Highlights: Risk Management Governance

1. Which of the following BEST reflects a strong 'tone at the top' in risk management?

• A · The board reviews risk information only when losses occur
• B · Executive leadership consistently models risk-aware behaviors and holds people accountable for risk outcomes
• C · Risk policies exist but are rarely referenced
• D · Only the risk officer discusses risk publicly

Tone at the top is demonstrated by consistent leadership behaviors and accountability — not merely the existence of policies.

2. COSO ERM (2017) integrates risk management with:

• A · External audit fee negotiations
• B · Strategy setting and performance
• C · Tax return preparation
• D · Vendor onboarding only

COSO ERM 2017 (Enterprise Risk Management—Integrating with Strategy and Performance) explicitly links risk management to strategy setting and performance management.

3. Under the Three Lines Model, the internal audit function serves as the:

• A · First line owning and managing risk
• B · Second line overseeing risk management
• C · Third line providing independent, objective assurance
• D · Fourth line replacing external auditors

Internal audit constitutes the third line under the IIA's Three Lines Model, providing independent assurance to governing bodies.

4. Which of the following BEST distinguishes risk appetite from risk tolerance?

• A · They are identical concepts
• B · Risk appetite is the broad amount of risk an organization is willing to accept; risk tolerance is the acceptable variation around specific objectives
• C · Risk appetite applies only to insurers; risk tolerance to banks
• D · Risk appetite is set by regulators; risk tolerance by internal audit

Risk appetite is broad, strategic acceptance of risk; risk tolerance is the more granular acceptable variation from performance targets tied to specific objectives.

5. An organization's ability to identify and respond to emerging risks is BEST assessed by evaluating:

• A · The historical loss database only
• B · Horizon scanning practices, early warning indicators, and governance escalation paths
• C · Only the number of risk policies in place
• D · The size of the risk register

Emerging risk readiness relies on active horizon scanning, key risk indicators, and effective escalation — not the mere existence of documentation.

6. Integrated risk reporting to key stakeholders should PRIMARILY:

• A · Cover only financial risks quantifiable in the general ledger
• B · Connect risk exposure, risk responses, performance, and culture in a decision-useful way
• C · Focus on historical incidents only
• D · Be limited to a monthly compliance checklist

Effective integrated reporting links risks to responses, performance implications, and culture — enabling risk-informed decisions.

7. Which of the following BEST demonstrates management's commitment to risk management?

• A · Risk objectives are embedded in performance goals and resource allocation decisions
• B · The organization has a printed risk policy in every office
• C · Risk is discussed only during the annual audit
• D · External auditors set the organization's risk priorities

Embedding risk considerations into performance objectives and resource allocation is the strongest evidence of genuine commitment.

8. Which of the following is an example of a transaction-level control?

• A · Human resource policies.
• B · Tone at the top.
• C · Reconciliations of primary accounts.
• D · Inventory counts.

Transaction-level controls operate at the process level to ensure individual transactions are properly executed, recorded, and safeguarded. Reconciliations of primary accounts (Option C) directly verify transaction accuracy by comparing recorded balances to supporting documentation, making them a classic transaction-level control. Human resource policies (Option A) and tone at the top (Option B) are entity-level controls that influence the overall control environment but don't address specific transactions. Inventory counts (Option D), while operational, are periodic physical verifications rather than ongoing transaction-level controls that validate individual transactions during processing. According to COSO's Internal Control Framework, transaction-level controls are designed to prevent or detect errors in routine business activities.

9. Which of the following is the most effective strategy to manage the risk of foreign exchange losses due to sales to foreign customers?

• A · Hire a risk consultant.
• B · Implement a hedging strategy.
• C · Maintain a large foreign currency balance.
• D · Insist that customers only pay in a stable currency.

Implementing a hedging strategy (Option B) is the most effective approach because it directly mitigates foreign exchange risk through financial instruments like forward contracts, options, or swaps that lock in exchange rates or limit potential losses. This is a proactive risk treatment aligned with COSO ERM principles of managing risks to acceptable levels. Option A (hiring a consultant) merely provides advice without directly addressing the risk. Option C (maintaining large foreign currency balances) actually increases exposure to currency fluctuations rather than reducing it. Option D (insisting on stable currency payment) may be impractical as it could reduce competitiveness and is difficult to enforce with customers who prefer their local currency, potentially limiting sales opportunities.

10. An organization invests its savings in a volatile stock with the potential for high gains rather than a mutual fund with a lower expected return and lower volatility. This best describes which of the following risk concepts?

• A · Risk identification.
• B · Risk appetite.
• C · Risk capacity.
• D · Risk tolerance.

Risk tolerance refers to the acceptable level of variation an organization is willing to accept in pursuit of its objectives. By choosing a volatile stock over a more stable mutual fund, the organization demonstrates its willingness to accept higher volatility (deviation from expected returns) in exchange for potentially greater gains. This decision reflects the specific degree of risk variation it finds acceptable. Risk appetite (B) represents the broad amount of risk an organization is willing to accept, but doesn't specifically address the volatility acceptance demonstrated here. Risk capacity (C) is the maximum risk an organization can bear based on its financial resources, not what it chooses to accept. Risk identification (A) is simply the process of recognizing potential risks, not making decisions about acceptable risk levels.