I85PREP
⌘ K
IFoA SP9 study materials
IFoA SP9 study resources

IFoA SP9 practice questions

One question at a time. Build your IFoA SP9 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Enterprise risk management framework and governance

Which feature most clearly distinguishes enterprise risk management from a traditional, silo-based approach to risk management?

  1. It delegates all risk decisions to individual business units to speed up response.
  2. It relies primarily on internal audit to identify and own material risks.
  3. It aggregates all risk types into an enterprise-wide portfolio view. Correct answer.
  4. It concentrates on insurable hazard risks that can be transferred to insurers.

Explanation

Enterprise risk management is distinguished by an integrated, portfolio perspective across all risk categories and business units, rather than managing risks in separate silos. It supports a consistent risk appetite and coordinated reporting to the board.

Question 2Enterprise risk management framework and governance

Under the three lines of defence model, which activity is performed by the second line?

  1. Owning and managing the risks that arise in day-to-day operations.
  2. Setting the organisation's strategic objectives and risk appetite.
  3. Providing independent oversight and challenge of risk management activities. Correct answer.
  4. Giving independent assurance to the board on the effectiveness of controls.

Explanation

The second line provides risk oversight, policy setting, monitoring and challenge, independent of the operational units that take risk. The first line owns and manages risk, while internal audit as the third line gives independent assurance.

Question 3Enterprise risk management framework and governance

An insurer is drafting a risk appetite framework. Which element most directly connects the stated appetite to everyday decision-making?

  1. A statement that the company aims to be a market leader in customer service.
  2. Quantified risk limits and tolerances allocated to business units. Correct answer.
  3. An annual risk awareness training programme for all employees.
  4. A list of all identified risks in the corporate risk register.

Explanation

Risk appetite is made operational through quantified limits and tolerances that translate the board's statement into constraints managers must respect. A risk register, strategic aspiration or training programme may support risk management but does not itself cascade appetite into decisions.

Question 4Enterprise risk management framework and governance

Which decision properly belongs to the board risk committee rather than to executive management?

  1. Selecting the software vendor for the enterprise risk management system.
  2. Approving the group's overall risk appetite and tolerance levels. Correct answer.
  3. Setting the agenda for the annual risk awareness training programme.
  4. Designing the methodology used to calculate operational risk capital.

Explanation

Board risk committees provide oversight and approve the risk appetite framework and tolerances on behalf of the board. Methodology design, procurement and training agendas are management responsibilities executed within that approved framework.

Question 5Enterprise risk management framework and governance

An insurer wants to strengthen the independence of its chief risk officer. Which arrangement best supports that objective?

  1. The CRO chairs the remuneration committee that determines trading bonuses for front-office staff.
  2. The CRO reports directly to the head of the largest underwriting division, aligning risk with business priorities.
  3. The CRO reports to the CEO and has direct access to the board risk committee. Correct answer.
  4. The CRO's variable pay is linked primarily to growth in gross written premium and market share.

Explanation

Independence is supported by a reporting line to the CEO combined with direct, unfettered access to the board risk committee. Reporting to a business line or having pay tied to business growth compromises the CRO's ability to challenge.

Question 6Enterprise risk management framework and governance

Under Solvency II, what is the primary purpose of the Own Risk and Solvency Assessment (ORSA)?

  1. To replace the standard formula with a regulator-approved internal model for capital.
  2. To publish the insurer's solvency and financial condition report to policyholders each year.
  3. To set out the insurer's own forward-looking assessment of its solvency needs. Correct answer.
  4. To calculate the minimum capital requirement using prescribed regulatory factors and simple proportions.

Explanation

The ORSA requires each insurer to assess its overall solvency needs in light of its own risk profile and to look forward over its business plan. It is a continuous internal process, not a capital formula or a public disclosure document.

Question 7Enterprise risk management framework and governance

Which observation is the strongest leading indicator of a weak risk culture in a financial firm?

  1. Regular risk training attended by the majority of employees.
  2. Staff describing escalation of concerns as damaging to their careers. Correct answer.
  3. Risk committee minutes showing robust debate and recorded challenge.
  4. A high number of near misses reported by front-office staff.

Explanation

Risk culture is revealed by how people behave when they raise concerns, and fear of career damage suppresses escalation. High near-miss reporting and recorded challenge generally indicate a healthy, transparent culture.

Question 8Enterprise risk management framework and governance

The COSO Enterprise Risk Management framework (2017) is organised around five components. Which of the following is one of them?

  1. Strategy and objective-setting. Correct answer.
  2. Capital allocation and transfer pricing.
  3. Internal audit and assurance mapping.
  4. Regulatory reporting and disclosure.

Explanation

The five COSO ERM components are governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting. Capital allocation, regulatory reporting and internal audit are not components of that framework.

Question 9Enterprise risk management framework and governance

A board is reviewing its ERM framework. Which feature best indicates that risk management is genuinely embedded rather than merely compliance-driven?

  1. The risk register is updated quarterly by the risk function and filed with the regulator.
  2. Every business unit has a risk policy document signed off by its head of department.
  3. The internal audit plan covers all major risk categories on a three-year cycle.
  4. Risk information is used routinely in strategic planning and capital allocation decisions. Correct answer.

Explanation

Embedding means risk considerations shape real decisions such as strategy, pricing and capital allocation, not merely documentation. Registers, policies and audit cycles are necessary infrastructure but can exist without genuine use.

Question 10Enterprise risk management framework and governance

Under Solvency II, an insurer has an approved internal model but uses it only to calculate the solvency capital requirement. Which statement best describes the regulatory concern?

  1. The insurer must switch to the standard formula until the model is used more widely across the group.
  2. The model automatically ceases to be approved at the start of a new financial year.
  3. It fails the use test: the model must inform risk management and decisions. Correct answer.
  4. There is no concern, because capital calculation is the model's primary purpose.

Explanation

The use test requires internal model outputs to be widely used in risk management, governance and decision-making, not merely for regulatory capital. A model used only for the solvency capital requirement calculation is likely to fail that test.

Question 11Enterprise risk management framework and governance

An insurer is setting up a board risk committee. Which composition best supports independent oversight of the firm's risk profile?

  1. The finance director as chair, with the external auditor as a standing member
  2. A majority of executive directors, chaired by the chief executive officer
  3. A majority of independent non-executive directors, chaired by one of them Correct answer.
  4. The chief risk officer as chair, with the remaining members drawn from executive management

Explanation

Independent non-executive directors provide challenge to executive management, and an independent chair prevents the committee from being dominated by the executives whose risks it oversees. Executives and the chief risk officer may attend, but they should not control the committee.

Question 12Enterprise risk management framework and governance

To protect the independence of the third line of defence, the internal audit function should report functionally to which body?

  1. The external auditor
  2. The board audit committee Correct answer.
  3. The chief financial officer
  4. The chief executive officer

Explanation

Functional reporting to the audit committee preserves internal audit's objectivity and gives it a direct route to the board when concerns arise. Administrative reporting may sit with management, but the functional line should not.

Question 13Enterprise risk management framework and governance

An insurer's board is delegating parts of its ERM responsibilities. Which delegation is consistent with sound governance?

  1. The board delegates formal approval of the ERM framework to the board audit committee.
  2. The board delegates formal approval of the risk appetite statement to the chief risk officer.
  3. The board retains approval of risk appetite and the ERM framework; management implements them. Correct answer.
  4. The board delegates all risk oversight to the executive committee and reviews that delegation annually.

Explanation

The board owns the ERM framework and the risk appetite, while management is responsible for implementing them within that framework. Delegating approval of either to management or to a committee that does not own the risk removes a key board control.

Question 14Enterprise risk management framework and governance

An insurer's variable pay scheme rewards sales staff for new business volume, with no adjustment for the risk or profitability of the business written. Which governance action most directly addresses the risk culture concern?

  1. Introduce risk-adjusted, deferred variable pay with clawback for poor outcomes Correct answer.
  2. Publish a revised code of conduct and ask staff to confirm they have read it
  3. Require the chief risk officer to review all sales presentations before issue
  4. Increase the number of compliance training sessions for sales staff each year

Explanation

Variable pay is one of the strongest signals of what the firm actually rewards, so risk adjustment, deferral and clawback directly counter balance volume-only incentives. Training and codes support awareness but do not change the payoff for risky behaviour.

Question 15Enterprise risk management framework and governance

A board is establishing governance over the models used for pricing and capital. Which arrangement is most appropriate?

  1. The board risk committee personally reviews every model parameter change before use
  2. The external auditor maintains the model inventory and approves all model changes
  3. Independent validation of material models, with findings reported to the board risk committee Correct answer.
  4. Model owners validate their own models before use, with results filed by the chief risk officer

Explanation

Independent validation is the core control in model risk governance, and material findings should reach the board risk committee. Model owners cannot objectively validate their own models, and the board should not be approving individual parameter changes.

Question 16Enterprise risk management framework and governance

Each material risk in an insurer's enterprise risk register should be owned by...

  1. The chief risk officer, because the risk function is responsible for maintaining the register
  2. The board risk committee, because it provides independent oversight of the risk register
  3. The internal audit function, because it provides independent assurance over the risk register
  4. The business manager accountable for the process or exposure that creates the risk Correct answer.

Explanation

Risk ownership sits with the manager who is accountable for the activity or exposure, because that person can change the risk and is accountable for controls. The risk function maintains the register and internal audit provides assurance, but neither owns the business risk.

Question 17Enterprise risk management framework and governance

Which practice best shows that a board is governing emerging risks, not only risks that have already caused losses?

  1. Horizon scanning, scenario discussion and agreed response triggers at board level Correct answer.
  2. Relying primarily on the external auditor's going-concern assessment and management letter
  3. Delegating all emerging risk identification work to the underwriting committee
  4. Reviewing the annual loss history and prior-year incident reports in detail at each board meeting

Explanation

Governing emerging risks requires forward-looking scanning and a prepared response, not only review of losses already incurred. Board-level scenario discussion and pre-agreed triggers make the board's appetite for such risks operational.

Question 18Enterprise risk management framework and governance

A multinational insurance group operates regulated subsidiaries. Which approach best respects legal-entity governance while maintaining group oversight?

  1. Each subsidiary board approves its own risk appetite within group-wide tolerances, with escalation of breaches Correct answer.
  2. The group board directly manages each subsidiary's risks and approves every individual underwriting case
  3. The group chief risk officer replaces subsidiary boards for risk decisions to ensure consistent standards
  4. Subsidiary boards apply group policies without local adaptation and report only annual summary results

Explanation

Legal-entity boards remain accountable for their own risk profiles, while the group sets consistent policies and tolerances and requires escalation of breaches. Group management cannot simply displace local boards or ignore local adaptation.

Question 19Enterprise risk management framework and governance

A board risk committee receives a 200-page monthly operational risk loss report. Which change would most improve its ability to govern?

  1. Delegate review of the report entirely to the internal audit function and rely on its summary
  2. Increase the report to weekly frequency so that the committee sees every loss sooner
  3. Replace it with a concise dashboard of forward-looking indicators, concentrations and limit breaches Correct answer.
  4. Add more historical loss data and detailed incident narratives to the existing monthly report

Explanation

A board needs aggregated, forward-looking information that highlights concentrations, trends and breaches so it can challenge and direct management. Volume of historical detail obscures the few items that require board attention.

Question 20Enterprise risk management framework and governance

An insurer outsources a material administration process. Which governance arrangement best preserves board accountability?

  1. The board delegates all accountability to the vendor and relies on the vendor's own risk reports and assurances
  2. The contract transfers regulatory responsibility for the outsourced process to the outsourcing provider
  3. The board approves the outsourcing policy, receives reporting on material risks and holds management accountable Correct answer.
  4. Internal audit manages the vendor relationship because it can provide independent challenge to the vendor

Explanation

A board cannot outsource its accountability for material outsourcing; it approves the policy, receives risk reporting and holds management to account for oversight. Regulatory responsibility and vendor management remain with the insurer.

Question 21Enterprise risk management framework and governance

An insurer is establishing a board risk committee. Which document should define the committee's mandate, authority, composition and reporting lines to the board?

  1. The enterprise risk appetite statement
  2. The committee's formal terms of reference Correct answer.
  3. The internal audit charter
  4. The annual ORSA report

Explanation

The terms of reference, often called a charter, is the governing document that sets a board committee's purpose, authority, membership and reporting lines. The risk appetite statement sets risk tolerances, the ORSA reports on solvency and risk assessment, and the internal audit charter governs the internal audit function rather than the risk committee.

Question 22Enterprise risk management framework and governance

An insurer is developing a risk taxonomy as part of its ERM framework. What is the primary purpose of the taxonomy?

  1. To replace quantitative risk modelling across the firm
  2. To assign one accountable owner to every identified risk
  3. To set the regulatory capital charge for each risk
  4. To classify and aggregate risks consistently Correct answer.

Explanation

A risk taxonomy gives the organisation a common language and consistent categories so that risks can be identified, aggregated and reported across business units. It supports risk ownership, modelling and capital calculation but does not replace them.

Question 23Enterprise risk management framework and governance

In an insurer's three lines model, the underwriting team approves a commercial property policy that exceeds the limit set in the risk appetite framework. The risk function did not detect the breach until month-end reporting. Which conclusion is most consistent with sound ERM governance?

  1. The risk function failed because it should have pre-approved every individual underwriting decision before binding
  2. The breach is acceptable because the risk function eventually identified it
  3. The board should remove underwriting authority from the business unit permanently
  4. First-line ownership failed: the underwriting team exceeded its delegated limit and controls need review Correct answer.

Explanation

The first line owns the risk and is responsible for operating within delegated limits, while the second line monitors and challenges. A breach indicates that first-line controls or limit monitoring need review, not that the second line should pre-approve every transaction.

Question 24Enterprise risk management framework and governance

A business unit reports that it has breached its approved market risk limit by a material amount. According to sound risk governance, which action should occur first?

  1. The breach should be recorded and reviewed at the next scheduled annual risk committee meeting
  2. The business unit should increase its limit retrospectively to match the position
  3. Prompt escalation to senior management and the risk committee, with remediation agreed Correct answer.
  4. The internal audit function should take over management of the position

Explanation

Material limit breaches require timely escalation to senior management and the board risk committee so that remediation, including reducing the position if needed, can be agreed. Retrospective limit changes undermine the limit framework, while delayed review leaves the exposure unmanaged.

Question 25Enterprise risk management framework and governance

A board is assessing whether its risk committee provides effective challenge to management. Which evidence is the strongest indicator of genuine challenge?

  1. Committee papers are circulated five working days before each meeting
  2. Minutes show specific questions, management responses and follow-up actions on material risks Correct answer.
  3. The committee meets quarterly and all members attend every meeting
  4. The committee receives presentations from the chief risk officer at each meeting

Explanation

Effective challenge is demonstrated by documented scrutiny of management's risk assessments, not merely by meeting logistics or attendance. Specific questions, responses and tracked follow-up actions show that the committee is testing and influencing risk decisions.

Question 26Enterprise risk management framework and governance

An insurer's board has approved a risk appetite statement that says the firm has 'a low tolerance for reputational risk'. Which revision would most improve the statement's usefulness for governance?

  1. State that reputational risk is owned by the chief risk officer
  2. Remove reputational risk from the statement because it cannot be measured
  3. Define specific indicators, thresholds and escalation triggers for reputational events Correct answer.
  4. Replace the statement with a commitment to comply with all applicable regulations

Explanation

An actionable risk appetite needs observable indicators, thresholds and escalation triggers so that management and the board can judge whether the stated tolerance is being respected. Ownership alone does not define tolerance, and removing the risk or substituting a compliance commitment avoids the governance question.

Question 27Risk identification, classification and risk registers

An insurer is launching a new product with no internal loss history. Which risk identification technique is most appropriate for generating an initial list of risks?

  1. Extrapolating frequency from the insurer's existing motor claims database
  2. Copying the risk register of an unrelated banking subsidiary without adaptation
  3. A facilitated cross-functional brainstorming workshop Correct answer.
  4. Fitting a loss distribution to the new product's historical claims

Explanation

With no internal loss history, structured expert judgement is needed to surface potential risks across underwriting, claims, actuarial and compliance perspectives. A cross-functional workshop brings those perspectives together before data are available. Methods that rely on existing claims data or unrelated registers cannot reliably identify the new product's risks.

Question 28Risk identification, classification and risk registers

In a risk register, what is the primary role of a named risk owner?

  1. To approve the firm's overall risk appetite statement
  2. To calculate the regulatory capital requirement for the risk
  3. To perform an independent audit of the risk controls
  4. To be accountable for managing and reporting the risk Correct answer.

Explanation

A risk owner is accountable for managing the assigned risk and for reporting its status through the governance process. Risk appetite approval sits with the board or relevant committee, while capital calculation and independent audit are separate functions. Ownership is therefore about accountability and monitoring rather than technical calculation or assurance.

Question 29Risk identification, classification and risk registers

Which of the following is classified as a financial risk rather than an operational risk in a typical insurer risk taxonomy?

  1. Loss caused by a cyber attack on the policy administration system
  2. Loss caused by the failure of a key outsourcing supplier
  3. Loss caused by a clerical error in claims processing
  4. Loss caused by an adverse movement in interest rates Correct answer.

Explanation

Financial risks arise from movements in market variables, credit events or liquidity conditions, and an adverse interest-rate movement is a market risk. Operational risks arise from inadequate or failed internal processes, people, systems or external events. Cyber attacks, supplier failures and clerical errors are therefore operational rather than financial risks.

Question 30Risk identification, classification and risk registers

A group risk function wants risk categories that allow consistent aggregation across subsidiaries while permitting local language. Which taxonomy design is most effective?

  1. Let each subsidiary create its own categories and report totals separately
  2. Restrict the taxonomy to financial risks so that all units use identical categories
  3. Update category definitions only after the annual external audit
  4. Use a common group taxonomy with defined terms and local mapping Correct answer.

Explanation

A common taxonomy with defined terms allows risks to be compared and aggregated across the group. A mapping table lets local labels be translated into group categories without losing local meaning. Separate local categories or an audit-driven update cycle would undermine timely and consistent aggregation.

Question 31Risk identification, classification and risk registers

Why does a formal near-miss reporting process improve risk identification in an insurance operation?

  1. Near misses remove the need for scenario analysis or expert judgement
  2. Near misses reveal control weaknesses before they produce actual losses Correct answer.
  3. Near misses provide a complete measurement of tail risk exposure
  4. Near misses are only useful for validating insurance claim reserves

Explanation

Near misses are leading indicators because they show where a control or process has failed without yet causing a loss. Capturing and analysing them allows management to act before more serious events occur. They complement scenario analysis and expert judgement rather than replacing them, and they do not fully measure tail exposure.

Question 32Risk identification, classification and risk registers

Which set of risk register fields best supports ongoing monitoring by a risk committee?

  1. Owner, inherent and residual ratings, key controls and review date Correct answer.
  2. Risk title and latest financial impact only
  3. Risk title, date first identified and the name of the business unit only
  4. Risk title, owner and free-text comment with no rating

Explanation

Effective monitoring requires an accountable owner, an assessment of risk before and after controls, evidence of the key controls and a scheduled review date. These fields allow the committee to track changes and challenge whether controls are working. Title-only, impact-only or unrated entries do not support prioritisation or trend analysis.

Question 33Risk identification, classification and risk registers

In an insurer's risk taxonomy, which risk is most appropriately classified as systematic?

  1. A fire affecting one regional office
  2. A sustained rise in economy-wide inflation Correct answer.
  3. The failure of one data centre used by a single business unit
  4. A fraud committed by a single claims handler

Explanation

Systematic risk affects the whole market or economy and cannot be diversified away within a portfolio. Economy-wide inflation affects many liabilities and expenses simultaneously, so it is systematic. A single office fire, an individual fraud and one data-centre failure are idiosyncratic or operational events.

Question 34Risk identification, classification and risk registers

During a risk identification workshop, the first suggested risk dominates discussion and the group considers few alternatives. Which facilitation technique best reduces this anchoring bias?

  1. Collect risks silently and independently before group discussion Correct answer.
  2. Invite the most senior manager to present a definitive risk list
  3. Ask participants to vote immediately on the first risk raised
  4. Use only the prior year's loss data to seed the discussion

Explanation

Silent independent generation allows participants to form their own views before hearing others, which reduces anchoring on the first suggestion. It also limits dominance by senior or vocal participants. Immediate voting, historical data seeding and a senior manager's list can all reinforce the initial anchor rather than broaden the risk set.

Question 35Risk identification, classification and risk registers

A risk register shows two risks, each with a 5% annual probability of a £10m loss. For capital aggregation, they are treated as perfectly positively correlated. What is the probability of at least one loss in the year?

  1. 9.75%
  2. 0.25%
  3. 10%
  4. 5% Correct answer.

Explanation

Perfect positive correlation means the two loss events occur together rather than independently. The probability of at least one loss is therefore the same as the probability of the common event, which is 5%. The 9.75% figure would apply if the risks were independent, while 10% would require mutually exclusive events.

Question 36Risk identification, classification and risk registers

Which characteristic most undermines a risk register's value for board oversight?

  1. Risk owners are members of the executive committee
  2. The register records both inherent and residual risk ratings
  3. The register is reviewed quarterly by the risk function
  4. Risks lack measurable impact and likelihood Correct answer.

Explanation

Board oversight depends on being able to compare, prioritise and challenge risks, which requires measurable impact and likelihood assessments. Vague descriptions prevent meaningful aggregation and trend analysis. Executive ownership, dual inherent and residual ratings, and regular risk-function review are generally strengths rather than weaknesses.

Question 37Risk identification, classification and risk registers

In a typical insurer risk taxonomy, which category covers losses arising from failed internal processes, people, systems or external events?

  1. Liquidity risk
  2. Market risk
  3. Insurance risk
  4. Operational risk Correct answer.

Explanation

Operational risk is commonly defined as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Market risk arises from movements in market prices, insurance risk from underwriting exposures, and liquidity risk from an inability to meet cash obligations.

Question 38Risk identification, classification and risk registers

Which field in a risk register records the level of risk after existing controls have been applied?

  1. Control owner
  2. Risk appetite threshold
  3. Residual risk rating Correct answer.
  4. Inherent risk rating

Explanation

Residual risk is the risk remaining after existing controls have been applied, so it is the appropriate field for post-control exposure. Inherent risk is assessed before controls, while appetite thresholds and control owner fields serve different purposes.

Question 39Risk identification, classification and risk registers

Which risk identification technique collects expert views anonymously over successive rounds until consensus emerges?

  1. Fault tree analysis
  2. Scenario analysis
  3. Brainstorming
  4. Delphi method Correct answer.

Explanation

The Delphi method gathers expert opinions anonymously over several rounds, with feedback between rounds, to reduce domination by senior or vocal participants and move towards consensus. Brainstorming is typically open discussion, scenario analysis explores plausible futures, and fault tree analysis traces causes of a defined event.

Question 40Risk identification, classification and risk registers

A risk register entry states: “Cyber attack could cause reputational damage.” Which revision best follows good risk-description practice?

  1. A cyber attack could cause reputational damage and reduce customer retention.
  2. The IT team should patch systems promptly to reduce cyber exposure.
  3. A cyber attack exploiting unpatched systems could disrupt quote generation, causing lost sales. Correct answer.
  4. Cyber risk is high because external attacks are increasing across the market and require action.

Explanation

A strong risk description separates cause, event and consequence, and makes the exposure specific enough to assess and monitor. Option 3 gives a cause (unpatched systems), an event (cyber attack) and a business consequence (disrupted quote generation and lost sales). The other options either omit the cause, state a conclusion, or describe a control action.

Question 41Risk identification, classification and risk registers

Why should a risk register distinguish inherent risk from residual risk?

  1. To compare risks across different taxonomies consistently.
  2. To satisfy external audit requirements on control testing.
  3. To ensure every risk has a named owner and action plan.
  4. To show the effect of controls on the risk and inform net risk decisions. Correct answer.

Explanation

Inherent and residual ratings show how much existing controls reduce the risk and support decisions on net risk acceptance and further mitigation. Ownership, taxonomy consistency and audit evidence are useful register features but are not the primary reason for separating the two ratings.

Question 42Risk identification, classification and risk registers

An insurer relies only on internal loss data to identify risks. What is the main weakness for identifying emerging risks?

  1. It requires complex statistical modelling beyond most insurers’ capability.
  2. It cannot be used alongside expert judgement in workshops.
  3. It captures past events but may miss new exposures with no loss history. Correct answer.
  4. It overstates the frequency of high-severity events.

Explanation

Internal loss data is backward-looking and only reflects exposures that have already produced recorded losses. Emerging risks often have little or no internal history, so loss data must be supplemented with scenario analysis, external data and expert judgement.

Question 43Risk identification, classification and risk registers

What does a bow-tie analysis add to risk identification by linking?

  1. Strategic objectives to key performance indicators.
  2. Historical losses to expected loss distributions.
  3. Risk appetite to capital allocation across business units.
  4. Causes and consequences through preventive and mitigative controls. Correct answer.

Explanation

Bow-tie analysis maps the threats that could cause a defined event, the preventive controls on those threats, the event itself, and the mitigative controls and consequences downstream. It therefore links causes and consequences through controls rather than linking appetite to capital or objectives to KPIs.

Question 44Risk identification, classification and risk registers

Before scoring likelihood and impact in a risk register, why define rating scale criteria?

  1. To rank risks strictly by their expected monetary value.
  2. To ensure different assessors assign consistent ratings to similar risks. Correct answer.
  3. To convert all qualitative risks into quantitative capital estimates.
  4. To eliminate the need for risk owners to review scores annually.

Explanation

Defined rating criteria give assessors a common interpretation of likelihood and impact, which improves consistency and comparability across risks and business units. They do not remove the need for review, convert qualitative risks into capital estimates, or require ranking by expected monetary value.

Question 45Risk identification, classification and risk registers

A risk register is updated only once a year at the annual risk workshop. Which consequence most directly weakens its usefulness for decision-making?

  1. It will duplicate the insurer’s risk taxonomy categories.
  2. It may not reflect changes in the risk profile during the year. Correct answer.
  3. It cannot include residual risk ratings for each entry.
  4. It will contain too many risks for the committee to review.

Explanation

A register that is refreshed only annually can become stale as exposures, controls and the external environment change during the year. That weakens its use for timely decisions, even if the register contains the right fields or taxonomy categories.

Question 46Risk identification, classification and risk registers

A reinsurer’s taxonomy places “accumulation of losses from a single earthquake affecting many cedants” under concentration risk rather than underwriting risk. What is the main rationale?

  1. Reinsurance recoveries eliminate the underlying underwriting exposure.
  2. Concentration risk only applies to investment portfolios.
  3. The loss arises from correlated exposure to one event across counterparties. Correct answer.
  4. Earthquake losses are always classified as market risk under solvency rules.

Explanation

Concentration risk captures the potential for a single event or common factor to generate correlated losses across multiple exposures or counterparties. Accumulation from one earthquake affecting many cedants is therefore a concentration exposure, not merely a market or underwriting pricing issue.

Question 47Risk identification, classification and risk registers

An insurer wants to identify operational risks embedded in each step of its new business processing chain. Which risk identification technique is most directly suited to this task?

  1. Trend analysis of industry loss ratios
  2. Process mapping with walkthroughs of each step Correct answer.
  3. Scenario analysis of a 1-in-200-year catastrophe
  4. Delphi survey of external market analysts

Explanation

Process mapping traces each activity, hand-off and system in the new business chain, so it exposes where operational failures could occur at each step. Delphi, scenario analysis and trend analysis are valid identification tools but are not designed to test a process step by step.

Question 48Risk identification, classification and risk registers

In a life insurer's risk taxonomy, which item is most appropriately classified as a strategic risk?

  1. Adverse movement in corporate bond spreads
  2. A pricing error in a legacy product's mortality assumption
  3. Loss of customer data through a supplier breach
  4. Failure of a planned expansion into a new distribution channel Correct answer.

Explanation

Strategic risk concerns the insurer's business model, markets, competition and execution of major plans such as a new distribution channel. Bond spread movements are market risk, pricing errors are insurance or operational risk, and supplier data loss is operational or cyber risk.

Question 49Risk identification, classification and risk registers

After a widely publicised cyber attack on a peer insurer, a risk committee sharply increases the cyber risk rating while leaving other operational risks unchanged. Which behavioural bias most explains this response?

  1. Confirmation bias, because evidence is interpreted to support existing beliefs
  2. Groupthink, because dissent is suppressed
  3. Availability heuristic, because a recent vivid event is over-weighted Correct answer.
  4. Anchoring on the first estimate provided

Explanation

The availability heuristic over-weights recent, vivid and easily recalled events, so a publicised peer cyber attack makes cyber risk feel more probable and salient. Anchoring concerns over-reliance on an initial number, confirmation bias concerns filtering evidence, and groupthink concerns pressure to agree.

Question 50Risk identification, classification and risk registers

Which of the following is most appropriately treated as an emerging risk in a general insurer's risk register?

  1. A regulatory penalty already imposed for a late solvency return
  2. A reinsurance counterparty rated below the insurer's credit threshold
  3. A known backlog in claims processing caused by staff shortages
  4. Liability claims arising from the use of artificial intelligence in underwriting decisions Correct answer.

Explanation

An emerging risk is new, evolving or not yet fully understood, so its likelihood and impact are highly uncertain. Artificial intelligence liability is developing with limited loss experience, whereas the other items are known current or historical exposures.