I85PREP
⌘ K
IFMP Risk Management Certification (RMC), Pakistan study materials
IFMP Risk Management Certification (RMC), Pakistan study resources

IFMP Risk Management Certification (RMC), Pakistan practice questions

One question at a time. Build your IFMP Risk Management Certification (RMC), Pakistan understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of Risk Management

In enterprise risk management, risk is best defined as:

  1. A hazard that can be fully avoided through adequate insurance cover
  2. The process of eliminating all uncertainty from an organisation's strategic objectives
  3. The effect of uncertainty on an organisation's objectives Correct answer.
  4. The certainty that an organisation will incur a financial loss during the next reporting period

Explanation

Risk in enterprise risk management is the effect of uncertainty on objectives, and it can include both downside and upside effects. It is broader than the certainty of a loss and cannot be reduced to a single hazard that insurance removes. Insurance may transfer a financial consequence, but it does not eliminate uncertainty itself.

Question 2Foundations of Risk Management

Which of the following is an example of pure risk for a manufacturing company?

  1. Fire damaging a warehouse and its stored inventory Correct answer.
  2. Investing surplus cash in equities to earn a higher return
  3. Launching a new product that may succeed or fail commercially
  4. Entering a foreign market to increase market share

Explanation

Pure risk involves situations where the possible outcomes are loss or no loss, with no prospect of gain. Fire damage to a warehouse fits this because the firm can only be worse off or unaffected. Product launches, equity investments, and market entry are speculative risks because they can produce a gain as well as a loss.

Question 3Foundations of Risk Management

A board approves a statement describing the amount and type of risk it is willing to accept in pursuit of strategic objectives. This statement is called:

  1. A risk register
  2. Risk appetite Correct answer.
  3. A key risk indicator
  4. Residual risk

Explanation

Risk appetite is the broad amount and type of risk an organisation is willing to accept in pursuit of its objectives. It is set at a high level and guides risk limits and decision-making across the organisation. A risk register records risks, while a key risk indicator monitors changes in exposure.

Question 4Foundations of Risk Management

A firm installs a new reconciliation control over supplier payments. After the control operates for a quarter, the remaining exposure to duplicate payments is referred to as:

  1. Risk appetite
  2. Residual risk Correct answer.
  3. Inherent risk
  4. Systematic risk

Explanation

Residual risk is the risk that remains after controls and treatment actions have been applied. In this case, the reconciliation control reduces but may not eliminate duplicate payments, so the remaining exposure is residual risk. Inherent risk would be the exposure before the control was introduced.

Question 5Foundations of Risk Management

A company purchases commercial property insurance to cover fire damage at its factory. In risk treatment terms, this action is best classified as:

  1. Risk avoidance
  2. Risk reduction through diversification
  3. Risk transfer Correct answer.
  4. Risk acceptance

Explanation

Insurance transfers the financial consequence of a specified loss to the insurer in exchange for a premium. The factory and the fire hazard still exist, so the company has not avoided the risk or eliminated it. Risk transfer shifts part of the financial impact rather than removing the underlying exposure.

Question 6Foundations of Risk Management

In the three lines model, which group provides independent assurance to the board on the effectiveness of risk management and internal controls?

  1. The external contractor managing operations
  2. Internal audit Correct answer.
  3. The risk and compliance function
  4. The first line business units

Explanation

Internal audit forms the third line and provides independent assurance to the board and senior management. The first line owns and manages risk in day-to-day operations, while the second line provides risk and compliance oversight. Independence is central because internal audit must assess controls without managing them.

Question 7Foundations of Risk Management

An investor holds a diversified portfolio of Pakistani equities. Which risk remains because it reflects broad market movements rather than company-specific events?

  1. Operational risk
  2. Systematic risk Correct answer.
  3. Unsystematic risk
  4. Credit risk

Explanation

Systematic risk arises from broad market or economic factors and cannot be removed by holding a diversified portfolio. Company-specific or unsystematic risk can be reduced through diversification. A diversified equity portfolio therefore still remains exposed to market-wide movements.

Question 8Foundations of Risk Management

A risk register is primarily used to:

  1. Calculate the market value of a company's equity shares
  2. Guarantee that identified risks will not occur
  3. Replace the need for board-level risk oversight
  4. Record identified risks, owners, ratings and treatment actions Correct answer.

Explanation

A risk register is a structured record of identified risks and typically includes risk owners, assessments, ratings, and treatment actions. It supports monitoring and reporting but does not guarantee that risks will not occur. It is a management tool that complements board oversight rather than replacing it.

Question 9Foundations of Risk Management

A bank reports a one-day 95% VaR of PKR 10 million on a trading portfolio. Which interpretation is most appropriate?

  1. There is a 5% chance that the one-day loss will exceed PKR 10 million, assuming normal market conditions and an accurate model Correct answer.
  2. The maximum possible loss on any single day is PKR 10 million
  3. The portfolio will lose exactly PKR 10 million on 5% of trading days
  4. The portfolio is certain to earn at least PKR 10 million over a one-day horizon

Explanation

Value at Risk is a statistical estimate of a loss threshold at a given confidence level and horizon. A one-day 95% VaR of PKR 10 million means that, under the model's assumptions, losses are expected to exceed PKR 10 million on about 5% of days. It is not a maximum loss and does not describe a certain outcome.

Question 10Foundations of Risk Management

A risk analyst aggregates two business lines' exposures by simply adding their individual 99% VaR figures. If the lines are not perfectly correlated, this simple addition will most likely:

  1. Produce the exact portfolio VaR regardless of correlation
  2. Overstate the portfolio VaR because diversification benefits are ignored Correct answer.
  3. Eliminate all portfolio risk because the lines are separate
  4. Understate the portfolio VaR because diversification benefits are ignored

Explanation

Adding VaR figures assumes that the two exposures move together perfectly, which is a conservative assumption. When the lines are not perfectly correlated, the portfolio VaR should be lower than the simple sum because diversification reduces combined risk. The simple addition therefore overstates the portfolio VaR by ignoring diversification benefits.

Question 11Foundations of Risk Management

Which risk category is defined as the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events?

  1. Operational risk Correct answer.
  2. Liquidity risk
  3. Market risk
  4. Credit risk

Explanation

Operational risk is the risk of loss from failed or inadequate internal processes, people, systems, or external events. Market risk arises from price movements, credit risk from counterparty non-performance, and liquidity risk from the inability to meet obligations without excessive cost. The stem mirrors the standard operational-risk definition used in banking regulation.

Question 12Foundations of Risk Management

A trading firm declines to enter a volatile commodity market because the potential losses exceed its risk capacity. In risk treatment terms, this decision is:

  1. Risk acceptance
  2. Risk transfer
  3. Risk reduction
  4. Risk avoidance Correct answer.

Explanation

Avoidance eliminates the exposure by deciding not to undertake the activity. Reduction lowers frequency or severity, transfer shifts the financial consequence to another party, and acceptance retains the exposure. Declining the market entirely is therefore avoidance.

Question 13Foundations of Risk Management

In a risk register, the person assigned accountability for managing a risk and reporting on its status is called the:

  1. Chief financial officer
  2. Internal auditor
  3. Risk owner Correct answer.
  4. Compliance officer

Explanation

The risk owner is accountable for managing a risk and reporting its status, even though others may perform the controls. Internal audit provides independent assurance, and compliance and finance may own specific risk types but not the register risk by default.

Question 14Foundations of Risk Management

A risk team wants to identify emerging risks by collecting anonymous expert views over several rounds, with a facilitator feeding back the group's aggregate responses each round. This technique is:

  1. Scenario analysis
  2. Brainstorming
  3. Delphi technique Correct answer.
  4. Fault tree analysis

Explanation

The Delphi technique collects expert judgments anonymously over successive rounds while a facilitator feeds back aggregated results. This controlled feedback helps experts converge without dominance by senior or vocal participants. Brainstorming, fault tree analysis and scenario analysis use different structures and purposes.

Question 15Foundations of Risk Management

Which feature most clearly distinguishes a key risk indicator (KRI) from an ordinary operational performance metric?

  1. It is derived from audited historical accounting records
  2. It is reviewed annually by the external audit firm
  3. It is tied to appetite thresholds and signals risk exposure Correct answer.
  4. It is reported each month to the executive risk committee

Explanation

A KRI is a metric deliberately chosen because movement in it signals a change in risk exposure relative to appetite or tolerance. Ordinary performance metrics may be reported monthly or audited, but those features do not make them risk indicators. The link to appetite thresholds and risk movement is the distinguishing feature.

Question 16Foundations of Risk Management

A firm's board states it will accept only moderate exposure to credit risk. Management then sets a maximum single-borrower exposure of 5% of capital. The 5% limit is best described as:

  1. A risk limit translating appetite into an operating constraint Correct answer.
  2. A control that eliminates credit risk
  3. A risk capacity reflecting the firm's maximum absorbable loss
  4. A key risk indicator used to forecast credit losses

Explanation

Risk appetite is the level of risk the firm is willing to accept; limits translate that appetite into measurable operating boundaries. Capacity is the maximum risk the firm could absorb, while a KRI is a warning indicator. A limit constrains behavior rather than eliminating the risk.

Question 17Foundations of Risk Management

On a likelihood-impact heat map, a risk sits in the high-likelihood, high-impact corner. Which response is most consistent with good risk management?

  1. Treat it as acceptable because no loss has yet occurred
  2. Record it in the register and review it at the next annual cycle
  3. Escalate it for priority treatment and assign a risk owner Correct answer.
  4. Transfer it to an insurer regardless of cost

Explanation

A high-likelihood, high-impact risk is a priority item that should be escalated, assigned an owner and treated promptly. Waiting for the annual cycle or assuming no loss means no problem leaves the firm exposed. Transfer may be part of treatment but is not automatic or costless.

Question 18Foundations of Risk Management

A business impact analysis (BIA) is conducted as part of business continuity planning. Its primary purpose is to:

  1. Test whether internal controls are operating effectively
  2. Identify critical business processes and the maximum tolerable downtime Correct answer.
  3. Determine the firm's optimal capital structure
  4. Quantify the firm's market risk under stressed market conditions

Explanation

A BIA identifies the processes whose disruption would most harm the firm and establishes recovery objectives such as maximum tolerable downtime and recovery time objectives. It does not stress-test market risk, test controls or set capital structure. Those tasks belong to other risk and finance functions.

Question 19Foundations of Risk Management

A manufacturer relies on a single supplier for a critical component with no qualified alternative. The supplier's failure appears on the risk register with a low likelihood rating. Why should the risk still receive elevated attention?

  1. Purchasing insurance will fully eliminate the supply disruption exposure faced by the firm
  2. Low-likelihood risks are always ranked above high-likelihood risks in a register
  3. The supplier relationship is a market risk that the firm cannot influence or manage
  4. High consequence and low substitutability can outweigh a low likelihood estimate Correct answer.

Explanation

Risk prioritization should reflect impact, velocity and controllability, not likelihood alone. A single-source dependency can cause severe disruption and is hard to control quickly, so a low likelihood estimate does not make it unimportant. Insurance may transfer some loss but rarely removes the operational disruption.

Question 20Foundations of Risk Management

An operational risk team estimates future losses using five years of historical data, but the firm has just outsourced a core process to a new vendor. What is the most important limitation of the historical data?

  1. The loss data have been formally approved by the internal audit function
  2. The loss data are denominated in a currency different from the reporting currency
  3. They reflect a process no longer representative of current risk Correct answer.
  4. The data cover too many loss events for reliable estimation

Explanation

Historical loss data are only useful if the past loss-generating process resembles the current one. Outsourcing a core process changes people, systems and controls, so the old data may understate or misstate current exposure. Data currency, audit approval or volume do not fix that representativeness problem.

Question 21Foundations of Risk Management

Under the distinction drawn by Frank Knight, which statement best describes the difference between risk and uncertainty?

  1. Risk involves outcomes with known or estimable probabilities, while uncertainty involves outcomes whose probabilities cannot be assigned. Correct answer.
  2. Risk describes losses that have already occurred, whereas uncertainty describes potential future gains and losses.
  3. Risk and uncertainty are identical, but risk is used when the exposure can be measured in monetary units.
  4. Risk applies only to hazards that can be insured, whereas uncertainty applies to speculative business decisions.

Explanation

Knight's distinction separates situations that can be quantified probabilistically from those that cannot. Risk exists when an outcome distribution or probability can be estimated; uncertainty exists when no reliable probability can be assigned. This distinction matters because risk measurement tools such as loss distributions and expected loss apply only to the measurable category.

Question 22Foundations of Risk Management

A bank reviews a lending product before any credit controls are applied and estimates that the exposure could lose PKR 80 million. In risk management terminology, this estimate represents:

  1. Risk appetite
  2. Risk capacity
  3. Residual risk
  4. Inherent risk Correct answer.

Explanation

Inherent risk is the level of risk that exists before controls, mitigants or risk responses are applied. Once credit controls operate, the remaining exposure is described as residual risk. The PKR 80 million figure is therefore an inherent-risk estimate because it is measured on a gross basis.

Question 23Foundations of Risk Management

A bank's SME portfolio has an exposure at default of PKR 50 million, a probability of default of 2% and a loss given default of 45%. Using the standard expected loss formula, the expected loss is:

  1. PKR 4,500,000
  2. PKR 225,000
  3. PKR 900,000
  4. PKR 450,000 Correct answer.

Explanation

Expected loss is calculated as probability of default multiplied by loss given default multiplied by exposure at default. Here, 2% × 45% × PKR 50 million equals PKR 450,000. Expected loss is a long-run average credit cost, not a worst-case or stress loss.

Question 24Foundations of Risk Management

Two business lines have volatile earnings. In a loss-distribution approach to risk aggregation, the combined portfolio risk is lowest when the correlation between the two loss distributions is:

  1. 0.0
  2. +0.5
  3. +1.0
  4. -1.0 Correct answer.

Explanation

Combined risk depends on both the individual volatilities and the correlation between them. A correlation of -1.0 produces the greatest offset between losses, so the aggregate volatility is lower than with any positive or zero correlation. Perfect positive correlation of +1.0 gives no diversification benefit at all.

Question 25Foundations of Risk Management

A corporate banking unit reports revenue of PKR 60 million, operating costs of PKR 24 million, expected loss of PKR 6 million and economic capital of PKR 150 million. Its risk-adjusted return on capital (RAROC) is:

  1. 40%
  2. 24%
  3. 12%
  4. 20% Correct answer.

Explanation

RAROC divides risk-adjusted return by the economic capital supporting the activity. The numerator here is PKR 60 million minus PKR 24 million minus PKR 6 million, which equals PKR 30 million. Dividing PKR 30 million by PKR 150 million gives 20%.

Question 26Risk Governance, Framework and Risk Appetite

A bank's board is defining the outer boundary of risk it could bear before capital adequacy or liquidity would be impaired. Which risk appetite concept does this boundary represent?

  1. Risk appetite
  2. Risk capacity Correct answer.
  3. Risk limit
  4. Risk tolerance

Explanation

Risk capacity is the maximum risk an institution can bear before breaching constraints such as capital adequacy, liquidity or regulatory requirements. Appetite is the lower amount the institution chooses to take within that capacity, tolerance is acceptable variation around appetite, and limits are measurable boundaries set at business-line level.

Question 27Risk Governance, Framework and Risk Appetite

In the three lines model, which group constitutes the first line and holds primary ownership of risk?

  1. Internal audit, providing independent assurance
  2. Business units that originate and manage risk Correct answer.
  3. The board risk committee approving appetite
  4. Compliance, monitoring regulatory breaches

Explanation

The first line consists of the business and operational units that originate risk and are responsible for managing it day to day. The second line provides independent oversight and compliance challenge, while internal audit as the third line gives independent assurance to the board.

Question 28Risk Governance, Framework and Risk Appetite

Which action falls squarely within the board's risk governance responsibilities rather than management's?

  1. Preparing daily market risk reports for the treasury desk
  2. Setting individual trader position limits within approved buckets
  3. Investigating the root cause of a settlement failure
  4. Approving risk appetite and overseeing the risk framework Correct answer.

Explanation

The board is responsible for approving the enterprise risk appetite and overseeing the risk management framework, including setting the tone at the top. Preparing reports, assigning trader limits within approved buckets and investigating operational failures are management or first-line activities delegated under that framework.

Question 29Risk Governance, Framework and Risk Appetite

A board approves a statement saying the bank has 'low appetite for operational risk'. Which mechanism best converts this qualitative statement into enforceable boundaries for each business line?

  1. Recording operational losses in a central risk register
  2. Commissioning an annual external review of controls
  3. Publishing the statement on the intranet for staff awareness
  4. Cascading quantitative limits with escalation triggers Correct answer.

Explanation

A qualitative appetite must be operationalised through measurable limits, thresholds and escalation triggers assigned to business lines so that breaches are detected and acted upon. Awareness, loss recording and external review support the framework, but they do not themselves create enforceable boundaries.

Question 30Risk Governance, Framework and Risk Appetite

Which reporting arrangement best preserves the independence of the Chief Risk Officer in a bank?

  1. Reporting to the internal audit head to align assurance coverage across the group
  2. Reporting to the finance director with shared revenue and cost targets
  3. Reporting to the head of trading with a dotted line to the finance director
  4. Functional reporting to the board risk committee, administrative to the CEO Correct answer.

Explanation

CRO independence requires unimpeded access to the board and freedom from business-line pressure, which is typically achieved through functional reporting to the board or its risk committee with administrative reporting to the CEO. Reporting to trading, internal audit or a finance director with shared performance targets compromises objectivity and the ability to challenge.

Question 31Risk Governance, Framework and Risk Appetite

Which pattern is the clearest early warning of a weak risk culture in a financial institution?

  1. Limit breaches routinely resolved without escalation Correct answer.
  2. Annual code of conduct training completed by staff
  3. Annual review of the risk appetite statement
  4. Quarterly board risk committee meetings with minutes retained

Explanation

Risk culture is revealed most clearly by how breaches and bad news are handled: routine tolerance of breaches without escalation or consequence signals that limits are not taken seriously. Regular committee meetings, training and annual appetite review are ordinary framework features and do not by themselves indicate a weak culture.

Question 32Risk Governance, Framework and Risk Appetite

A firm sets an appetite of 'no more than 50 operational-loss events above PKR 1 million per year' and treats 60 events as a trigger for board reporting. What is the 60-event level best described as?

  1. Risk profile
  2. Risk capacity
  3. Risk appetite
  4. Risk tolerance Correct answer.

Explanation

Tolerance is the acceptable variation around the stated appetite before escalation is required; here 60 events breaches the 50-event appetite and triggers board reporting. Capacity is the absolute maximum the firm could bear, appetite is the desired level of risk, and profile is the current aggregate exposure.

Question 33Risk Governance, Framework and Risk Appetite

Which board committee normally reviews and challenges the institution's aggregate risk profile and recommends the risk appetite statement for board approval?

  1. The asset-liability committee
  2. The audit committee
  3. The nomination and remuneration committee
  4. The board risk committee Correct answer.

Explanation

A dedicated board risk committee gives focused oversight of the risk management framework, aggregate risk profile and appetite, and recommends the appetite statement to the full board. The audit committee focuses on financial reporting and internal control assurance, the nomination and remuneration committee on appointments and pay, and the asset-liability committee on balance-sheet and liquidity matters.

Question 34Risk Governance, Framework and Risk Appetite

A board approves a risk appetite statement that says 'moderate appetite' for every risk type but contains no metrics, limits or escalation triggers. What is the most serious governance deficiency?

  1. The board exceeded its authority by approving the statement
  2. It is unmeasurable and unlinked to limits, so cannot constrain risk-taking Correct answer.
  3. Moderate appetite is inappropriate for every risk type
  4. The statement covers too many risk types for a board to oversee

Explanation

An appetite statement must be specific enough to be measured and must cascade into limits, thresholds and escalation triggers; otherwise it cannot constrain or monitor risk-taking. The number of risk types covered, the board's authority to approve and the choice of 'moderate' are secondary to the absence of measurable boundaries.

Question 35Risk Governance, Framework and Risk Appetite

Which governance arrangement most directly undermines the effectiveness of the second line of defense?

  1. Annual review of risk limits against approved appetite
  2. Direct escalation rights for risk staff to the board risk committee
  3. Business heads controlling the risk function's budget and ratings Correct answer.
  4. Independent CRO presentations to the board risk committee

Explanation

The second line must be independent of the business activities it monitors; if the business heads it oversees control its budget and performance ratings, challenge becomes conflicted and can be suppressed. Independent board access and periodic review of limits against appetite strengthen, rather than weaken, second-line effectiveness.

Question 36Risk Governance, Framework and Risk Appetite

Which description best defines risk governance in a financial institution?

  1. The calculation of regulatory capital under Basel rules
  2. The annual external audit of financial statements
  3. The daily hedging of market positions by the treasury desk
  4. The board-led structures and processes for directing and overseeing risk Correct answer.

Explanation

Risk governance is the board-led system of structures, policies, committees and accountabilities that directs and oversees risk-taking. It sets direction and oversight, while hedging, capital calculation and external audit are execution or assurance activities.

Question 37Risk Governance, Framework and Risk Appetite

Which characteristic is most consistent with a sound risk appetite statement?

  1. It is kept confidential from business lines
  2. It links appetite to strategy with measurable indicators Correct answer.
  3. It lists every operational procedure in detail
  4. It is revised only after a breach occurs

Explanation

A sound risk appetite statement translates strategy into the types and levels of risk the board is willing to accept. It should include qualitative principles and, where possible, quantitative measures that can be monitored and escalated.

Question 38Risk Governance, Framework and Risk Appetite

In risk appetite frameworks, what does risk tolerance generally describe?

  1. Acceptable deviation from appetite for a specific risk Correct answer.
  2. A daily stop-loss limit used by the trading desk
  3. The maximum risk the institution could bear before failure
  4. The minimum capital required by the regulator

Explanation

Risk tolerance is the acceptable variation around the approved risk appetite for a given risk type. It sits below risk capacity, which is the maximum risk the institution could bear before capital or liquidity is impaired.

Question 39Risk Governance, Framework and Risk Appetite

A bank is establishing a board risk committee to provide independent challenge on risk appetite. Which composition best supports that objective?

  1. The CRO, head of credit and head of treasury
  2. The CEO, CFO and two executive directors
  3. Mostly independent non-executives with risk expertise Correct answer.
  4. The chair of the audit committee and the external auditor

Explanation

Independence is strengthened when the board risk committee is composed mainly of independent non-executive directors with relevant risk expertise. Executives and the CRO may attend, but they should not dominate a committee whose role is to challenge management.

Question 40Risk Governance, Framework and Risk Appetite

Which feature makes a board risk report most useful for governance?

  1. It compares exposures with appetite and flags emerging breaches Correct answer.
  2. It focuses on market news and competitor results
  3. It is prepared by the business line being reported on
  4. It contains only historical loss data for the last quarter

Explanation

A governance-level risk report should aggregate exposures, compare them with approved appetite and limits, and highlight breaches or emerging risks. This lets the board challenge direction rather than review stale data.

Question 41Risk Governance, Framework and Risk Appetite

A relationship manager seeks an exception to credit policy for a large exposure. Under sound risk governance, who should decide?

  1. An independent credit committee within delegated authority Correct answer.
  2. The CEO alone, to speed up the decision
  3. The branch operations officer handling documentation
  4. The relationship manager, because client ownership sits there

Explanation

Policy exceptions should be approved by an authority independent of the business line seeking the exception and within formally delegated limits. The decision and rationale should be documented and reported so that exceptions are visible to the board or its committee.

Question 42Risk Governance, Framework and Risk Appetite

The CRO is also appointed head of corporate banking, a revenue line. What is the main governance concern?

  1. A conflict of interest impairs risk independence Correct answer.
  2. It reduces the need for a board risk committee
  3. It increases the CRO's understanding of client risk
  4. It automatically breaches capital adequacy rules

Explanation

Combining a revenue role with the CRO role creates a conflict between challenging risk-taking and pursuing business targets. Sound governance keeps the CRO independent of revenue lines and with direct access to the board risk committee.

Question 43Risk Governance, Framework and Risk Appetite

Which compensation design best reinforces a strong risk culture?

  1. Uniform bonuses for all staff regardless of performance
  2. Risk-adjusted bonuses deferred over several years Correct answer.
  3. Bonuses based solely on quarterly revenue growth
  4. Bonuses paid immediately after each profitable trade

Explanation

Compensation should reward risk-adjusted performance and defer part of the award so that risk outcomes emerge before payout. This aligns staff incentives with the board's risk appetite and discourages short-term risk-taking.

Question 44Risk Governance, Framework and Risk Appetite

A bank plans to launch a product with a new fee structure and contingent credit exposure. What is the most appropriate governance step before launch?

  1. A treasury update after the first month of sales
  2. An internal audit review after launch to confirm controls
  3. A marketing sign-off because the product is client-facing
  4. Formal risk assessment and risk committee approval Correct answer.

Explanation

New products with unfamiliar risk features should pass a formal risk assessment and approval by the relevant risk committee before launch. This ensures limits, controls and capital impacts are understood and owned.

Question 45Risk Governance, Framework and Risk Appetite

What is the proper role of internal audit in risk governance?

  1. Owns the enterprise risk register and updates it daily
  2. Independent assurance that risk governance works Correct answer.
  3. Sets the board's risk appetite annually
  4. Approves credit limits for large borrowers

Explanation

Internal audit provides independent assurance to the board that the risk governance framework and controls are designed and operating effectively. It must not own risk decisions or set appetite, because that would compromise its independence.

Question 46Risk Governance, Framework and Risk Appetite

A bank's board has approved a risk appetite statement covering credit, market, liquidity and operational risk. Under sound risk governance, which review trigger is most appropriate for keeping that statement current?

  1. Only when the regulator issues a circular that directly amends the statement, with no internal trigger
  2. At least annually, and out-of-cycle whenever strategy, the operating environment or capital adequacy changes materially Correct answer.
  3. Only after a loss event exceeds the prior year's budget for that risk type by a material margin
  4. Every five years, aligned to the cycle for replacing the core banking system and its risk engines

Explanation

Risk appetite is a living board document and must stay aligned with strategy, the operating environment, and the bank's capital and liquidity capacity. Sound frameworks therefore require board review at least annually, supplemented by event-driven triggers such as a material strategy shift, an acquisition, a severe macroeconomic shock, or a significant fall in capital ratios. Relying only on regulatory prompting, system-replacement cycles, or loss events leaves appetite stale while risk-taking continues.

Question 47Risk Governance, Framework and Risk Appetite

Which distinction correctly separates a risk appetite statement from a risk policy in a bank's risk framework?

  1. The risk appetite statement sets the mandatory control procedures and reporting lines, while policies record the aggregate level of risk the board is willing to accept
  2. Appetite states how much and what type of risk the bank accepts in pursuing its strategy; policies turn that intent into binding controls Correct answer.
  3. The risk appetite statement binds only the second line of defence, while policies bind the first and third lines
  4. The risk appetite statement is prepared by internal audit for board approval, while policies are drafted by the business lines

Explanation

The appetite statement is a forward-looking declaration by the board of how much and what type of risk it will accept in pursuit of strategy, typically combining qualitative statements with quantitative thresholds. Policies, standards, and procedures operationalise that intent by setting mandatory requirements, controls, delegated authorities, and accountabilities. Confusing the two either leaves appetite unenforceable or turns policy detail into false precision.

Question 48Risk Governance, Framework and Risk Appetite

A treasury desk temporarily exceeds its board-approved market risk limit by 15% while positioning for a client-driven flow. Which sequence of actions best reflects sound risk governance?

  1. Bring the position back within limit under a pre-agreed plan, notify senior management and the risk committee promptly, and document the root cause Correct answer.
  2. Ask the finance function to adjust the risk measure so that the breach disappears from the monthly board pack
  3. Allow the position to run while the desk prepares a business case, then seek ratification at the next scheduled board meeting
  4. Leave the position in place but reclassify it as a client-facilitation exposure so it no longer counts against the limit

Explanation

A limit breach must trigger prompt escalation and remediation, not retrospective ratification or reclassification. The desk reduces the position in line with a pre-agreed plan, management and the risk committee are informed within a defined timeframe, and the root cause is documented so limits, models, or controls can be corrected. Redefining or adjusting the measure to hide the breach destroys the integrity of the limit framework and is itself a conduct issue.

Question 49Risk Governance, Framework and Risk Appetite

A bank is calibrating the quantitative appetite threshold for credit risk. Which input provides the strongest basis for setting the maximum tolerable level of credit losses?

  1. The credit committee's view of what the business lines can comfortably deliver within the annual budget
  2. Severe-but-plausible stress results showing capital and liquidity stay above board-approved internal minima after losses Correct answer.
  3. The average loss rate recorded over the preceding three profitable years
  4. Peer banks' published risk appetite ratios, adopted unchanged to preserve competitive standing

Explanation

Appetite thresholds should be calibrated from risk capacity and resilience rather than from recent benign experience, peer practice, or budget ambition. Severe-but-plausible stress results show whether the bank remains above its internal capital and liquidity minima after absorbing losses, which is the binding constraint on how much credit risk can be tolerated. Historic average losses and peer ratios say little about survivability under stress.

Question 50Risk Governance, Framework and Risk Appetite

A digital lending launch creates material conduct risk and model risk, but the bank's risk taxonomy and appetite statement do not name either risk type, and business-line reporting omits them. What is the most significant governance consequence?

  1. Both risks are adequately captured because conduct and model failures eventually appear as operational-loss events
  2. Regulatory capital requirements rise automatically to cover the two unnamed risk types
  3. Board reporting understates aggregate risk, so limits, capital planning and challenge rest on an incomplete risk picture Correct answer.
  4. Internal audit cannot form an opinion on the digital lending product until the taxonomy is expanded

Explanation

The risk taxonomy defines the risk universe used for aggregation, appetite setting, and board reporting. If conduct and model risk are omitted, they are neither limited nor measured consistently, so the aggregate profile presented to the board understates total risk and limit and capital decisions are made on an incomplete basis. Operational-loss capture is not a substitute, because many conduct and model failures cause reputational or strategic harm without producing a recorded loss event.