question 31Risk and Risk Management in Financial Services

A firm has identified a risk of fraud in its payments team. Management decides to purchase fidelity insurance to cover losses above a deductible. Which risk treatment approach does this represent?

  1. Reduction
  2. Avoidance
  3. Transfer Correct answer.
  4. Acceptance

Explanation

Purchasing insurance transfers part of the financial consequence of a risk to a third party, although the underlying risk and its reputational effects remain with the firm. Avoidance would mean ceasing the activity, acceptance would mean bearing the loss, and reduction would involve controls that lower likelihood or impact. Insurance is therefore classified as transfer.

Question 32Risk and Risk Management in Financial Services

A bank uses a risk map to plot its principal risks by likelihood and impact. Which action is most consistent with how such a map should be used?

  1. Prioritising resources towards risks sitting in the high-likelihood, high-impact zone Correct answer.
  2. Treating all plotted risks identically regardless of their position on the map
  3. Using the map in place of a risk register to record individual risk owners
  4. Removing low-impact risks from the map so only severe risks are shown

Explanation

A risk map is a visual prioritisation tool, and risks in the high-likelihood, high-impact quadrant typically attract the most attention and resources. It supplements rather than replaces the risk register, which captures owners, controls and actions. Removing lower-impact risks would distort the picture of the firm's overall exposure.

Question 33Risk and Risk Management in Financial Services

A firm's operational risk team is designing controls for a manual payment process. Which control is best described as a preventive control?

  1. An annual external audit of the payments function
  2. A system rule that blocks any payment above an approved limit from being released Correct answer.
  3. A quarterly review of loss events by the risk committee
  4. A daily reconciliation that detects and corrects mis-posted payments

Explanation

Preventive controls are designed to stop an error or loss occurring in the first place, such as a system rule blocking payments over an approved limit. Detective controls identify problems after they arise, and oversight or audit activities provide assurance rather than preventing the event. The distinction matters when assessing control effectiveness and residual risk.

Question 34Risk and Risk Management in Financial Services

A firm's three lines of defence model is being reviewed. Which description correctly matches a line of defence to its role?

  1. The second line executes transactions and is accountable for the resulting exposures
  2. The second line provides independent risk oversight and challenge to the first line Correct answer.
  3. The first line provides independent assurance to the board on control effectiveness
  4. The third line owns and manages risk in day-to-day business activities

Explanation

In the three lines model, the first line owns and manages risk in the business, the second line provides independent risk and compliance oversight and challenge, and the third line, internal audit, gives independent assurance. Confusing these roles weakens accountability and independence. The key feature of the second line is oversight without taking on first-line operational responsibility.

Question 35Risk and Risk Management in Financial Services

A firm's risk register entry for a cyber intrusion states that existing controls reduce the risk to within tolerance. Which action best reflects sound risk management practice following that assessment?

  1. Increase the risk appetite limit so the entry can be removed from reporting
  2. Rely solely on the initial assessment without further testing of controls
  3. Close the risk entry permanently because it is now within tolerance
  4. Monitor control effectiveness and reassess the risk periodically as threats evolve Correct answer.

Explanation

A risk assessed as within tolerance still requires ongoing monitoring, because controls can degrade and the threat environment changes. Closing the entry permanently ignores the dynamic nature of cyber risk. Raising appetite to remove an entry from reporting would mask rather than manage the exposure, and untested controls cannot be relied upon.

Question 36Risk and Risk Management in Financial Services

A firm's risk function is reviewing how it aggregates risks across business units. Which practice most undermines the reliability of a firm-wide risk profile?

  1. Applying a single agreed risk taxonomy and scoring methodology across all units
  2. Reviewing the aggregated profile with senior management and the board
  3. Combining unit-level assessments that use inconsistent likelihood and impact scales Correct answer.
  4. Reconciling aggregated exposures against finance and regulatory reporting

Explanation

Aggregation depends on comparability, so units using different scales and definitions can produce a misleading firm-wide picture. A common taxonomy, reconciliation to other reporting, and senior review all strengthen reliability. Inconsistent scoring is a common source of error when risks are rolled up across a group.

Question 37Risk and Risk Management in Financial Services

A firm's board is considering a proposal to enter a new overseas market. Which risk is most appropriately classified as strategic risk?

  1. The risk that a counterparty defaults on a loan made to a local borrower
  2. The risk that a key server fails and interrupts local trading operations
  3. The risk that the expansion fails to deliver expected returns because of poor market selection Correct answer.
  4. The risk that a currency position loses value following an exchange rate movement

Explanation

Strategic risk arises from business decisions, plans and the competitive environment, such as entering a market that proves unattractive. Counterparty default is credit risk, currency movements are market risk, and server failure is operational risk. Correct classification drives the right measurement approach and ownership.

Question 38Risk and Risk Management in Financial Services

A firm's risk committee is reviewing a proposal to reduce the number of key risk indicators it monitors. Which consideration is most important when deciding which indicators to retain?

  1. Whether each indicator has been in use for more than five years
  2. Whether each indicator produces a single number rather than a range
  3. Whether each indicator is predictive of a risk trend and linked to a specific risk appetite measure Correct answer.
  4. Whether each indicator is easy to calculate with existing spreadsheet tools

Explanation

Useful key risk indicators are forward-looking, linked to a defined risk and its appetite, and capable of triggering action before losses occur. Ease of calculation, longevity of use or output format are secondary to relevance and predictive value. Retaining indicators without a clear link to risk appetite weakens their usefulness.

Question 39Risk and Risk Management in Financial Services

A bank's risk appetite statement permits a maximum exposure to a single corporate counterparty of 5% of capital, but a proposed facility would take the exposure to 7%. Which response is most consistent with a functioning risk appetite framework?

  1. Record the excess in the risk register and take no further action
  2. Change the limit retrospectively so the exposure appears compliant
  3. Escalate the breach for approval or restructure the facility so it fits within the limit Correct answer.
  4. Approve the facility because the counterparty is highly rated and the excess is small

Explanation

Limits derived from risk appetite are binding, and exposures above them must be escalated for formal approval or reduced to fit. Credit quality does not override a limit without proper governance. Retrospective limit changes to accommodate an exposure undermine the credibility of the framework.

Question 40Risk and Risk Management in Financial Services

A firm's internal audit report finds that operational risk losses are consistently under-reported by business units. Which consequence is most likely if this persists?

  1. Regulatory reporting requirements will cease to apply to the affected units
  2. The risk appetite statement will automatically adjust to reflect the lower losses
  3. Capital and control decisions will be based on an incomplete picture of the firm's true risk profile Correct answer.
  4. The firm's reported losses will fall, demonstrating improved control effectiveness

Explanation

Loss data feeds capital modelling, control assessment and management information, so under-reporting distorts all three and can lead to under-capitalisation and misdirected controls. Falling reported losses reflect reporting behaviour, not improved control. Risk appetite and regulatory obligations are not automatically adjusted by lower reported losses.

Question 41Corporate Governance and Risk Management

Under the UK Corporate Governance Code, which body is principally responsible for determining the nature and extent of the significant risks the company is willing to take?

  1. The company secretary
  2. The board of directors Correct answer.
  3. The remuneration committee
  4. The external audit firm

Explanation

The Code places responsibility for risk governance on the board itself, including setting risk appetite and ensuring sound risk management and internal control systems. Committees support the board but do not displace its ultimate accountability for risk.

Question 42Corporate Governance and Risk Management

A non-executive director who sits on the audit committee is best described as performing which role in risk governance?

  1. Day-to-day operation of the risk management framework
  2. Independent challenge and oversight of reporting and controls Correct answer.
  3. Preparation of statutory financial statements
  4. Execution of hedging transactions

Explanation

Non-executive directors, particularly on the audit committee, provide independent scrutiny of financial reporting, risk management and internal control. They do not manage operations or prepare accounts, which remain executive functions.

Question 43Corporate Governance and Risk Management

Which arrangement best supports independence of a non-executive director on a board?

  1. Receiving a bonus linked to short-term profit targets
  2. Having recently served as the company's finance director
  3. Holding shares worth several times annual director fees
  4. Having no material business or personal relationship with the company Correct answer.

Explanation

Independence requires freedom from relationships or circumstances that could materially influence judgement. Former executive office, significant shareholdings and profit-linked pay are recognised factors that can compromise independence.

Question 44Corporate Governance and Risk Management

In the three lines model of governance, which group constitutes the 'second line'?

  1. Front-line business units that own and manage risk
  2. A risk and compliance function that monitors and advises on risk Correct answer.
  3. The board and its committees
  4. Internal audit

Explanation

The second line comprises risk management and compliance functions that develop frameworks, monitor exposures and advise the business. The first line owns and manages risk, while internal audit forms the third line of independent assurance.

Question 45Corporate Governance and Risk Management

A bank's board delegates authority to a board risk committee. Which statement correctly describes the effect of that delegation?

  1. The committee assumes legal responsibility for the bank's prudential compliance
  2. The board retains ultimate accountability while the committee performs detailed oversight Correct answer.
  3. The committee replaces internal audit in providing independent assurance
  4. The board transfers its ultimate accountability for risk to the committee

Explanation

Delegation to a committee allows detailed scrutiny of risk matters, but the board remains collectively accountable for the firm's risk governance. Committees report and recommend; they do not absorb the board's ultimate responsibility.

Question 46Corporate Governance and Risk Management

Which feature most clearly indicates a 'comply or explain' approach to corporate governance?

  1. Boards being prohibited from departing from any code provision
  2. A regulator imposing identical governance structures on every listed company
  3. Firms either following a code provision or publicly justifying any departure from it Correct answer.
  4. Governance rules applying only to state-owned enterprises

Explanation

Under comply or explain, companies must either meet a code provision or explain to shareholders why they have not, allowing flexibility for differing circumstances. It is not a rigid rulebook imposing uniform structures.

Question 47Corporate Governance and Risk Management

A firm's risk culture is weak: staff hide errors and targets are met by cutting compliance checks. Which governance response addresses the root cause most directly?

  1. Outsourcing the compliance function to a third party
  2. Increasing the volume of monthly risk reports to the board
  3. Commissioning an additional external audit of the financial statements
  4. Aligning incentives and tone from the top with escalation of bad news Correct answer.

Explanation

Weak risk culture driven by perverse incentives and fear of escalation is addressed by leadership tone and reward structures that encourage transparency. Reporting volume or external assurance does not change the behaviours causing concealment.

Question 48Corporate Governance and Risk Management

Which committee is typically responsible for overseeing the design and effectiveness of the internal control and risk management systems?

  1. The audit committee Correct answer.
  2. The remuneration committee
  3. The nomination committee
  4. The investment committee

Explanation

The audit committee usually reviews the effectiveness of internal control and risk management systems and monitors financial reporting integrity. Nomination and remuneration committees focus on board composition and executive pay respectively.

Question 49Corporate Governance and Risk Management

A chief risk officer reports functionally to the board risk committee and administratively to the chief executive. What is the main governance benefit of this arrangement?

  1. It transfers risk ownership to the risk function
  2. It reduces the risk function's operating budget
  3. It gives the risk function independent access to the board while remaining embedded in management Correct answer.
  4. It removes the need for a board risk committee

Explanation

A dual reporting line preserves independence and escalation to the board while keeping the risk function connected to executive decision-making. It does not shift risk ownership, which stays with the business.

Question 50Corporate Governance and Risk Management

What is the primary purpose of a board-approved risk appetite statement?

  1. To define the amount and type of risk the firm is willing to accept in pursuit of its objectives Correct answer.
  2. To set the salaries of risk function staff
  3. To replace the firm's enterprise risk management framework
  4. To list every operational incident that occurred during the year

Explanation

A risk appetite statement articulates the level and types of risk the board is prepared to accept, guiding strategy and setting boundaries for management. It complements rather than replaces the wider risk framework.