I85PREP
⌘ K
AICB Bank Risk Practices (BKR, Malaysia) study materials
AICB Bank Risk Practices (BKR, Malaysia) study resources

AICB Bank Risk Practices (BKR, Malaysia) practice questions

One question at a time. Build your AICB Bank Risk Practices (BKR, Malaysia) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Framework and Governance

Under Bank Negara Malaysia's risk governance expectations, which body within a bank holds ultimate responsibility for approving the risk appetite statement and overseeing the risk management framework?

  1. The business line risk champions
  2. The asset-liability committee
  3. The Board of Directors Correct answer.
  4. The internal audit committee

Explanation

BNM's corporate governance and risk governance policy documents place ultimate accountability for risk appetite and the risk management framework with the Board of Directors. The Board approves the risk appetite statement and ensures senior management implements it within an effective control environment.

Question 2Risk Management Framework and Governance

In the three lines model applied by Malaysian banks, which function is considered the second line?

  1. The external auditor engaged for statutory audit
  2. The internal audit function reporting to the Board
  3. The independent risk management and compliance function Correct answer.
  4. The front-office business units that originate loans

Explanation

The second line comprises risk management and compliance functions that set frameworks, monitor and challenge the first line's risk-taking. The first line owns and manages risk in the business, while internal audit forms the third line. External auditors sit outside the bank's internal lines model.

Question 3Risk Management Framework and Governance

A bank's risk appetite statement is best described as which of the following?

  1. A statement of the amount and types of risk the bank is willing to accept in pursuit of its objectives Correct answer.
  2. A list of every operational incident recorded in the past year
  3. A schedule of regulatory capital ratios reported to BNM
  4. A summary of the bank's marketing strategy for new products

Explanation

A risk appetite statement articulates the level and types of risk the bank is prepared to accept to achieve its strategic objectives. It is normally supported by quantitative risk appetite metrics and qualitative boundaries. It is not a historical incident log, a capital reporting schedule, or a business strategy document.

Question 4Risk Management Framework and Governance

Which of the following best captures the purpose of a bank's internal capital adequacy assessment process (ICAAP)?

  1. To set the interest rate charged on new retail loans
  2. To demonstrate that the bank holds sufficient capital against all material risks, including those not fully captured by regulatory minimums Correct answer.
  3. To determine the annual dividend payable to shareholders
  4. To calculate the statutory minimum capital ratio prescribed for all banks

Explanation

ICAAP requires a bank to assess capital adequacy on a forward-looking basis across all material risks, including concentration, liquidity and other risks beyond Pillar 1. It is a bank-specific process rather than a simple recalculation of regulatory minimums. It is not a dividend or pricing exercise.

Question 5Risk Management Framework and Governance

What does the principle of proportionality mean when BNM applies risk governance requirements to banks?

  1. Proportionality applies only to operational risk, not credit risk
  2. Larger banks are exempt from board-level risk oversight
  3. Every bank must apply identical controls regardless of its scale
  4. Requirements are calibrated to the size, complexity and risk profile of the institution Correct answer.

Explanation

Proportionality allows supervisory and governance requirements to be calibrated to an institution's scale, complexity and risk profile. A small, simple bank may apply lighter governance structures than a large, complex group. It does not create exemptions from core board oversight.

Question 6Risk Management Framework and Governance

Which committee structure is most commonly used in Malaysian banks to provide board-level oversight of the risk management framework?

  1. An IT helpdesk steering group
  2. A management credit committee chaired by the CEO
  3. A Board Risk Committee that reports to the full Board Correct answer.
  4. A customer complaints review panel

Explanation

A Board Risk Committee, or equivalent board-level committee, is typically established to oversee the risk framework and report to the full Board. Management committees operate below board level and do not discharge board accountability. Complaints panels and IT helpdesks are operational forums.

Question 7Risk Management Framework and Governance

In risk governance terminology, what is the role of the chief risk officer (CRO)?

  1. To manage the bank's branch network and sales targets
  2. To lead the independent risk function and provide an enterprise-wide view of risk to the Board and senior management Correct answer.
  3. To prepare the bank's statutory financial statements
  4. To approve all customer loans personally before disbursement

Explanation

The CRO heads the independent risk management function and provides enterprise-wide risk oversight and reporting to the Board and senior management. Independence from business lines is central to the role so that risk views are not compromised by commercial pressure. Approving every loan, preparing financial statements and running branches are not CRO responsibilities.

Question 8Risk Management Framework and Governance

Which of the following is the clearest example of a risk appetite metric (a limit or threshold) used in practice?

  1. A maximum acceptable level of non-performing loans as a percentage of the total loan portfolio Correct answer.
  2. A target for the number of new branches opened next year
  3. The scheduled date for the annual general meeting
  4. The bank's advertising budget for the coming year

Explanation

Risk appetite metrics translate the appetite statement into measurable thresholds, such as a maximum NPL ratio, that can be monitored and escalated. They are quantitative expressions of acceptable risk. Branch targets, advertising budgets and meeting dates are business planning items.

Question 9Risk Management Framework and Governance

A bank's internal audit function reports directly to the Board Audit Committee. Why is this reporting line important for risk governance?

  1. It ensures internal audit can set the bank's risk appetite
  2. It gives internal audit authority to execute business transactions
  3. It preserves the independence needed for audit to assess controls objectively without management influence Correct answer.
  4. It allows internal audit to approve the bank's credit policies

Explanation

Reporting to the Board Audit Committee protects internal audit's independence from the management it reviews, which is essential for objective assurance. Independence is a core principle in BNM's expectations for the audit function. Internal audit does not approve policies, set appetite or conduct business.

Question 10Risk Management Framework and Governance

A bank's risk register records a risk with high likelihood and high impact that exceeds the approved appetite. What is the most appropriate governance response?

  1. Ignore the entry because the register is only an information document
  2. Reclassify the risk as low likelihood without supporting evidence
  3. Escalate the breach to the appropriate risk committee and require a mitigation plan within a defined timeframe Correct answer.
  4. Delete the risk from the register to keep the dashboard green

Explanation

Risks or breaches exceeding appetite must be escalated to the relevant committee, with a documented mitigation plan and timeframe. This ensures accountability and timely corrective action. Ignoring, deleting or arbitrarily reclassifying the risk would undermine the integrity of the framework.

Question 11Risk Management Framework and Governance

Which statement correctly distinguishes risk appetite from risk capacity?

  1. Risk appetite is the maximum risk the bank can bear, while risk capacity is the risk it chooses to take
  2. Risk appetite and risk capacity are identical concepts used interchangeably
  3. Risk appetite is the risk the bank chooses to take within its objectives, while risk capacity is the maximum risk it can bear before breaching constraints Correct answer.
  4. Risk capacity applies only to liquidity risk, while risk appetite applies only to credit risk

Explanation

Risk capacity is the maximum risk a bank can absorb given its capital, liquidity and other constraints, while risk appetite is the amount it chooses to take within that capacity. Appetite should always sit inside capacity. The two concepts are related but not interchangeable, and neither is confined to a single risk type.

Question 12Risk Management Framework and Governance

A new product is proposed by the retail business. Under a strong risk governance framework, which control should be completed before launch?

  1. An increase in the marketing budget to support the launch
  2. A verbal confirmation from the sales head that the product is safe
  3. A new product approval process that assesses the risks and confirms they are within the approved risk appetite Correct answer.
  4. A retrospective review conducted one year after the product has been sold

Explanation

New product approval processes require a structured risk assessment before launch to confirm the product fits within appetite and that controls are in place. This is a preventive control, not a retrospective one. Verbal assurances and marketing spend do not substitute for formal risk assessment.

Question 13Risk Management Framework and Governance

What is the primary function of a bank's risk management committee at management level (as distinct from the Board)?

  1. To set the remuneration of the chief executive officer
  2. To oversee day-to-day implementation of the risk framework and escalate material issues to the Board Correct answer.
  3. To conduct the external audit of the bank's financial statements
  4. To replace the Board's role in approving the risk appetite

Explanation

Management-level risk committees oversee the implementation of the risk framework, monitor exposures against limits and escalate material matters to the Board. They support, but do not replace, Board accountability. External audit and CEO remuneration are handled by other parties and committees.

Question 14Risk Management Framework and Governance

A bank uses a three-lines model but the risk function reports to the head of the lending business. What governance weakness does this create?

  1. It compromises the independence of the second line, weakening objective oversight of the first line Correct answer.
  2. It has no effect because the three lines model only concerns internal audit
  3. It automatically converts the risk function into the third line
  4. It strengthens the second line by aligning risk with business incentives

Explanation

Second-line independence requires that risk management not be subordinate to the business it monitors. Reporting to the lending head creates a conflict of interest and weakens objective challenge. The three lines model covers all three lines, and reporting lines do not change a function's line classification.

Question 15Risk Management Framework and Governance

Which of the following best describes the role of a risk appetite framework in linking strategy and risk management?

  1. It translates strategic objectives into risk limits and tolerances that guide decision-making across the bank Correct answer.
  2. It replaces the need for a strategic plan
  3. It applies exclusively to market risk in the trading book
  4. It is used only by the internal audit function

Explanation

A risk appetite framework connects strategy to day-to-day risk-taking by converting objectives into measurable limits and tolerances. This guides business decisions and escalation. It complements, rather than replaces, the strategic plan, and it is enterprise-wide rather than confined to audit or market risk.

Question 16Risk Management Framework and Governance

A bank's board delegates authority to a credit committee to approve exposures up to a defined limit. What governance principle does this reflect?

  1. The elimination of the need for credit policies
  2. The replacement of risk management by committee voting
  3. The complete transfer of accountability away from the Board
  4. Delegated authority within clearly defined limits, with accountability retained at the delegating level Correct answer.

Explanation

Delegation of authority is acceptable when limits are clearly defined and accountability remains with the delegating body. The Board can delegate approval authority but cannot delegate away its ultimate accountability. Delegation does not remove the need for credit policies or risk management.

Question 17Risk Management Framework and Governance

Which of the following is a key element of an effective risk culture within a bank?

  1. Open escalation of concerns and appropriate consequences for excessive risk-taking Correct answer.
  2. Rewarding staff solely on sales volume regardless of risk outcomes
  3. Discouraging staff from reporting errors to avoid reputational damage
  4. Limiting risk training to the risk function only

Explanation

A sound risk culture encourages open escalation, challenge and accountability, with incentives and consequences aligned to prudent risk-taking. Rewarding volume alone, suppressing error reporting or restricting training undermines that culture. These elements are emphasised in BNM's conduct and governance expectations.

Question 18Risk Management Framework and Governance

A bank's stress testing programme reveals that under a severe recession scenario its capital ratio would fall below its internal target. What is the most appropriate governance action?

  1. Present the results to the Board and senior management and agree on mitigating actions such as capital conservation or contingency planning Correct answer.
  2. File the results without discussion because stress testing is a routine exercise
  3. Exclude the result from the ICAAP to avoid regulatory scrutiny
  4. Reduce the severity of the scenario so the result looks acceptable

Explanation

Stress test results that breach internal targets must be escalated to the Board and management so that mitigating actions can be agreed. Stress testing is a decision-support tool, not a compliance formality. Adjusting scenarios to hide weaknesses or excluding results from ICAAP would be improper.

Question 19Risk Management Framework and Governance

Which of the following best explains why a bank should maintain a risk data aggregation and reporting capability?

  1. To provide accurate and timely risk information to the Board and management for effective decision-making Correct answer.
  2. To reduce the number of staff employed in the finance department
  3. To replace the need for internal audit testing
  4. To satisfy customer requests for their account balances

Explanation

Accurate, timely risk data aggregation supports informed decision-making by the Board and management, particularly in stress conditions. Weak data infrastructure undermines risk identification and reporting. It is not a headcount reduction tool, a customer service function or a substitute for audit.

Question 20Risk Management Framework and Governance

Under a sound risk governance framework, what should happen when a business line consistently breaches its risk limits?

  1. The limits should be automatically increased to accommodate the business line's activity
  2. The risk function should be instructed to stop monitoring that business line
  3. The breaches should be escalated and the business line's limit or authority should be reviewed, with consequences applied as appropriate Correct answer.
  4. The breaches should be recorded but no action taken if profits are strong

Explanation

Persistent limit breaches indicate a breakdown in discipline and must be escalated, with a review of limits or authorities and appropriate consequences. Automatically raising limits or tolerating breaches because profits are strong undermines the framework. Ceasing monitoring removes the control entirely.

Question 21Risk Management Framework and Governance

A bank's Board is considering whether to approve a significant acquisition that would materially change its risk profile. Which governance consideration is most important?

  1. Whether the acquisition will increase the bank's market share in the short term
  2. Whether the post-acquisition risk profile remains within the approved risk appetite and capital capacity Correct answer.
  3. Whether the deal can be completed before the next reporting deadline
  4. Whether the acquisition will reduce the number of competitors

Explanation

Material transactions must be assessed against the approved risk appetite and the bank's capital capacity, since they can alter the enterprise risk profile. Market share, deal timing and competitive effects are commercial considerations but do not substitute for risk appetite and capital assessment.

Question 22Risk Management Framework and Governance

A bank operates in multiple jurisdictions and its group risk function sets limits centrally. A subsidiary's local regulator requires stricter limits. How should the group framework respond?

  1. Apply the stricter of the group and local requirements to ensure compliance in all jurisdictions Correct answer.
  2. Apply whichever limit is more convenient for the subsidiary's business plan
  3. Apply only the local limits and disregard the group framework
  4. Apply only the group limits because they are set centrally

Explanation

Where local requirements are stricter than group limits, the stricter standard should prevail so that the bank complies everywhere. Group frameworks typically incorporate a 'most stringent applies' principle. Ignoring either the group or local requirements would create compliance and governance gaps.

Question 23Risk Management Framework and Governance

Which of the following scenarios best illustrates a failure of the second line's challenge role?

  1. The first line documents its risk assessment for a new process
  2. The risk function approves a complex product without questioning the business's optimistic assumptions Correct answer.
  3. The Board reviews the risk appetite statement annually
  4. The internal audit function reports a control weakness to the Board Audit Committee

Explanation

The second line is expected to provide constructive challenge to first-line risk-taking, including questioning optimistic assumptions. Approving a complex product without challenge is a failure of that role. Audit reporting, first-line documentation and Board review are all appropriate governance activities.

Question 24Risk Management Framework and Governance

A bank's risk appetite statement contains only qualitative statements such as 'the bank will take a prudent approach to risk'. Why is this insufficient on its own?

  1. It lacks measurable limits and thresholds that allow the Board to monitor and enforce the appetite Correct answer.
  2. It is too detailed and constrains business flexibility
  3. It duplicates the internal audit charter
  4. It is only relevant to operational risk

Explanation

An effective risk appetite statement must be supported by quantitative metrics and thresholds so that adherence can be monitored and breaches escalated. Purely qualitative statements cannot be measured or enforced. Such statements are not overly detailed, do not duplicate the audit charter and are not confined to operational risk.

Question 25Risk Management Framework and Governance

A bank's internal audit finds that risk reports to the Board are consistently late and omit key exposures. What is the most significant governance implication?

  1. The issue is purely administrative and requires no governance response
  2. The bank should reduce the frequency of Board meetings to ease reporting pressure
  3. The Board may be unable to discharge its oversight duties effectively because it lacks timely and complete risk information Correct answer.
  4. The risk function should be merged into the business lines to improve data flow

Explanation

Timely and complete risk reporting is essential for the Board to exercise effective oversight. Persistent delays and omissions impair decision-making and can mask emerging risks. Reducing meeting frequency, merging risk into business lines or treating the issue as purely administrative would worsen the governance weakness.

Question 26Risk Management Framework and Governance

Under Bank Negara Malaysia's policy on risk governance, which body within a bank holds ultimate responsibility for approving the risk appetite and overseeing the risk management framework?

  1. The internal audit function
  2. The shariah advisory committee
  3. The Board of Directors Correct answer.
  4. The management risk committee

Explanation

Risk governance places ultimate accountability for the risk management framework and risk appetite with the Board of Directors, which approves policy and oversees its implementation. Management committees execute the framework within delegated authority, and control functions such as internal audit provide independent assurance rather than ownership. The shariah advisory committee is concerned with shariah compliance matters, not overall enterprise risk oversight.

Question 27Risk Management Framework and Governance

A bank defines a 'risk universe' as part of its risk management framework. What is the primary purpose of maintaining a complete risk universe?

  1. To list every customer the bank intends to lend to in the coming year
  2. To document the disciplinary actions taken against staff who breach limits
  3. To identify and categorise all material risk types the bank is exposed to so none escape oversight Correct answer.
  4. To record the market values of the bank's trading portfolio at close of business

Explanation

The risk universe is the full inventory of risk types and sources that could affect the bank, used to ensure scoping of the framework, risk registers, and assurance coverage is complete. Without it, some risks can go unowned and unmonitored. Customer lists, portfolio valuations, and HR disciplinary records are operational data, not the risk universe.

Question 28Risk Management Framework and Governance

In a bank's governance structure, what distinguishes the role of the Board Risk Committee from that of the management-level risk committee?

  1. The Board Risk Committee replaces internal audit by performing assurance testing on controls
  2. The Board Risk Committee approves individual retail loan applications while management approves corporate loans
  3. The Board Risk Committee provides independent oversight and challenges management, while the management committee executes the framework within approved appetite Correct answer.
  4. The Board Risk Committee sets staff remuneration while the management committee sets credit pricing

Explanation

The Board Risk Committee is a board-level body that oversees and challenges management's risk-taking within the approved appetite, without taking on executive execution. The management risk committee translates Board-approved appetite into limits, policies, and day-to-day decisions. Neither committee approves individual retail loans, sets remuneration exclusively, or performs internal audit assurance.

Question 29Risk Management Framework and Governance

A bank's risk management framework describes 'risk ownership' as a core principle. What does risk ownership require of a business line head?

  1. Accepting accountability for identifying, managing, and reporting the risks generated by their business activities Correct answer.
  2. Delegating risk accountability to the internal audit function
  3. Transferring all risk decisions to the risk management function for approval
  4. Reporting only losses above a materiality threshold to the Board

Explanation

Risk ownership means the business that generates a risk is accountable for managing it within approved appetite, supported by independent risk oversight. The risk function sets frameworks and challenges but does not take over business decisions. Internal audit provides assurance and cannot own business risk, and reporting only large losses would leave the framework blind to emerging exposures.

Question 30Risk Management Framework and Governance

A bank's framework requires that risk policies be approved and periodically reviewed. Which practice best demonstrates an effective policy review cycle?

  1. Policies are reviewed whenever a new chief executive officer is appointed
  2. Policies are reviewed only when a regulator issues a supervisory letter
  3. Policies carry an owner, an approval date, and a scheduled review trigger, with interim review when material changes occur Correct answer.
  4. Policies are reviewed annually by the internal audit function alone

Explanation

Effective policy management assigns ownership, records approval, and sets a defined review frequency, supplemented by event-driven review when the business, products, or regulation change materially. Reviews triggered only by external events or leadership changes leave policies stale. Internal audit may assess the review process but should not be the sole reviewer of policies it later audits.

Question 31Risk Management Framework and Governance

A bank's risk appetite framework is being refreshed. Which characteristic makes a risk appetite statement most useful for governance?

  1. It contains broad aspirational language that allows management wide discretion
  2. It is expressed in specific, measurable terms with limits and escalation triggers tied to strategy Correct answer.
  3. It is rewritten each quarter to reflect current market sentiment
  4. It is kept confidential from the Board to preserve commercial flexibility

Explanation

A useful risk appetite statement converts strategic intent into measurable tolerances, limits, and escalation triggers so that management and the Board can monitor adherence objectively. Vague aspirational language cannot be monitored or enforced. Concealing it from the Board defeats oversight, and frequent wholesale rewriting undermines stability and comparability.

Question 32Risk Management Framework and Governance

A bank's new chief risk officer reports to the chief financial officer rather than to the Board or chief executive. What governance concern does this reporting line raise?

  1. It may compromise the risk function's independence and its ability to challenge financial decisions objectively Correct answer.
  2. It guarantees faster escalation of risk issues to the Board
  3. It increases the risk function's independence from the business lines
  4. It transfers risk ownership from the business to the finance function

Explanation

Independence of the risk function is a cornerstone of sound governance, and placing the CRO under the CFO creates a conflict because the CFO is accountable for financial performance and reporting. This can blunt challenge on provisioning, valuation, and capital decisions. Independence is not strengthened, escalation is not guaranteed, and risk ownership remains with the business.

Question 33Risk Management Framework and Governance

A bank's Board delegates credit approval authority to a management credit committee up to a defined threshold, above which Board approval is required. Which governance principle does this arrangement illustrate?

  1. Transfer of credit risk ownership to the internal audit function
  2. Elimination of the need for credit policy documentation
  3. Unlimited delegation of Board accountability to management
  4. Delegated authority operating within documented limits and escalation rules Correct answer.

Explanation

Delegated authority allows efficient decision-making at management level while preserving Board control through thresholds and escalation rules, with the delegation documented and reviewed. The Board retains ultimate accountability and cannot delegate it away entirely. This arrangement does not remove the need for credit policy or shift risk ownership to internal audit.

Question 34Risk Management Framework and Governance

A bank's internal audit function is asked to help design and operate the controls in the credit approval process. Why should this request be declined?

  1. Because internal audit is only permitted to review market risk controls
  2. Because internal audit staff lack the technical skills to design credit controls
  3. Because performing management functions would impair internal audit's independence and objectivity Correct answer.
  4. Because control design must always be outsourced to external consultants

Explanation

The third line must remain independent of the activities it audits, so taking on control design or operation creates a self-review threat and undermines objectivity. Internal audit can advise and challenge while management retains responsibility for designing and running controls. The objection is not about skills, risk-type restrictions, or a requirement to outsource.

Question 35Risk Management Framework and Governance

A bank's risk committee charter has not been updated for several years, and the committee now reviews matters outside its stated remit while key risks go unaddressed. What is the most appropriate governance response?

  1. Disband the committee and transfer all risk oversight to internal audit
  2. Reduce the frequency of committee meetings to save resources
  3. Review and update the charter to define mandate, membership, quorum, and reporting lines, then monitor adherence Correct answer.
  4. Allow the committee to set its own remit without Board approval

Explanation

A committee charter is the governing document that defines mandate, composition, quorum, and reporting, and should be reviewed periodically to keep oversight aligned with the bank's risk profile. Updating and monitoring adherence restores focus on key risks. Disbanding the committee, cutting meetings, or letting it self-define its remit would weaken governance further.

Question 36Risk Management Framework and Governance

A bank's risk reporting pack to the Board is prepared by the business lines themselves with no independent validation. Which governance weakness does this create?

  1. It guarantees that the Board receives more timely information
  2. It removes the need for a risk data governance policy
  3. It increases the independence of risk reporting
  4. It allows potential under-reporting or bias because the originating business controls the figures without independent challenge Correct answer.

Explanation

Independent validation by the risk or finance function is a key control over risk reporting, because business lines have an incentive to present favourable figures. Without it, under-reporting or bias can go undetected and the Board may act on inaccurate information. Self-preparation does not enhance independence, remove the need for data governance, or guarantee timeliness.

Question 37Risk Management Framework and Governance

A bank's risk appetite is set at group level, but a subsidiary operates under stricter local regulatory capital requirements. How should the framework reconcile the two?

  1. The subsidiary should ignore group appetite and follow only local rules
  2. The subsidiary should seek an exemption from group limits to reduce compliance costs
  3. Group limits should be applied without adjustment to the subsidiary
  4. The subsidiary should apply the more conservative of group appetite and local requirements, with the difference documented and escalated Correct answer.

Explanation

Where local requirements are stricter than group appetite, the subsidiary must comply with the binding constraint, which is the more conservative of the two, and the group framework should recognise and document this. Ignoring either set of requirements creates breaches, and unadjusted group limits may breach local rules. Seeking exemptions to reduce costs is not a sound governance response.

Question 38Risk Management Framework and Governance

A bank's Board is assessing whether its risk management framework is proportionate to the bank's size and complexity. Which indicator would most strongly suggest the framework is under-developed relative to the bank's risk profile?

  1. The bank conducts annual stress testing and reviews results at Board level
  2. The bank has a designated chief risk officer with a direct reporting line to the Board
  3. The bank has a documented risk appetite and a functioning Board Risk Committee
  4. The bank has expanded into complex derivatives trading but still relies on a single spreadsheet-based risk register with no independent validation Correct answer.

Explanation

Proportionality requires that the sophistication of risk infrastructure keep pace with the complexity of activities; a spreadsheet-based register without validation is inadequate for a derivatives book. The other options describe sound governance features that indicate the framework is appropriately developed. The mismatch between business complexity and control maturity is the warning sign.

Question 39Risk Management Framework and Governance

A bank's risk committee approves a new limit framework but the business continues to operate under prior limits because the change was never communicated to front-office staff. Which control failure does this most directly illustrate?

  1. A failure of the shariah advisory committee to approve the framework
  2. A failure of the internal audit function to detect fraud
  3. A failure in the design of the limit framework itself
  4. A failure in the implementation and communication of approved risk decisions Correct answer.

Explanation

Governance is only effective when approved decisions are operationalised through clear communication, system changes, and monitoring; a gap between approval and execution is an implementation control failure. The framework design may be sound, and the issue is not fraud detection or shariah approval. Effective governance links decision-making to execution and follow-up.

Question 40Risk Management Framework and Governance

A bank's risk culture programme relies solely on annual online training modules with no other interventions. Why is this approach unlikely to be effective?

  1. Because risk culture is solely the responsibility of the compliance function
  2. Because online training is always more effective than classroom training
  3. Because training modules are prohibited under risk governance standards
  4. Because risk culture is shaped mainly by incentives, tone from the top, and day-to-day behaviour, which training alone does not change Correct answer.

Explanation

Risk culture reflects what is rewarded, tolerated, and modelled by leadership, so it is shaped by incentive structures, escalation behaviour, and tone from the top rather than by training content alone. Training can raise awareness but cannot by itself change behaviour. The issue is not the delivery channel, ownership by compliance, or any prohibition on training.

Question 41Credit Risk

Under a commercial loan agreement, which event most directly constitutes a credit event for the lender?

  1. The borrower's share price falls below its 12-month average
  2. The borrower fails to pay scheduled interest within the contractual grace period Correct answer.
  3. The borrower appoints a new chief financial officer
  4. The borrower's internal credit rating is downgraded by one notch by an external agency

Explanation

A credit event is an objective occurrence that triggers default or restructuring provisions, and non-payment of interest beyond the grace period is the classic trigger. Rating downgrades, share price movements and management changes are early warning signals but do not by themselves constitute default under the facility.

Question 42Credit Risk

A bank uses a 12-month probability of default of 1.5% and a loss given default of 45% on an exposure of RM20 million. What is the expected loss?

  1. RM135,000 Correct answer.
  2. RM1,350,000
  3. RM13,500,000
  4. RM300,000

Explanation

Expected loss equals PD multiplied by LGD multiplied by exposure at default, so 0.015 x 0.45 x 20,000,000 = RM135,000. This formula underpins provisioning and pricing under internal ratings-based approaches.

Question 43Credit Risk

Which five categories make up the traditional 'five Cs of credit' framework used in commercial lending assessment?

  1. Capacity, capital, collateral, character, conditions Correct answer.
  2. Cash flow, capital, cost, collateral, conditions
  3. Capacity, covenant, collateral, currency, country
  4. Capital, collateral, compliance, character, concentration

Explanation

The five Cs are character, capacity, capital, collateral and conditions, covering borrower integrity, repayment ability, financial strength, security and the economic environment. The framework gives lenders a structured qualitative overlay to quantitative ratio analysis.

Question 44Credit Risk

A corporate borrower reports EBITDA of RM50 million, total debt of RM200 million and cash of RM20 million. What is net debt to EBITDA?

  1. 3.6 times Correct answer.
  2. 3.2 times
  3. 4.4 times
  4. 4.0 times

Explanation

Net debt is total debt less cash, so RM200 million minus RM20 million equals RM180 million. Dividing by EBITDA of RM50 million gives 3.6 times, a common leverage measure used in covenant setting.

Question 45Credit Risk

In credit risk management, what does a 'hard' credit limit refer to?

  1. A limit set only for retail exposures below a defined threshold
  2. A limit that cannot be breached without formal approval from a designated higher authority Correct answer.
  3. A limit reviewed only when the borrower's rating changes
  4. A limit that can be exceeded with same-day approval from the relationship manager

Explanation

A hard limit is an absolute exposure ceiling that requires escalation to a designated higher authority before any breach can occur. It contrasts with soft or advisory limits, which act as early warning thresholds rather than binding constraints.

Question 46Credit Risk

A bank's credit policy requires that all new corporate facilities above RM10 million be approved by the credit committee. A branch manager approves a RM12 million facility alone. Which control failure has occurred?

  1. A breach of delegated lending authority Correct answer.
  2. A breach of the single customer exposure limit
  3. A breach of the liquidity coverage ratio
  4. A breach of the market risk limit

Explanation

Delegated lending authority defines the maximum approval size and risk grade each officer or committee may sanction. Approving above that threshold without referral is an authority breach regardless of the borrower's credit quality.

Question 47Credit Risk

Which statement best describes the role of collateral in credit risk mitigation?

  1. Collateral guarantees that the facility will not become non-performing
  2. Collateral reduces loss given default and provides a secondary source of repayment Correct answer.
  3. Collateral increases the exposure at default recognised in regulatory capital
  4. Collateral substitutes for a thorough assessment of the borrower's repayment capacity

Explanation

Collateral is a secondary repayment source that reduces loss severity if default occurs, thereby lowering LGD. It does not replace assessment of the borrower's primary repayment capacity, which remains the core underwriting test.

Question 48Credit Risk

A borrower's loan is restructured with a concession on interest rate because of financial difficulty. Under Bank Negara Malaysia's classification guidance, how should the facility generally be treated?

  1. It is classified as a restructured loan and subject to a probation period before reclassification Correct answer.
  2. It remains performing because payments are still being made
  3. It is transferred to the trading book
  4. It is automatically written off

Explanation

A concession granted because of financial difficulty results in a restructured or rescheduled classification, with a defined probation period of satisfactory performance before it can be upgraded. This prevents cosmetic restructuring from masking underlying weakness.

Question 49Credit Risk

Which of the following best illustrates 'moral hazard' in a lending relationship?

  1. A borrower's sales decline because of an industry-wide recession
  2. A borrower's collateral value falls because of a property market downturn
  3. A borrower is downgraded because of a sovereign rating action
  4. A borrower diverts loan proceeds intended for working capital into a speculative venture Correct answer.

Explanation

Moral hazard arises when the borrower takes actions that increase risk after the loan is granted because the lender bears part of the downside. Diversion of funds contrary to the agreed purpose is a direct example.

Question 50Credit Risk

In credit scoring, what is the primary purpose of a scorecard cut-off?

  1. To separate applicants that are accepted from those that are declined Correct answer.
  2. To calculate the bank's regulatory capital requirement
  3. To determine the interest rate charged to each borrower
  4. To set the maximum tenor of each facility

Explanation

A cut-off score defines the boundary between acceptable and unacceptable credit risk at origination. It is calibrated against the bank's risk appetite and expected approval and bad rates.