Risk Management MCQ – CIA Part 1

  

Risk Management MCQ – CIA Part 1

Risk Management MCQ  – CIA Part 1

SECTION A: DIRECT KNOWLEDGE QUESTIONS

### *MCQ 1: Risk Appetite / Tolerance + Residual Risk (Most Tested Concept)*

*CASE:* 

ABC Ltd is a manufacturing company. The Board has set Risk Appetite for operational loss as $5 Million per year. Management has set Risk Tolerance at $4 Million.

The company has a key supplier in a politically unstable country. The risk assessment is done:

- Inherent Risk = $8 Million loss if supplier fails (High Likelihood)

- Company implemented a control: Dual sourcing – Secondary supplier ready – Cost $500,000

- After control, Residual Risk = $3 Million

The Internal Auditor reviews this. The secondary supplier audit reveals the secondary supplier has no capacity to supply in next 3 months due to financial issues.

*Question: What should Internal Auditor conclude and report?*

A) Residual risk is $3 Million which is within both appetite ($5M) and tolerance ($4M), so risk is effectively managed, no reporting needed.

B) Inherent risk of $8M exceeds appetite, so management should terminate the supplier relationship immediately.

C) The control is ineffective, actual residual risk is still close to inherent risk of $8M, which exceeds both risk appetite and tolerance, so this is a material risk exposure that must be reported to Board/Audit Committee.

D) Risk tolerance should be increased to $8M to accommodate inherent risk.

*CORRECT ANSWER:

---

### *MCQ 2: Risk Response + Three Lines Model (Case on GITC + Risk Management)*

*CASE:*

You are the Chief Audit Executive (CAE) of a bank. The bank launched a new mobile payment app quickly to compete in market without conducting a formal Risk Assessment (RCSA). The IT Department (1st Line) developed and launched the app.

After 2 months, customers report fraud due to weak authentication. Loss is $2M.

The Chief Risk Officer (CRO) – 2nd Line says: "We were not involved in app launch, IT did not consult us. Also Internal Audit (3rd Line) did not audit the app before launch, so IA is also responsible."

The CIO says: "Internal Audit should take ownership of Risk Management for all new products to prevent such failures in future."

*Question: As CAE, what is the MOST appropriate response as per IIA Standards and Three Lines Model?*

A) Accept responsibility as 3rd Line should have audited before launch, and agree to take ownership of Risk Management for new products to ensure independence.

B) Agree with CRO – 1st Line (IT) is responsible for managing risk, 2nd Line should have been consulted, 3rd Line provides independent assurance AFTER launch, not before. IA should not own risk management as it impairs independence. Recommend strengthening Risk Management process: mandatory RCSA and 2nd Line review for all new products before launch.

C) Recommend that all risk management responsibility should be transferred to Internal Audit as 3rd Line is most competent to manage risk.

D) Conclude that since fraud occurred, the only correct risk response is Terminate/Avoid – Shut down the mobile app permanently.

*CORRECT ANSWER: 

*LEARNING POINT FOR EXAM:*

- 1st Line = Owns Risk, 2nd Line = Oversight/Challenge, 3rd Line = Assurance – Never own.

- IA role in Risk Management = Assess effectiveness, NOT own or manage.

- If question says "Management wants IA to own ERM" – Answer is ALWAYS – Refuse, impairs independence, recommend safeguards.

Q3. Who owns the risk in an organization?

A) Board of Directors

B) Internal Audit

C) Management

D) External Auditors

Answer: .

---

Q4. What is the role of the Board in risk management?

A) Day-to-day risk management

B) Designing and operating controls

C) Providing oversight and determining if the RM process is adequate and effective

D) Independent assurance

Answer: 

---

Q5. Internal Audit's role in risk management is to:

A) Design and implement the RM framework

B) Own and manage risk

C) Provide independent assurance on the effectiveness of RM processes

D) Approve the risk appetite

---

Q6. Risk Appetite is best defined as:

A) The maximum risk the organization can absorb

B) The acceptable variation around a specific objective

C) The broad amount of risk the organization is willing to accept in pursuit of value

D) Risk remaining after controls are applied

---

Q7. Risk Tolerance is:

A) The broad willingness to accept risk

B) The narrower acceptable variation around a specific objective

C) The absolute maximum risk the organization can assume

D) The same as risk appetite

---

Q8. Risk Capacity refers to:

A) The organization's ability to design controls

B) The maximum amount of risk the organization can assume (the "outer limit")

C) The acceptable variation around objectives

D) The risk appetite minus tolerance

Q9. Inherent Risk is:

A) Risk remaining after controls

B) Risk before any management actions or controls

C) The same as residual risk

D) Risk that cannot be managed

Q10. Residual Risk is:

A) Risk before controls

B) The maximum risk the organization can absorb

C) Risk remaining after controls and responses have been applied

D) The board's preferred risk level

Q11. How many interrelated components does COSO ERM (2017) have?

A) 3

B) 5

C) 8

D) 17

Q12. Which COSO ERM component addresses "tone at the top"?

A) Strategy & Objective Setting

B) Performance

C) Governance & Culture

D) Review & Revision

Q13. Risk appetite is established under which COSO ERM component?

A) Governance & Culture

B) Strategy & Objective Setting

C) Performance

D) Information, Communication & Reporting

Q14. Risk identification and assessment falls under which COSO ERM component?

A) Governance & Culture

B) Strategy & Objective Setting

C) Performance

D) Review & Revision

Q15. Monitoring changes in the risk landscape falls under which COSO ERM component?

A) Performance

B) Review & Revision

C) Information, Communication & Reporting

D) Governance & Culture

Q16. "Right information to right people" is the focus of which COSO ERM component?

A) Performance

B) Review & Revision

C) Information, Communication & Reporting

D) Governance & Culture

Q17. The IIA Three Lines Model (2020) replaced:

A) COSO ERM (2004)

B) The Three Lines of Defense model

C) The COSO Internal Control Framework

D) The Risk Management Framework

Q18. Which line owns and manages risk directly?

A) First Line

B) Second Line

C) Third Line

D) Board

Q19. Which line provides expertise and monitors risks?

A) First Line

B) Second Line

C) Third Line

D) External Audit

Q20. Which line provides independent assurance to the governing body?

A) First Line

B) Second Line

C) Third Line

D) Management

Q21. How many risk response methods are identified in the notes?

A) 3

B) 4

C) 5

D) 6

Q22. Which risk response involves eliminating the activity?

A) Accept

B) Avoid

C) Reduce

D) Share

Q23. Which risk response involves taking on more risk for performance?

A) Accept

B) Avoid

C) Pursue/Exploit

D) Reduce

Q24. Insurance and hedging are examples of which risk response?

A) Avoid

B) Reduce/Mitigate

C) Share/Transfer

D) Accept

Q25. M&A risk is classified as which type of risk?

A) Operational

B) Financial

C) Strategic

D) Compliance

Q26. IT failure risk is classified as which type of risk?

A) Strategic

B) Operational

C) Financial

D) Reputational

Q27. Liquidity risk is classified as which type of risk?

A) Strategic

B) Operational

C) Financial

D) Compliance

Q28. A preventive control:

A) Finds loss after it occurs

B) Stops loss before it happens

C) Fixes issues after detection

D) Transfers risk to a third party

Q29. A detective control:

A) Stops loss before it happens

B) Finds loss after it occurs

C) Fixes issues after detection

D) Eliminates risk entirely

Q30. A corrective control:

A) Stops loss before it happens

B) Finds loss after it occurs

C) Fixes issues after detection

D) Prevents fraud

SECTION B: NEGATIVE-TYPE QUESTIONS

---

Q31. Which of the following is NOT a role of Internal Audit in risk management?

A) Providing independent assurance

B) Evaluating the effectiveness of RM processes

C) Designing and implementing the RM system

D) Reporting on RM effectiveness to the Board

Q32. Which of the following is NOT a component of COSO ERM (2017)?

A) Governance & Culture

B) Performance

C) Risk Transfer & Insurance

D) Review & Revision

Q33. Which of the following is NOT a risk response method?

A) Avoid

B) Accept

C) Ignore

D) Share/Transfer

Q34. Which of the following is NOT a type of risk mentioned in the notes?

A) Strategic

B) Operational

C) Technical

D) Reputational

Q35. Which statement about the Board is INCORRECT?

A) The Board provides oversight

B) The Board sets the tone

C) The Board owns and manages day-to-day risk

D) The Board determines if the RM process is adequate and effective

Q36. Which statement about Risk Tolerance is INCORRECT?

A) It is narrower than risk appetite

B) It relates to a specific objective

C) It represents the maximum risk the organization can assume

D) It defines acceptable variation

Q37. Which is NOT a characteristic of the Three Lines Model (2020)?

A) Uses principles rather than rigid structures

B) First Line owns and manages risk

C) Third Line designs controls to ensure effectiveness

D) Second Line provides expertise and monitoring

Q38. Which of the following is NOT an example of a preventive control?

A) Passwords on systems

B) Segregation of duties

C) Monthly bank reconciliations

D) Physical access restrictions

Q39. Which statement about Inherent Risk is INCORRECT?

A) It exists before management actions

B) It exists before controls are applied

C) It is the same as residual risk

D) It represents raw risk exposure

Q40. Which is NOT a valid reason for Internal Audit to decline designing an ERM system?

A) It impairs objectivity

B) It creates a self-review threat

C) It is a management responsibility

D) It would reduce IA's budget

SECTION C: TRICKY LOGICAL REASONING QUESTIONS

--

Q41. A CRO identifies risks, designs controls, and monitors them. Internal Audit is asked to verify the CRO's work. What is the PRIMARY concern?

A) The CRO lacks technical expertise

B) The CRO's self-review threat weakens independence and the control environment

C) The CRO is not part of the Three Lines Model

D) The CRO should report to the Board instead

---

Q42. A bank's policy states: "We accept moderate credit risk." A loan portfolio allows 5% default variance. Capital can absorb $500M in losses. A portfolio shows 6% default. What is the MOST appropriate interpretation?

A) The bank has exceeded its risk capacity

B) The bank has exceeded its risk appetite but is within tolerance

C) The bank has exceeded its risk tolerance but may still be within capacity

D) The bank has exceeded both tolerance and capacity

Q43. A manufacturing plant has a fire risk rated High (inherent). After installing sprinklers and fire alarms, the risk is rated Low (residual). The CEO says, "Since residual risk is low, we don't need to worry." Is the CEO correct?

A) Yes, because residual risk is low

B) No, because residual risk must always be zero

C) Partially — residual risk being low means controls are working, but IA must assess alignment with appetite and monitoring is still needed

D) Yes, because the controls have eliminated the risk

Q44. A company faces a risk from a competitor launching a superior product. Management decides to do nothing. Is this valid?

A) No, management must always respond to competitive threats

B) Yes, if it's within risk appetite — "Accept" is a legitimate response

C) No, this is a strategic risk that must be avoided

D) Yes, but only if the Board approves it

Q45. A company buys insurance for a factory in a flood zone. What risk response is this, and what limitation exists?

A) Avoid; no limitation

B) Share/Transfer; insurance transfers financial impact but not all risk (reputation, business interruption may remain)

C) Reduce; insurance eliminates all risk

D) Accept; insurance is not a risk response

Q46. A retail chain's ERM process includes: (a) Board approves risk appetite, (b) Management identifies risks quarterly, (c) Results are reported to the Audit Committee, (d) No process exists to monitor changing regulations. Which COSO component is MISSING?

A) Governance & Culture

B) Performance

C) Review & Revision

D) Information, Communication & Reporting

Q47. The CFO asks Internal Audit to design and implement a new ERM system. The CFO argues IA "knows risk best." What should IA do?

A) Accept, since IA has the expertise

B) Decline, because designing/implementing RM systems impairs objectivity and is a management responsibility

C) Accept, but only if the Board approves

D) Accept, but disclose it in the audit report

Q48. If Internal Audit already designed an ERM system, can it still audit it?

A) No, never

B) Yes, without any disclosure

C) Yes, but must disclose the impairment and ensure independent oversight (e.g., external reviewer) for that engagement

D) Yes, because IA is always independent

Q49. A hospital uses brainstorming, SWOT analysis, and process mapping to identify risks. It does NOT use scenario analysis or interviews with frontline staff. What risks might be missed?

A) Only financial risks

B) Low-probability, high-impact events and operational/frontline risks

C) Only compliance risks

D) No risks would be missed

Q50. A detective control finds fraud after a $1M loss. What is the PRIMARY weakness?

A) Detective controls are useless

B) Detective controls don't prevent loss — they only identify it; preventive controls should be considered to reduce impact

C) The control was not designed properly

D) Fraud cannot be prevented

Q51. A portfolio shows 6% default when tolerance is 5%. IA should report this as:

A) An acceptable variation

B) A deviation requiring management to reduce/mitigate risk to return within tolerance

C) A risk capacity breach

D) A strategic risk

Q52. Management proposes a new product with potential $600M loss when risk capacity is $500M. What should IA do?

A) Approve the product

B) Flag that it exceeds risk capacity; the Board must either reject it or increase capital before proceeding

C) Ignore it since it's a management decision

D) Recommend insurance

Q53. A sprinkler system fails inspection. What happens to the risk level?

A) It remains low

B) It becomes zero

C) Residual risk rises back toward inherent until the control is restored

D) It becomes a strategic risk

Q54. Which risk does IA evaluate when concluding on adequacy?

A) Inherent risk

B) Residual risk

C) Risk capacity

D) Risk appetite

Q55. Without an objective, "risk" is:

A) Still meaningful

B) Meaningless — risk is always the effect of uncertainty on objectives

C) The same as inherent risk

D) The same as residual risk

Q56. A unit that designs and monitors its own controls is:

A) Independent

B) Not independent; IA cannot rely blindly on its testing without evaluating objectivity

C) Following best practices

D) Exempt from IA review

Q57. Can Internal Audit rely on the CRO's monitoring?

A) Yes, always

B) No, never

C) Only after evaluating the CRO's competence and objectivity

D) Only if the Board approves

Q58. Who ultimately determines if the RM process is effective?

A) The CRO

B) Internal Audit

C) The Board provides oversight and determines adequacy/effectiveness; IA provides independent assurance to support that judgment

D) External auditors

Q59. Match each risk to the best response: (1) Factory in flood zone, (2) Currency fluctuation, (3) New regulation, (4) Competitor launching superior product.

A) 1-Avoid/Reduce, 2-Share/Transfer, 3-Reduce/Mitigate, 4-Accept or Pursue

B) 1-Accept, 2-Avoid, 3-Share, 4-Reduce

C) 1-Share, 2-Reduce, 3-Accept, 4-Avoid

D) 1-Reduce, 2-Accept, 3-Avoid, 4-Share

Q60. Which technique best addresses emerging risks?

A) Brainstorming

B) SWOT analysis

C) Scenario analysis and environmental scanning

D) Process mapping

SECTION D: EXAM TRIGGER QUICK QUESTIONS

Q61. If the question says "Who owns risk?" the answer is likely:

A) Internal Audit

B) Management (First Line)

C) Board

D) External Auditors

Q62. If the question says "Who provides assurance?" the answer is likely:

A) Management

B) Internal Audit (Third Line)

C) Risk Committee

D) CEO

Q63. If the question says "Risk after controls?" the answer is likely:

A) Inherent risk

B) Residual risk

C) Risk capacity

D) Risk appetite

Q64. If the question says "Maximum risk absorbable?" the answer is likely:

A) Risk appetite

B) Risk tolerance

C) Risk capacity

D) Residual risk

Q65. If the question says "Acceptable variation?" the answer is likely:

A) Risk appetite

B) Risk tolerance

C) Risk capacity

D) Inherent risk

Q66. If the question says "Broad risk willingness?" the answer is likely:

A) Risk tolerance

B) Risk capacity

C) Risk appetite

D) Residual risk

Q67. If the question says "IA asked to design controls?" the answer is likely:

A) Accept the engagement

B) Decline — impairs objectivity

C) Accept with Board approval

D) Accept but disclose

Q68. If the question says "Risk within appetite but not reduced?" the answer is likely:

A) Avoid

B) Accept (valid response)

C) Reduce

D) Share

Q69. If the question says "Missing monitoring of changes?" the answer is likely:

A) Governance & Culture gap

B) Performance gap

C) Review & Revision (COSO gap)

D) Information & Communication gap

Q70. On the CIA exam, which three lenses solve 80% of scenario questions?

A) Cost, benefit, risk

B) Who owns this? Is IA's independence preserved? Is the risk within appetite/tolerance/capacity?

C) Plan, do, check

D) Identify, assess, respond

SUMMARY TABLE: KEY DISTINCTIONS

Concept Definition Key Point

Risk Appetite Broad amount of risk willing to accept "Preferred level"

Risk Tolerance Narrower acceptable variation Around a specific objective

Risk Capacity Maximum risk absorbable "Outer limit"

Inherent Risk Before controls Raw exposure

Residual Risk After controls IA focuses here

First Line Operational Management Owns and manages risk

Second Line Risk & Compliance Expertise and monitoring

Third Line Internal Audit Independent assurance

Avoid Eliminate activity Response method

Accept Within appetite Valid response

Pursue/Exploit Take on more risk For performance

Reduce/Mitigate Bring within tolerance Response method

Share/Transfer Insurance, hedging Transfers financial impact