Exam questions

Question 1

Which of the following is correct regarding the historical development of risk management?

1. Risk management as a formalised discipline has been around for 20 years.
2. The first appearance of ‘Chief Risk Officer’ is associated with implementation of ERM.
3. The inherent defects in the risk management approach failed to prevent the global financial crisis of 2008.
4. During the 2000s, financial services firms have been encouraged to develop internal risk management systems and capital models.

Answer 1

2 is correct as during the 1990s corporate governance encouraged directors to place greater emphasis on ERM and the first appointment of a chief risk officer occurred.

This followed financial service firms being encouraged to develop internal risk management systems and capital models during the 2000s. Thus point 4 is correct.

Incorrect
1. Been around for more than 100 years
3. The failure was in correctly applying risk management processes and procedures, rather than any defects in the risk management approach.

Question 2

Hopkin states ‘Most standard definitions of risk refer to risks being attached to corporate objectives’. What else may risks be attached to?
Core processes
Hazard management or
risk correlation

Answer 2

Core Processes

Risk attachment is covered in Fig 1.2 in Hopkin which shows how risks can be attached to core processes as well as corporate objectives.

Question 3

Enterprise Risk Management (ERM) is considered to have significant advantages over traditional risk management approaches because ERM:
Ensures that an organisation’s objectives will be achieved.
takes an integrated or holistic approach or
addresses strategic, tactical and operational risk management.

Answer 3

The key differentiator for ERM is that it takes an integrated or holistic approach. Option A is incorrect as neither traditional or ERM approaches can ensure that an organisation’s objectives will be achieved whilst both can address the management of strategic, tactical and operational risks.

Question 4

Which of the following would you expect to see in the context of risk strategy in the risk architecture, strategy and protocols framework (RASP)?

The risk and audit team report to the Board quarterly.
The attitude to risk is clearly defined.
Ownership of risk is delegated to business units.
The organisation has a defined risk appetite.

Answer 4

2 & 4
Risk appetite is part of the risk management strategy element of the RASP framework set out in Table 23.1 in Hopkin. Risk reporting and roles and responsibilities are parts of the risk management architecture within the same framework.

Question 5

What elements in addition to Operations make up the COSO ERM risk classification system?

Compliance.
Reporting.
Reputational.
Strategic.

Answer 5

1,2,4
The elements of the COSO ERM cube classification headings include strategic, operations, reporting and compliance. Reputational is one of the classification headings in the FIRM risk scorecard and not part of COSO ERM.

Question 6

Which factors are most likely to influence assigning a low, medium or high rating for the likelihood and impact of an interruption to production due to a natural disaster?

The length of time since the last natural disaster in the vicinity of the production unit.
Where your suppliers are located.
Long range models and stress scenarios.
What you produce.

Answer 6

2,4
A key consideration is where your suppliers are located, as production would be harder hit if they were located nearby and affected by the same disaster. The second consideration is what you produce as this will determine the extent to which production might be disrupted by a natural disaster, for example products that are reliant on just-in-time deliveries would be more impacted if deliveries could not be made.
The length of time since the last natural disaster is not a relevant consideration as it is unlikely to impact the likelihood of another natural disaster occurring. Similarly, modelling is of limited value when assessing the likelihood of natural disasters occurring.

Question 7

Which of the following factors are likely to influence the risk classification approach adopted by an organisation?

Risk appetite.
The complexity of operations.
Stakeholder views.
The types of risk that are most common.

Answer 7

2,4
Organisations will choose a risk classification approach that is most suited to its size, nature and complexity. Although there are different risk classification approaches many offer a combination of event, impact, source and consequence categories. They all help organisations define the scope of risk management providing a structure for risk identification and giving an opportunity to aggregate similar kinds of risks. This makes options 2 and 4 correct.

Classification of risks enables organisations to better identify risk appetite, risk capacity and total risk exposures in relation to each risk. Stakeholder views do not form part of the factors that can influence a risk classification system. This makes options 1 and 3 incorrect.

Question 8

Which one of the following are consequences of people with different risk perceptions undertaking risk assessments?
Risk treatments could be applied to the less significant risks
Risks are not fully identified
It is not possible to determine a risk rating for a particular risk

Answer 8

A
One consequence of people having different risk perceptions is that the significance of some risks may be incorrectly determined and therefore treatments could be applied to less significant ones. The failure to identify risks fully is possible but this is relevant to the risk identification stage of risk assessment only and with people having different risk perceptions it is possible that more risks are identified and more fully discussed. In terms of risk assessment ratings, risk perceptions may result in an incorrect rating being applied but a rating will eventually be determined, possibly by the most senior person and even if not everybody agrees. The correct answer is Risk treatments could be applied to the less significant risks

Question 9

Which of the following controls can be used to reduce the likelihood of IT failure?

IT penetration testing
Robust business continuity plans
Robust breach response plan

Answer 9

C
Hopkin, Chapter 19, Page 207

The correct answer is:
IT penetration testing

Question 10

Which of the following are common characteristics of a traditional risk management approach?
1. There is no ownership of risk in this organisation.
2. The culture of the organisation embraces risk management.
3. Risk is looked after by the organisation’s insurance department.
4. This organisation adopts an integrated approach to risk management.

Answer 10

1,3
Traditional risk management tends to focus on the mathematics of hazard-based risks or financial risks amongst other specific risks and not an enterprise-wide approach. This means options 2 & 4 are incorrect as they refer to an enterprise-wide approach.

Enterprise risk management offers a holistic approach to risk management and recognises that risks in one part of the organisation can relate to risks occurring elsewhere and these links and relationships need to be managed just as much as individual risks in isolation. In this manner there is specific ownership of risks in the organisation.
This means options 1 & 3 are traditional risk management characteristics rather than enterprise-wide approach, as they manage risks in isolation.

Question 11

s part of the ISO 31000 (2018) risk management process monitoring and review is best thought of as which of the following?
An extra stage.
A feedback loop.
Part of an iterative process.

Answer 11

3
Monitoring and review is part of the ISO 31000 risk management process set out in Fig 6.4 in Hopkin. It is iterative, rather than just an extra stage or a feedback loop, because each of the stages in the process may be executed multiple times before the risk evaluation is finalised and the appropriate risk treatment agreed.

Question 12

Which of the MADE2 objectives is most relevant to a manufacturing organisation, in managing the risk of production cost overruns?

Mandatory.
Decision making.
Effective and efficient processes.

Answer 12

3
A manufacturing organisation’s risk management considerations will assist with achieving effective operations and compliance in managing the risk of production cost overruns. Option C is the most aligned to this objective.

Question 13

Among the loss control tools and techniques, which of the following is used for cost containment, after a business interruption?

Fire drills.

Crisis communication plan.

Restrictions on smoking.

Answer 13

2
Loss containment techniques are concerned with the activities for minimizing the costs following any business interruption. As such, crisis communication plan is used by organisations in order to minimize any loss or damage to reputation following the incident. Fire drills and routine maintenance and related to damage limitation and loss prevention, respectively.

Question 14

What sort of control would appear on the left side of a Bowtie analysis?
Response improve.
Preventative.
Detective.

Answer 14

2
Preventative controls occur before the risk materialises in the disruption event.

Question 15

In the longer term which of the following can ERM result in?
Impaired resource deployment.
Enhancement of enterprise resilience.
Assured profit margins.

Answer 15

Over the longer term ERM can see organisations anticipate and respond to change, not only to survive but also to evolve and thrive. Thus enhances resilience

Over longer term ERM allows organisations to prioritise resource deployment and assess overall resource needs. This improves resource deployment rather than reducing it.

ERM cannot not by itself result in guaranteed increased profits. It is possible but cannot be guaranteed or assured.

Question 16

Which of these factors is most likely to determine an organisation’s attitude to risk?
The maturity of the sector or industry.
The maturity of the organisation.
The level of risk management sophistication.

Answer 16

2
An organisation’s attitude to risk is specific to that organisation and is different when an organisation is a start-up operation compared to a mature organisation. This is all related to the maturity of the organisation, not to the sector / industry or risk management sophistication.

Question 17

What should a company do if faced with a high risk/ high reward situation that is outside of its risk appetite, and has not been able to find a partner to work with in this circumstance?
Explore.
Exploit.
Exit.

Answer 17

C
In a high risk/ high reward scenario an organisation that does not have the risk appetite, capacity or resources but has been able to find a partner to buy or share will want to exploit the opportunity.

However, in this question the organisation is unable to find a suitable partner and thus the most appropriate response would be to exit. Option C is correct.

Question 18

Which of the following best describes control risks?
Risks that can only inhibit achievement of corporate mission.
Risks that cause doubt about the ability to achieve the organisation’s mission.
Risks that are deliberately sought or embraced by the organisation.

Answer 18

2
Hazard risks are the risks that can only inhibit achievement of corporate mission. Opportunity risks are the risks that are deliberately sought or embraced by the organisation. Options A and C are incorrect.

Control risks are associated with uncertainty and cause doubt about the ability to achieve the organisations mission.

Question 19

What is an advantage of a detective control?
They eliminate the hazard, so that no further consideration of it is required.
Risk control requirements can be explained during a training session
They are often simple to administer and can distinguish the lessons learnt from projects that can be applied in future

Answer 19

C
Preventive controls are designed to limit the possibility of an undesirable outcome being realised. Examples include limits of authorisation and segregation of duties.
Corrective controls are designed to limit the scope for loss and reduce any undesirable outcomes that have been realised.
Directive controls are designed to ensure that a particular outcome is achieved. They are based on giving directions to people on how to ensure losses do not occur. Typical examples include written systems and procedures and training.

Question 20

A risk matrix is commonly used by organisations to:
Provide a visual presentation of an organisation’s strategic objectives
Display the likelihood of an event against its magnitude or impact
Facilitate an effective allocation of resources to risk-reducing counter measures.

Answer 20

B
It does demonstrate the relationship between the likelihood of the risk materialising and the impact of the event should the risk materialise.

Question 21

The highest level of risk management sophistication is related to which of the following?
control management.
achievement of benefits.
recognition of stakeholder expectations.

Answer 21

B
The achievement of benefits is indeed related to the highest level of risk management sophistication [Hopkin, ibid.].

Control management is related to the third level (CONFORM) of the four levels hierarchy of risk management sophistication [Hopkin, p. 53, figure 3.2].

The recognition of stakeholder expectations is a result of becoming aware of requirements that have to be met, which is part of the initial level of risk management sophistication (INFORM).

Question 22

Which of the following conditions is a necessity for defining risk in corporate settings?
Changing circumstances.
Declared organisational objectives.
Suitability for own purposes.

Answer 22

A
Change in circumstances is a source of uncertainty, which is a form of risk. “In order for a risk to materialize, an event must occur.” [Hopkin, p. 16, paragraph 3]. Without a change in circumstances, there can never be an event, and therefore no risk occurrence. If a risk can never materialize, it does not exist.

Declared organisational objectives is wrong. It is true that “Risk in an organisational context is usually defined as anything that can impact the fulfilment of corporate objectives.” [Hopkin, p. 16, second paragraph] but this doesn’t necessarily mean that risk cannot be defined without having declared corporate objectives, let alone that “corporate objectives are usually not fully stated by most organisations” [Hopkin, ibid.].

Suitability for own purposes is wrong. We can read in Hopkin [p. 16, first paragraph] that because “there are many available definitions for the word risk, it is important that the organisation chooses the definition that is most suitable for its own purposes.” In other words, the “suitability for own purposes” is not a necessary condition for defining risk but an optimisation in making the best use of risk management.

Question 23

Which of the following are determinants of the organisational attitude to risk?

1. Opportunity pursuit.
2. Business maturity.
3. Area of activity.
4. Decision-making

Answer 23

2,3
Option 1 is wrong. As opportunities arise their pursuit is inherently a matter of “short-term willingness to take risk”, which is an indicator of risk appetite, not risk attitude.

Option 2 is correct. The attitude to risk is often different “when an organisation is a start-up operation rather than a mature organisation”.

Option 3 is correct. The “attitude of the organisation to risk will depend on the sector … within which it operates” and area of activity is another term for sector.

Option 4 is wrong. Decision-making is a result of risk management, not a determinant of the risk attitude. “Improvement in the robustness of decision-making activities is one of the key benefits of risk management.”.

Question 24

When evaluating the effectiveness of controls on an inherent risk which of the following must be considered?

1. Target level of risk.
2. Risk magnitude.
3. Resulting risk exposure.
4. Likelihood / impact scales.

Answer 24

2,3,4
To evaluate the effect of a risk control we need a start point, an end point and a measuring instrument.

Option 1 is incorrect. The target level of risk is an objective, and the question is about the evaluation of a variation in the level of risk, which may or may not reach the target level of risk.

Option 2 is correct. “Magnitude represents the gross or inherent level of the risk.” This is the start point.

Option 3 is correct. According to Hopkin “The exposure presented by an individual risk can be defined in terms of the likelihood of the risk materializing and the impact of the risk when it does materialize.” We can therefore measure a risk exposure for the inherent risk and a risk exposure for the residual risk. As Option 3 is about “Resulting risk exposure”, it clearly identifies the exposure associated with the residual (current) risk remaining after the application of the risk control, and this is the end point.

Option 4 is also correct. An instrument of measure is necessary to determine both the start point (inherent risk in the case of this question) and the end point (residual risk). In this case, the package of the likelihood / impact scales represents the measuring instrument.

Question 25

Which of the following can be revealed by the Bow-tie method of analysing a risk? 1. Risk attachment points. 2. Types of damage. 3. Risk classification used. 4. Suitable controls.

Answer 25

Options 1, 2 and 4 are correct. In the bow-tie diagram from the box “Risk management and the bow-tie” [Hopkin, p. 30] we can see examples of expected impacts (e.g. asset destruction, smoke inhalation) that indicate types of damage (e.g. destruction, inhalation) and also risk attachment points (affected elements). We can also see in that diagram categories of risk controls. Option 3 is wrong. The question is about analysing a risk, meaning a certain risk, not risk in general, so we can’t have risk categories (e.g. strategic, tactical, operational, compliance) in the left side of the bow-tie, to allow us to figure out the risk classification system.

Question 26

What is the central purpose of risk management as promoted by ISO 31000:2018? Protection and creation of value. Continuous improvement of the risk management capability. Integration of risk thinking in all decision-making processes.

Answer 26

A ISO 31000 states that ‘The purpose of risk management is the creation and protection of value. It improves performance, encourages innovation and supports the achievement of objectives.’

Question 27

What is the purpose of a risk register? To facilitate ownership and management of risks. To facilitate risk perception. To validate the position of the risk manager.

Answer 27

A A risk register is defined in the ISO Guide 73 as the ‘document used for recording risk management process for identified risks’. The guide adds that the purpose of the risk register is to facilitate ownership and management of each risk. Different people have varying risk perceptions, this is common. There are several ways of accommodating differing opinions such as voting tools, a risk register in itself is not one.

Question 28

What is an advantage of conducting a top-down risk assessment? Limited awareness of internal operational risks or interdependencies of risks within the business. Senior managers and directors tend to be more focused on risks external to the organisation. The most significant strategic risks for the organisation can be captured quickly and there will be a manageable number.

Answer 28

C

Question 29

Which of the following are responsibilities of Risk Management Committees? To advise the Board on risk management. To make appropriate recommendations to the board on all significant matters relating to the risk strategy and policies of the company. Develop a risk-based internal audit programme. Establish the structure for risk management.

Answer 29

1,2 Point 3 is the responsibility of internal audit. Point 4 is the responsibility of the CEO.

Question 30

When integrating strategy and performance using the COSO framework, to which of the following elements is culture related? Performance. Information sharing. Understanding of risk.

Answer 30

C Within the governance and culture component, culture relates to ethical values, desired behaviours and understanding of risk The following are incorrect: Performance is its own component and considers risks that can impact achievement of strategy and business needs. ERM requires a continual process of obtaining and sharing information; this is within the component information, communication and reporting.

Question 31

Question: To ensure staff are complying with health and safety standards in the warehouse, which directive controls could be implemented? 1. Supply protective suits for staff to wear to provide extra warmth in the freezer units. 2. Issue requirements regarding the wearing of protective suits clothing. 3. Require staff working in the storage units to complete checklists and worksheets daily. 4. Health monitoring of warehouse staff.

Answer 31

2,3 Directive controls include documented procedures that staff are required to comply with, in this case wearing protective clothing and completing checklists and worksheet. In this context, supplying protective clothing is an example of a corrective control and health monitoring an example of a detective control.

Question 32

Question: What corrective action could the two managers consider to reduce the likelihood of more staff going off sick with asthmatic conditions? Reduce the length of time staff are exposed to cold conditions Increase training about the use of protective clothing Provide staff with a booklet on keeping warm

Answer 32

A A corrective action or control is one that reduces the inherent level of risk to one within appetite which is option A. The other options are examples of directive controls. The correct answer is: Reduce the length of time staff are exposed to cold conditions

Question 33

According to Hopkin, the most significant disadvantage associated with the ‘objectives-driven’ approach to risk management is: The difficulty of linking risks to changes in the organisational objectives The need to challenge the objectives to ensure they are completely developed The danger of considering risks out of the context that gave rise to them

Answer 33

C The danger of considering risks out of the context that gave rise to them" is indicated in the book as the most important disadvantage. Fully defined objectives and the consideration of changes in objectives are aspects of an adequate risk assessment.

Question 34

Venture Oil’s board of management has decided to invest in the Arctic project for the following reasons: 1. To pursue a business opportunity that their competitors are unwilling to undertake. 2. In light of their previous experience they believe they understand and can manage all the risks. 3. Risk management techniques will reduce the uncertainty or volatility of the outcome therefore costs can be predicted more accurately. 4. The return on investment exceeds their minimum return requirements. Question: Based on the Board’s reasons to invest in the Arctic project, which of the following would be valid in the context of upside risk?

Answer 34

1,3,4 Upside of risk can have many definitions; in simple terms it is achieved when the benefits obtained from taking risk are greater than any benefit that would have resulted from not taking it. Options 1, 3 and 4 means the benefit obtained from investing in the Artic project is greater than not investing. Option 2 does not fit upside of risk.

Question 35

Venture Oil’s board of management has decided to invest in the Arctic project for the following reasons: 1. To pursue a business opportunity that their competitors are unwilling to undertake. 2. In light of their previous experience they believe they understand and can manage all the risks. 3. Risk management techniques will reduce the uncertainty or volatility of the outcome therefore costs can be predicted more accurately. 4. The return on investment exceeds their minimum return requirements. What are the responsibilities of the Board? To establish the risk management strategy for protecting the oil rigs. Overall responsibility for risk management. Evaluating the accuracy of risk reporting on this project.

Answer 35

B One of the historical roles of an insurance risk manager is to establish the risk management strategy for protecting company property and people. This is not the responsibility of the Board. Option A is incorrect. It is the Board that has overall responsibility for risk management, regardless of size or sector. As an example, in charities this is the trustee Board. Option B is correct. The evaluation of risk reporting accuracy which can provide assurance on the management of risk on the project is the responsibility of the internal auditors and not the Board. Option C is incorrect.

Question 36

Specialist engineers have designed equipment to detect minor oil leaks in the early stages. This is an example of: Loss prevention. Damage limitation. Cost containment.

Answer 36

B Loss prevention is about reducing the likelihood of an adverse event occurring. Damage limitation is a measure for ensuring that only limited damage occurs. Cost contamination occurs when despite efforts to loss prevention and damage limitation there will still be a need to contain the cost of the event.

Question 37

Which of the following does Hopkin suggest is perhaps the most important feature of the risk management context for effective risk management? The level of resources involved in risk management activities How risk management is implemented. The establishment of risk criteria

Answer 37

B

Question 38

The implementation of strategic decisions is a high-risk activity because: It carries less uncertainty than the implementation of tactical or operational decisions It has a higher probability of failure More value can be destroyed by incorrect strategic decisions than by hazard, control or even compliance risks

Answer 38

More value can be destroyed by incorrect strategic decisions than by hazard, control or even compliance risks. This is because the strategic decisions are pervasive to all the organisation does and can impact many areas within the organisation. Is not necessarily true that the implementation of strategic decisions carries more uncertainty than the implementation of tactical or operational decisions or that it has a higher probability of failure per se.

Question 39

What does a good risk-aware culture result from? 1. Involving all key stakeholders in the risk management process. 2. Individual and collective values. 3. Attitudes and behaviours. 4. Varying perceptions of the importance of risk management.

Answer 39

1,2,3 Diverse perceptions of the importance of risk management is wrong, as a diverse perception of the importance of risk management does not lead to a risk-aware culture.

Question 40

Which of the following statements relating to risk appetite is false? Risk appetite is an operational constraint at board level Risk appetite regulates behaviour at the individual level Risk appetite is often driven by strategy

Answer 40

A Risk appetite is an operational constraint at line manager level. The board of directors do not typically get involved in the day-to-day operations of an organisation.

Question 41

The UK Corporate Governance Code contains which of the following: 1. Key risks. 2. Broad principles. 3. Mandatory rules. 4. Specific provisions.

Answer 41

2,4 The UK Corporate Governance Code contains broad principles and more specific provisions. It does not contain key risks or mandatory rules – it is principles based and listed companies can choose to comply or explain why they have chosen not to.

Question 42

What core responsibilities fall within the Internal Audit function’s remit to add value as part of an organisation’s management of risk? 1. Identifying the risks facing the business. 2. Evaluating controls and reporting upon their effectiveness. 3. Providing assurance to the board of directors and senior management. 4. Taking decisions on risk response.

Answer 42

2,3 See Hopkin Chapter 35 and figure 35.1 regarding the role of Internal Audit in Enterprise Risk Management. Option 4 on taking action on risk response ownership does not reside with Internal Audit and should be disregarded. Option 1 ownership resides with the 1st line (of defence) and as such has the accountability. It could be argued that Internal Audit could have a role, but it is not within its core responsibilities

Question 43

An effective internal control system should encompass which of the following? 1. Policies. 2. Behaviours. 3. Tasks. 4. Processes.

Answer 43

1,2,3,4 According to the course, “An internal control system encompasses the policies, processes, tasks, behaviours and other aspects of a company...”

Question 44

Which of the following defines internal control according to COSO? All the elements of an organisation that, taken together, support people in the achievement of the organisation’s objectives. A process, effected by an entity’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives. A set of processes, functions, activities, sub-systems, and people who are grouped together or consciously segregated to ensure the effective achievement of objectives and goals

Answer 44

B See Hopkin Chapter 32 The control environment page 388. As per COSO, Internal Control is a process effected by an entity’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: ● effectiveness and efficiency of operations ● reliability of financial reporting ● compliance with applicable laws and regulations CoCo (Criteria of Control) states, Internal control is all the elements of an organisation that, taken together, support people in the achievement of the organisation’s objectives. The elements include resources, systems, processes, culture, structure and tasks. As per IIA (Institute of Internal Auditors) Internal control is a set of processes, functions, activities, sub-systems, and people who are grouped together or consciously segregated to ensure the effective achievement of objectives and goals.