I85PREP
⌘ K
ICSAN Admin Risk study materials
ICSAN Admin Risk study resources

ICSAN Admin Risk practice questions

One question at a time. Build your ICSAN Admin Risk understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Frameworks and Governance

Under the three lines model, which group provides independent, objective assurance to the governing body on the effectiveness of risk management and internal controls?

  1. Internal audit, positioned as the third line Correct answer.
  2. Operational management, positioned as the first line
  3. The external auditor engaged by the board
  4. The risk and compliance functions, positioned as the second line

Explanation

The three lines model assigns ownership of risk to operational management (first line), oversight and challenge to risk and compliance functions (second line), and independent assurance to internal audit (third line). Independence from management is what allows the third line to report objectively to the governing body.

Question 2Risk Management Frameworks and Governance

A board committee approves the enterprise risk appetite statement and the limits delegated to business units. Which governance responsibility does this primarily illustrate?

  1. Designing the control testing schedule for operational processes
  2. Setting risk appetite and delegating authority within an approved framework Correct answer.
  3. Executing day-to-day risk mitigation activities
  4. Preparing the annual financial statements for audit

Explanation

Governing bodies set the tone by approving risk appetite and the authority delegated to management. Execution and control design sit with management, not the board.

Question 3Risk Management Frameworks and Governance

Which statement best describes the concept of risk appetite in a governance framework?

  1. The level of risk remaining after controls have been applied
  2. The maximum loss the organisation could suffer under any scenario
  3. The total of all identified risks recorded in the risk register
  4. The amount and type of risk an organisation is willing to accept in pursuit of its objectives Correct answer.

Explanation

Risk appetite expresses the quantum and nature of risk the organisation chooses to pursue or retain to meet its objectives. It is a forward-looking statement of willingness, distinct from capacity or residual exposure.

Question 4Risk Management Frameworks and Governance

In a formal risk governance structure, what is the primary role of a risk committee reporting to the board?

  1. Conducting the external audit of the risk function
  2. Overseeing the risk framework, challenging management and escalating material exposures Correct answer.
  3. Approving individual customer credit applications
  4. Managing the daily trading positions of the treasury desk

Explanation

A board risk committee provides oversight of the risk management framework and challenges management's risk decisions. It escalates material exposures to the full board and does not perform operational tasks.

Question 5Risk Management Frameworks and Governance

Which term describes the risk that remains after management has implemented controls to mitigate an identified risk?

  1. Residual risk Correct answer.
  2. Inherent risk
  3. Control risk
  4. Risk appetite

Explanation

Residual risk is the exposure remaining once mitigating controls are in place. Inherent risk, by contrast, is the exposure before controls are considered.

Question 6Risk Management Frameworks and Governance

What distinguishes a risk owner from a risk champion in a governance framework?

  1. Both roles are held by the second line to ensure oversight
  2. The risk owner promotes awareness, while the champion is accountable for the risk
  3. Both roles are held by the internal auditor to preserve independence
  4. The risk owner is accountable for managing a specific risk, while a champion promotes risk awareness Correct answer.

Explanation

Accountability for a risk sits with a named risk owner who manages and reports on it. A risk champion supports the culture and awareness of risk but does not carry formal accountability for the exposure.

Question 7Risk Management Frameworks and Governance

A policy states that any risk exceeding a defined threshold must be reported to the board risk committee within five business days. What governance mechanism does this represent?

  1. A risk escalation and reporting protocol Correct answer.
  2. A control self-assessment exercise
  3. A risk transfer arrangement
  4. A business continuity plan

Explanation

Mandatory reporting of threshold breaches within a set timeframe is an escalation protocol that ensures material risks reach the appropriate governance level promptly.

Question 8Risk Management Frameworks and Governance

Which document typically defines the organisation's risk management methodology, roles, responsibilities and reporting lines?

  1. The risk management framework or policy Correct answer.
  2. The internal audit charter
  3. The annual financial report
  4. The procurement manual

Explanation

The risk management framework or policy sets out methodology, roles, responsibilities and reporting arrangements for risk. Other documents serve different governance purposes.

Question 9Risk Management Frameworks and Governance

A firm defines its risk appetite as 'low' for regulatory compliance but 'moderate' for product innovation. What does this differentiated appetite demonstrate?

  1. Risk appetite can vary by risk category and objective Correct answer.
  2. Risk appetite must be uniform across all activities
  3. Risk appetite is the same as risk capacity
  4. Risk appetite is set solely by the internal audit function

Explanation

Appetite statements are often expressed per risk category or business objective, allowing the organisation to accept more risk in some areas than others. A single uniform appetite would not reflect differing strategic priorities.

Question 10Risk Management Frameworks and Governance

Management proposes a new product with an expected loss profile that exceeds the approved appetite for market risk. According to sound governance, what should happen?

  1. The product should proceed because it is expected to be profitable
  2. The proposal should be escalated to the board or its risk committee for a decision Correct answer.
  3. The risk function should quietly adjust the appetite to accommodate the product
  4. The internal auditor should approve the product launch

Explanation

When a proposal breaches approved appetite, the decision to accept, modify or reject it belongs at the level that set the appetite. Management cannot unilaterally exceed board-approved limits.

Question 11Risk Management Frameworks and Governance

An organisation maps its risks onto a matrix with likelihood on one axis and impact on the other. What is the primary purpose of this tool?

  1. To replace internal audit's assurance work
  2. To eliminate the need for a risk register
  3. To prioritise risks for treatment based on their relative significance Correct answer.
  4. To calculate the exact financial loss from each risk

Explanation

A likelihood-impact matrix helps compare and rank risks so resources can be directed to the most significant exposures. It is a prioritisation aid, not a precise loss calculator.

Question 12Risk Management Frameworks and Governance

Which of the following best illustrates the second line of defence in operation?

  1. The board approves the annual report
  2. A compliance team reviews and challenges business unit risk assessments against policy Correct answer.
  3. Internal audit tests the design of key controls
  4. A front-office team completes its daily trade confirmations

Explanation

Second-line functions provide oversight and challenge to first-line activity, such as compliance reviewing business risk assessments. They support but do not replace first-line ownership.

Question 13Risk Management Frameworks and Governance

A company's risk register records a risk with high inherent impact but low residual impact after mitigation. What does this pattern most likely indicate?

  1. The inherent risk was incorrectly recorded
  2. No controls have yet been applied
  3. Effective controls are reducing the exposure substantially Correct answer.
  4. The risk has been eliminated entirely

Explanation

A large gap between inherent and residual ratings typically shows that mitigating controls are working. It does not mean the risk no longer exists.

Question 14Risk Management Frameworks and Governance

Why does governance guidance recommend separating the risk management function from the internal audit function?

  1. To reduce the total headcount in the organisation
  2. To allow internal audit to set the risk appetite
  3. To ensure the risk function reports to the audit committee only
  4. To preserve the independence and objectivity of assurance over risk management Correct answer.

Explanation

If internal audit also managed risk, it would be reviewing its own work, undermining objectivity. Separation keeps assurance independent of the activities it examines.

Question 15Risk Management Frameworks and Governance

A regulator requires the board to affirm annually that the risk management framework is effective. Which governance practice does this most directly reinforce?

  1. Delegation of all risk decisions to external consultants
  2. Removal of the second line to streamline reporting
  3. Board accountability for the adequacy of the risk framework Correct answer.
  4. Reliance solely on management self-reporting

Explanation

An annual board affirmation places accountability for framework adequacy at the top of the organisation. It requires the board to obtain assurance rather than simply accept management's word.

Question 16Risk Management Frameworks and Governance

In a risk governance framework, what is the function of key risk indicators (KRIs)?

  1. To replace the risk register with quantitative data
  2. To record the historical losses incurred by the organisation
  3. To provide early warning signals of increasing exposure against defined thresholds Correct answer.
  4. To set the organisation's risk appetite

Explanation

KRIs are metrics designed to signal rising risk levels before losses occur, often with amber and red thresholds. They support monitoring and escalation rather than replacing registers or setting appetite.

Question 17Risk Management Frameworks and Governance

A risk committee receives a report showing that a business unit breached its operational risk limit for three consecutive months. What is the most appropriate governance response?

  1. Immediately dismiss the business unit head without investigation
  2. Take no action because the breach is operational rather than strategic
  3. Require a remediation plan with root-cause analysis and escalate to the board Correct answer.
  4. Increase the limit permanently to remove the breach

Explanation

Persistent breaches call for root-cause analysis, a documented remediation plan and escalation to the appropriate governance level. Simply raising the limit or ignoring the breach would undermine the control framework.

Question 18Risk Management Frameworks and Governance

Which characteristic most clearly distinguishes a mature risk culture from a compliance-only culture?

  1. Staff at all levels openly raise concerns and are rewarded for identifying emerging risks Correct answer.
  2. Staff follow procedures only when an auditor is present
  3. The risk function owns every risk in the organisation
  4. Risk is discussed exclusively at annual board meetings

Explanation

A mature risk culture encourages open discussion and escalation of risks throughout the organisation, supported by incentives. Compliance-only behaviour is driven by external scrutiny rather than genuine ownership.

Question 19Risk Management Frameworks and Governance

An organisation adopts a 'three lines model' but places the risk function inside the first line, reporting to the same business head whose activities it monitors. What governance weakness does this create?

  1. Reduced need for internal audit
  2. Stronger assurance because the function knows the business well
  3. Impaired independence and challenge of the business it oversees Correct answer.
  4. Improved efficiency with no governance consequence

Explanation

Placing oversight inside the line it monitors creates a conflict of interest that weakens independent challenge. Proximity to the business may aid understanding but compromises objectivity.

Question 20Risk Management Frameworks and Governance

A board wants assurance that its risk appetite statement is actually being applied in decision-making. Which evidence would best demonstrate this?

  1. A signed copy of the appetite statement on file
  2. Minutes showing decisions were tested against appetite limits and rejected or escalated where breached Correct answer.
  3. An external consultant's generic template for appetite statements
  4. A training session attended by all staff

Explanation

Application is evidenced by decisions that reference and respect the appetite, including rejections and escalations. Mere existence of a signed statement shows approval, not use.

Question 21Risk Management Frameworks and Governance

In a large financial institution, which arrangement best supports effective challenge of first-line risk-taking?

  1. A second-line function staffed part-time by first-line managers
  2. A second-line function whose budget is controlled by the trading desk
  3. A second-line function with sufficient authority, resources and direct access to the board risk committee Correct answer.
  4. A second-line function that reports only to the business unit it oversees

Explanation

Effective challenge requires authority, adequate resourcing and an escalation route independent of the business being challenged. Structural dependence on the first line undermines objectivity.

Question 22Risk Management Frameworks and Governance

A firm's board delegates risk oversight to an audit committee that also reviews the internal audit plan and approves the risk appetite. What governance concern might a reviewer raise?

  1. The arrangement strengthens independence by centralising all risk matters
  2. There is no concern because audit committees can perform any board function
  3. Combining assurance oversight with appetite-setting may blur accountability and overload the committee Correct answer.
  4. The arrangement is required by the three lines model

Explanation

Bundling assurance oversight with appetite-setting can blur the separation between those who set risk tolerance and those who assure against it, and may overload a single committee. Many frameworks favour distinct risk and audit committees for this reason.

Question 23Risk Management Frameworks and Governance

An organisation's risk register lists 400 risks, but the board reviews only a summary of the top 10 by residual score. What is the most significant governance risk of this approach?

  1. The board is overburdened with detail
  2. Residual scoring is inherently unreliable
  3. The register is too small to be useful
  4. Material but slowly emerging risks outside the top 10 may escape board attention Correct answer.

Explanation

Filtering to a top-10 list can mask emerging or correlated risks whose current residual score is modest but whose potential impact is high. Effective governance combines summary reporting with attention to emerging and aggregated exposures.

Question 24Risk Management Frameworks and Governance

A group operates in several jurisdictions with differing regulatory requirements. How should its risk governance framework address this complexity?

  1. Apply the strictest single jurisdiction's rules uniformly without local input
  2. Set group-wide principles with local adaptation and clear escalation of jurisdictional conflicts Correct answer.
  3. Allow each subsidiary to design an unrelated framework
  4. Delegate all regulatory risk to external counsel

Explanation

A sound framework balances consistent group-wide principles with local adaptation, and includes a mechanism to escalate conflicts between jurisdictions. Uniform imposition or fragmentation both create governance gaps.

Question 25Risk Management Frameworks and Governance

A board is evaluating whether to accept a strategic risk that exceeds its stated appetite but offers significant long-term value. Which governance process should govern the decision?

  1. Automatic rejection because appetite is absolute
  2. An informal decision by the CEO without record
  3. Delegation of the decision to the internal audit function
  4. A documented, board-level exception process with rationale, conditions and periodic review Correct answer.

Explanation

Appetite is a guide, not an absolute prohibition; boards can approve exceptions through a documented process with conditions and review. Undocumented or automatic responses both undermine governance.

Question 26Risk Management Frameworks and Governance

In a formal risk governance structure, what is the primary role of the board of directors with respect to risk?

  1. Executing day-to-day hedging transactions to control exposures
  2. Setting the organisation's risk appetite and providing oversight of the risk management framework Correct answer.
  3. Performing the independent audit of the risk management function
  4. Preparing the detailed risk register entries for each business unit

Explanation

The board sits at the apex of risk governance and is accountable for defining how much risk the organisation is willing to accept and for overseeing that the framework operates as intended. Operational tasks such as drafting register entries, auditing, and executing hedges are delegated to management and control functions, not retained by the board.

Question 27Risk Management Frameworks and Governance

An organisation wants a single reference document that sets out how risk is identified, assessed, treated and reported across the whole firm. Which governance artefact fulfils this purpose?

  1. The annual financial statements
  2. The internal audit charter
  3. The enterprise risk management framework Correct answer.
  4. The business continuity plan

Explanation

The enterprise risk management framework is the overarching document that defines methodology, roles, appetite linkages and reporting lines for risk across the organisation. The other documents serve narrower purposes and do not prescribe firm-wide risk methodology.

Question 28Risk Management Frameworks and Governance

A risk committee reviews a heat map where a risk sits in the high-likelihood, high-impact quadrant, yet the risk register records a low residual rating for the same risk. What is the most appropriate governance response?

  1. Remove the risk from the register because the residual rating confirms it is adequately controlled
  2. Challenge the control effectiveness evidence supporting the residual rating before accepting the low residual score Correct answer.
  3. Escalate the heat map to the board without reviewing the underlying control assessments
  4. Increase the risk appetite threshold so the residual rating aligns with the heat map

Explanation

A large gap between inherent positioning and residual rating should trigger scrutiny of whether the claimed controls genuinely reduce likelihood and impact. Governance requires evidence-based challenge before a low residual score is relied upon for decisions or reporting.

Question 29Risk Management Frameworks and Governance

A firm's risk function is asked to approve the trading limits it will later monitor, and the same function reports to the head of trading. Which governance weakness does this arrangement most directly create?

  1. A loss of independence that undermines objective challenge and limit monitoring Correct answer.
  2. An overreliance on external regulators to set internal limits
  3. A duplication of internal audit responsibilities within the risk function
  4. An excessive separation between risk and the business that slows decision-making

Explanation

When the risk function both sets limits and reports to the business it oversees, its ability to challenge that business objectively is compromised. Independence in reporting lines and in limit-setting versus monitoring is a core governance safeguard.

Question 30Risk Management Frameworks and Governance

A multinational group must satisfy differing risk reporting rules across several jurisdictions while maintaining one coherent group risk framework. Which design best achieves this?

  1. A group framework setting common principles and minimum standards, with local addenda to meet jurisdictional requirements Correct answer.
  2. A single group framework applied unchanged everywhere, disregarding local regulatory rules
  3. Fully decentralised frameworks in each jurisdiction with no group-level standards or aggregation
  4. Delegating all risk reporting to external auditors in each jurisdiction

Explanation

Effective group governance combines a common core of principles and minimum standards with local tailoring so that each jurisdiction's rules are met while risks remain comparable and aggregable at group level. This preserves both consistency and local compliance.

Question 31Risk Identification and Assessment

In the ICSAN administrative risk framework, which statement best describes the relationship between a hazard and a risk?

  1. A hazard is measured in monetary units, while a risk is measured only in time lost
  2. A hazard is always a physical object, while a risk is always a financial loss
  3. A hazard and a risk are interchangeable terms that describe the same administrative control failure
  4. A hazard is a source of potential harm, while a risk is the combination of the likelihood of that harm occurring and its consequences Correct answer.

Explanation

Risk assessment separates the source of possible harm from the assessed level of that harm. A hazard is the source or driver, and risk expresses likelihood combined with impact. Keeping the two distinct allows administrators to identify causes first and then quantify exposure.

Question 32Risk Identification and Assessment

An administrative officer is preparing a risk register for a new records digitisation project. Which entry is the clearest statement of an inherent risk?

  1. Staff training will be delivered in the second quarter
  2. The project sponsor has approved the budget
  3. Paper records could be lost or misfiled during scanning, delaying statutory responses Correct answer.
  4. The scanning contractor was selected through competitive tender

Explanation

An inherent risk statement describes an uncertain event and its potential consequence before controls are applied. Only the option that names a possible loss event and its effect qualifies. The other options are project facts or planned activities, not risk statements.

Question 33Risk Identification and Assessment

Which risk assessment technique is specifically designed to identify failure modes, their causes, and their effects in a systematic administrative process?

  1. Balanced scorecard
  2. SWOT analysis
  3. Failure mode and effects analysis (FMEA) Correct answer.
  4. Monte Carlo simulation

Explanation

FMEA examines each step of a process for ways it can fail, the causes of those failures, and the resulting effects, often scoring severity, occurrence, and detection. It is a structured identification tool suited to administrative workflows. The other techniques serve different purposes such as strategy review or quantitative modelling.

Question 34Risk Identification and Assessment

A risk matrix uses a five-point likelihood scale and a five-point impact scale. A risk scored 4 for likelihood and 2 for impact on a multiplicative matrix receives which rating?

  1. 6
  2. 16
  3. 2
  4. 8 Correct answer.

Explanation

On a multiplicative matrix the risk score is likelihood multiplied by impact, so 4 times 2 equals 8. The score is then mapped to a band such as low, medium, or high. Addition or other combinations would misrepresent the intended scaling.

Question 35Risk Identification and Assessment

Which of the following is the primary purpose of conducting a risk identification exercise before any assessment is scored?

  1. To confirm that existing controls are already sufficient
  2. To allocate blame to the staff responsible for past incidents
  3. To produce a complete inventory of uncertain events that could affect the organisation's objectives Correct answer.
  4. To calculate the exact financial value of every possible loss

Explanation

Identification comes first so that the organisation knows which uncertainties exist before it tries to measure or treat them. Its output is a comprehensive list of events linked to objectives. Scoring, valuation, and control evaluation follow in later stages.

Question 36Risk Identification and Assessment

In administrative risk terminology, what does 'residual risk' refer to?

  1. The risk that has been eliminated entirely from the process
  2. The risk that exists before any controls are considered
  3. The risk transferred to a third party under an insurance contract
  4. The risk that remains after existing controls have been applied Correct answer.

Explanation

Residual risk is the exposure left over once current controls are taken into account. It is compared with the target or acceptable level to decide whether further treatment is needed. Inherent risk, by contrast, is assessed before controls.

Question 37Risk Identification and Assessment

Which source of information is most useful for identifying emerging administrative risks that have not yet produced internal incidents?

  1. The organisation's own historical incident log
  2. The current year's approved operating budget
  3. Internal audit reports from the previous three years
  4. External regulatory updates, industry loss data, and sector risk bulletins Correct answer.

Explanation

Emerging risks often appear first in external sources such as regulators, industry loss databases, and professional bulletins. Internal records only capture events the organisation has already experienced. Combining external scanning with internal data gives fuller coverage.

Question 38Risk Identification and Assessment

Which of the following best defines risk appetite in the context of administrative risk management?

  1. The total value of insurance cover purchased against administrative losses
  2. The amount and type of risk an organisation is willing to accept in pursuit of its objectives Correct answer.
  3. The list of risks that the board has formally rejected
  4. The maximum number of incidents the organisation expects each year

Explanation

Risk appetite expresses how much risk the organisation is prepared to pursue or retain in order to meet its objectives. It guides whether assessed risks are acceptable or require treatment. It is a statement of willingness, not a count, a budget, or a list of rejected items.

Question 39Risk Identification and Assessment

An administrator is building a risk register and needs to record the owner, the cause, the potential effect, and the current controls for each entry. Which additional field is most important for enabling later monitoring?

  1. The number of staff employed in the department
  2. The name of the software used to store the register
  3. The date the risk was first identified and the assigned review date Correct answer.
  4. The physical location of the office where the risk arose

Explanation

Tracking when a risk was identified and when it is next due for review supports ongoing monitoring and escalation. Without dates, the register cannot show whether assessments are current. The other fields are administrative metadata that do not drive monitoring.

Question 40Risk Identification and Assessment

A department applies a control that reduces likelihood from 'likely' to 'unlikely' but leaves impact unchanged. How should the residual risk rating be characterised?

  1. It remains identical to the inherent rating because impact did not change
  2. It must fall to the lowest possible band because likelihood was reduced
  3. It should be increased to reflect the cost of the new control
  4. It should be reassessed using the reduced likelihood and the unchanged impact Correct answer.

Explanation

Residual risk is recalculated from the post-control likelihood and impact values. Reducing likelihood lowers the combined score even when impact is unaffected. The new rating is then compared with appetite to decide on further action.

Question 41Risk Identification and Assessment

During a workshop, participants repeatedly propose vague risks such as 'poor communication'. Which facilitation technique best converts this into an assessable risk statement?

  1. Recording it as written to preserve the participants' original wording
  2. Asking the group to specify the event, its cause, and its consequence so the entry follows a cause-event-effect structure Correct answer.
  3. Assigning it the highest possible score to ensure it receives attention
  4. Removing the entry until a documented incident occurs

Explanation

Assessable risks are expressed as a cause, an uncertain event, and a consequence. Probing for these elements turns a vague concern into something that can be scored and owned. This structured phrasing is a core facilitation skill in risk workshops.

Question 42Risk Identification and Assessment

An organisation uses a heat map to present its risk profile. What is the main limitation of relying solely on a heat map for risk assessment?

  1. It cannot display more than five risks at once
  2. It removes the need to document individual risk owners
  3. It can only be used for financial risks
  4. It hides the underlying assumptions and scoring judgements behind aggregated colour bands Correct answer.

Explanation

Heat maps summarise many risks into colour bands, which can obscure the specific likelihood and impact judgements and the assumptions behind them. Decision-makers may over-rely on the visual and miss the detail in the register. Heat maps should therefore be supported by underlying data.

Question 43Risk Identification and Assessment

A clerical team performs a high-volume task with frequent small errors that are corrected quickly. Which combination of likelihood and impact is most appropriate for the inherent risk of these errors?

  1. High likelihood and low impact Correct answer.
  2. High likelihood and high impact
  3. Low likelihood and high impact
  4. Low likelihood and low impact

Explanation

Frequent small errors indicate a high likelihood of occurrence, while rapid correction limits the consequence, giving low impact. This combination is typical of high-volume administrative processes. The assessment should reflect both dimensions rather than assuming severity from frequency alone.

Question 44Risk Identification and Assessment

Which approach best supports the identification of risks arising from interdependencies between administrative functions?

  1. Mapping end-to-end processes and holding cross-functional workshops to surface hand-off risks Correct answer.
  2. Relying only on the risk register maintained by the finance function
  3. Reviewing each department's risks in isolation from the others
  4. Restricting risk discussions to senior management only

Explanation

Interdependency risks occur at the interfaces between functions, so they are best found by mapping processes end to end and involving the parties on both sides of each hand-off. Isolated departmental reviews systematically miss these boundary risks. Cross-functional workshops bring the necessary perspectives together.

Question 45Risk Identification and Assessment

A risk has an inherent score of 20 and a residual score of 15 after controls. What does this pattern most likely indicate?

  1. The controls reduce exposure only modestly, so further treatment may be warranted Correct answer.
  2. The inherent score was calculated incorrectly
  3. The controls are ineffective and should be removed
  4. The risk has been fully mitigated and can be closed

Explanation

A small drop from inherent to residual suggests the existing controls have limited effect on the exposure. Where the residual remains above appetite, additional treatment should be considered. The pattern is a signal for review rather than proof of error or full mitigation.

Question 46Risk Identification and Assessment

Which factor is most relevant when assessing the velocity of an administrative risk?

  1. The number of pages in the risk register
  2. The currency in which any resulting loss would be recorded
  3. The seniority of the person who first identified the risk
  4. The speed at which the risk event would materialise and impact the organisation once triggered Correct answer.

Explanation

Velocity describes how quickly a risk would unfold and cause harm, which affects how much time exists to respond. Fast-onset risks require more immediate controls and contingency arrangements. It is distinct from likelihood and impact, although it informs both.

Question 47Risk Identification and Assessment

An organisation wants to compare its administrative risk profile against peers in the same sector. Which input would most directly support this benchmarking?

  1. Anonymised sector loss data and published industry risk reports Correct answer.
  2. The number of meetings held by the risk committee
  3. Its own internal staff satisfaction survey results
  4. The personal risk preferences of the chief executive

Explanation

Benchmarking requires external comparators, and anonymised sector loss data plus published industry reports provide that reference point. Internal surveys and meeting counts describe the organisation itself rather than peers. Individual preferences are subjective and not a benchmarking source.

Question 48Risk Identification and Assessment

Which statement correctly distinguishes qualitative from quantitative risk assessment?

  1. Quantitative assessment cannot be used for administrative risks
  2. Qualitative assessment uses descriptive scales, while quantitative assessment assigns numerical values to likelihood and impact Correct answer.
  3. Qualitative assessment is always more accurate than quantitative assessment
  4. Qualitative assessment requires a statistical model of loss distribution

Explanation

Qualitative assessment ranks risks using descriptive categories such as high, medium, and low, while quantitative assessment expresses likelihood and impact numerically. Both are valid for administrative risks and are often combined. Neither is inherently more accurate; the choice depends on data availability and decision needs.

Question 49Risk Identification and Assessment

A risk assessment team finds that a single clerk holds the only knowledge of a critical regulatory reporting process. Which risk driver does this situation most clearly represent?

  1. Currency exposure
  2. Key person dependency Correct answer.
  3. Market price volatility
  4. Regulatory change

Explanation

Concentration of critical knowledge in one individual is the defining feature of key person dependency. If that person is unavailable, the process is disrupted. This is a common administrative risk driver and is usually treated through documentation and cross-training.

Question 50Risk Identification and Assessment

Which control characteristic most directly reduces the likelihood component of an administrative risk?

  1. A detective control such as a monthly reconciliation performed after the fact
  2. A preventive control such as mandatory dual authorisation before a payment is released Correct answer.
  3. A directive control such as a policy statement that is not monitored
  4. A corrective control such as an insurance claim after a loss

Explanation

Preventive controls act before an event occurs and therefore reduce the likelihood that the risk materialises. Detective and corrective controls operate after or during the event and mainly affect impact or recovery. A directive control only has effect when it is enforced and monitored.