1. A risk has an 8% annual probability of a Tk 45 million loss. An insurance policy costs Tk 3.2 million a year and covers 90% of any loss. Comparing expected annual cost, insuring:

A) increases expected annual cost by Tk 0.04 million
B) reduces expected annual cost by Tk 0.40 million
C) reduces expected annual cost by Tk 0.36 million
D) reduces expected annual cost by Tk 0.04 million

Correct: D complex Risk assessment: insurance

Uninsured expected cost = 8% x 45 = Tk 3.6 million. Insured = premium 3.2 + retained 10% of 3.6 = 0.36, total Tk 3.56 million. Saving = Tk 0.04 million. If you chose 0.40 you compared the premium with the expected loss but forgot the retained 10%. If you chose 0.36 you gave only the retained expected loss. If you chose an increase you reversed the comparison.

2. The board states that it will not accept a fall of more than 5% in annual profit from any single operational incident. This statement is best described as the company's:

A) risk capacity
B) risk culture
C) risk appetite
D) risk tolerance

Correct: D difficult Risk appetite and tolerance

Risk tolerance is a specific, measurable limit on acceptable variation. Risk appetite is the broader amount and type of risk the company is willing to take. Risk capacity is the maximum it could bear. Risk culture is the shared attitude to risk. If you chose appetite you chose the general concept; if you chose capacity you ignored that the limit is set by choice.

3. Which TWO are financial risks? (Select TWO.)

Multiple response
A) A fall in the taka value of dollar export receipts
B) A fire at the main supplier's factory
C) A customer's bank failing to settle a letter of credit
D) A key director leaving to join a competitor
E) A new factory-safety regulation

Correct: A, C difficult Types of risk

Exchange-rate exposure is market (financial) risk and non-settlement of a letter of credit is credit risk. The supplier fire is operational, the director's exit is people risk and the regulation is compliance/regulatory risk. If you chose B, D or E you selected non-financial risks.

4. Consider risk management and control. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A risk register records likelihood, impact and owner for each risk.   Yes

2. Residual risk is the risk before any controls are applied.   No

3. Segregation of duties is a preventive control.   Yes

4. Inherent risk exists before management action.   Yes

Correct: Y, N, Y, Y difficult Internal control

(1) Yes. (2) No: residual risk is what remains after controls. (3) Yes: it prevents one person controlling a transaction from start to finish. (4) Yes: inherent risk is the risk before management response.

5. Consider the three lines model. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Operational management forms the first line.   Yes

2. Internal audit provides independent assurance as the third line.   Yes

3. The risk management function is part of the third line.   No

Correct: Y, Y, N difficult Three lines model

(1) Yes. (2) Yes. (3) No: risk management and compliance form the second line, which advises and monitors.

6. A project has three possible annual profits: Tk 100 million with probability 0.2, Tk 60 million with probability 0.5 and Tk 20 million with probability 0.3. What is the expected value of annual profit?

A) Tk 60 million
B) Tk 64 million
C) Tk 56 million
D) Tk 48 million

Correct: C complex Expected values

EV = (0.2 x 100) + (0.5 x 60) + (0.3 x 20) = 20 + 30 + 6 = Tk 56 million. If you chose 64 you attached the probabilities in reverse order to the outcomes. If you chose 60 you picked the most likely outcome or the unweighted average. If you chose 48 you matched the probabilities to the wrong outcomes.

7. Project X has a mean return of Tk 80 million and a standard deviation of Tk 12 million. Project Y has a mean return of Tk 50 million and a standard deviation of Tk 10 million. Which project carries more risk relative to its return?

A) Project X, because its standard deviation of 12 is larger than Y's 10, which shows greater relative risk
B) Project X, because its higher mean return of 80 means more money is exposed to the same volatility
C) Project Y, because its coefficient of variation of 0.20 exceeds X's 0.15 even though its standard deviation is lower
D) Neither, because the coefficient of variation can only compare projects with the same mean return

Correct: C complex Coefficient of variation

CV = standard deviation / mean: X = 12 / 80 = 0.15 and Y = 10 / 50 = 0.20. Y has more risk per unit of return. Standard deviation alone compares absolute dispersion and ignores the scale of the mean. The CV exists precisely to compare projects with different means.

8. Which THREE are typically provided for in a business continuity plan? (Select THREE.)

Multiple response
A) Standby procedures so that some operations can continue while normal services are disrupted
B) The dividend policy for the year after recovery
C) Recovery procedures once the cause of the breakdown has been corrected
D) Personnel management policies to make sure the plan is carried out properly
E) The transfer pricing policy between group companies
F) A share buyback timetable

Correct: A, C, D difficult Business continuity plans

A BCP covers standby procedures, recovery procedures and personnel policies, from first response through to full recovery. Dividend, transfer pricing and buyback policies are financing or tax matters, not continuity matters.

9. Consider the measurement of business resilience. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Compliance measures how well the organisation complies with its standards and policies.   Yes

2. Completeness measures the range of issues the organisation is prepared for.   Yes

3. Capability relies on evidence collected through exercises and reviews.   Yes

4. Value is purely a qualitative measure and cannot be quantified.   No

Correct: Y, Y, Y, N difficult Measuring business resilience

(1) Yes. (2) Yes. (3) Yes. (4) No: value includes qualitative and quantitative measures of how well specific outcomes can be met.

10. Consider measures of spread and the shape of distributions. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. The range can be distorted by outliers.   Yes

2. In a left-skewed distribution the mean is typically greater than the median.   No

3. The normal distribution is symmetrical, with half the values above the mean and half below it.   Yes

4. A right-skewed distribution has a long left-hand tail.   No

5. In a right-skewed distribution the mean is typically greater than the median.   Yes

Correct: Y, N, Y, N, Y difficult Skewness and the normal distribution

(1) Yes: the range uses only the two extreme values. (2) No: in a left-skewed distribution the mean is typically lower than the median. (3) Yes. (4) No: a right-skewed distribution has a long right-hand tail. (5) Yes.

11. A Chattogram warehouse owner estimates a 4% chance of a fire each year, with a loss of Tk 50 million if it happens. An insurer offers cover for a premium of Tk 2.5 million. Considering only expected value, which statement is correct?

A) The expected annual loss is Tk 0.4 million, so the owner should refuse any insurance
B) The expected annual loss is Tk 2.5 million, so the premium is exactly fair and the owner should insure
C) The expected annual loss is Tk 50 million, so the owner must insure at any premium
D) The expected annual loss is Tk 2.0 million, so the premium exceeds it, but the owner may still insure to avoid a catastrophic loss

Correct: D complex Risk response: insurance

Expected loss = 4% x 50 = Tk 2.0 million. The premium of 2.5 is higher than the expected loss, but insurance transfers an unlikely catastrophic loss, which a risk-averse owner may accept.

12. A company identifies a risk of key customer default, estimates that it could cost Tk 30 million with a 10% probability and decides to insure the receivable with a credit insurer. Which stage of the risk management process has been completed with the insurance decision?

A) Risk response (treatment) using risk transfer
B) Risk monitoring using risk acceptance
C) Risk assessment using risk retention
D) Risk identification using risk avoidance

Correct: A complex Risk management process

Insurance transfers the risk to another party, which is a response choice after identifying and assessing the risk.

13. Which description is correct for pure (downside) risk compared with speculative risk?

A) Pure risk offers only the possibility of gain, whereas speculative risk offers only loss
B) Pure risk arises only from investing, whereas speculative risk arises only from fire and theft
C) Pure risk offers only the possibility of loss or no loss, whereas speculative risk offers the possibility of gain or loss
D) Pure risk can never be insured, whereas speculative risk is routinely insured

Correct: C difficult Downside and upside risk

Fire and theft are pure risks (loss or no loss), usually insurable. Business investments are speculative risks with potential gain or loss.

14. A project has expected profit of Tk 40 million and a standard deviation of Tk 10 million. Assuming profits are normally distributed, roughly what is the probability that profit falls below Tk 20 million?

A) About 0.15%
B) About 2.5%
C) About 16%
D) About 5%

Correct: B complex Mean and standard deviation

Tk 20 million is two standard deviations below the mean. About 95% of outcomes fall within two standard deviations, leaving 5% in both tails, so about 2.5% lies below.

15. A food company discovers contamination in a batch already sold. Which first priority best reflects sound crisis management?

A) Protect public safety by recalling the product and communicating clearly
B) Cut the price on remaining stock to clear it quickly
C) Delay any announcement until the legal team has finished investigating
D) Deny the problem publicly until the cause is known

Correct: A difficult Crisis management

Crisis management begins with protecting people and communicating openly. Delay, denial or discounting increases harm and reputational damage.

16. Project A has expected return Tk 200 million and standard deviation Tk 30 million. Project B has expected return Tk 120 million and standard deviation Tk 24 million. Which has less risk per unit of return?

A) Project A, with a coefficient of variation of 0.15 against 0.20
B) Project B, because its standard deviation is smaller
C) Project A, with a coefficient of variation of 0.20 against 0.15
D) The two are equal because both have positive means

Correct: A complex Coefficient of variation

CV = SD / mean: A = 30 / 200 = 0.15; B = 24 / 120 = 0.20. A has lower relative risk.

17. Which THREE are ways of responding to risk? (Select THREE.)

Multiple response
A) Ignoring all identified risks
B) Increasing exposure without analysis
C) Reduction (mitigation)
D) Transfer
E) Avoidance
F) Pretending the risk is smaller

Correct: C, D, E difficult Risk responses

Standard responses are avoidance, transfer, reduction and acceptance. Ignoring or misreporting risk is not a response strategy.

18. Which THREE are processes or functions in the protective axis of business resilience? (Select THREE.)

Multiple response
A) Risk management
B) Leadership involvement
C) Business continuity planning
D) Level of customer trust
E) IT disaster recovery
F) Employee morale

Correct: A, C, E difficult Business resilience

The protective axis covers processes such as risk management, continuity planning and disaster recovery. Morale, trust and leadership are cross-cutting characteristics.

19. Which TWO statements about standard deviation are correct? (Select TWO.)

Multiple response
A) It tells us the most likely outcome
B) A lower value always means a higher mean
C) It cannot be calculated for expected profits
D) A higher standard deviation indicates more dispersion
E) It is measured in the same units as the data

Correct: D, E difficult Measuring risk

Standard deviation measures spread, in the same units as the data. It is not the mode and is independent of the mean.

20. Consider the normal distribution. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. About 68% of values lie within one standard deviation of the mean.   Yes

2. It is skewed to the right.   No

3. It is symmetrical about the mean.   Yes

4. In a normal distribution the mean, median and mode are always different.   No

Correct: Y, N, Y, N difficult Normal distribution

(1) Yes. (2) No: the normal distribution is symmetrical. (3) Yes. (4) No: they coincide in a normal distribution.

21. Consider the risk management process. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Risk assessment considers likelihood and impact.   Yes

2. Risk management ends once a policy is written.   No

3. Once risks are assessed, monitoring is needed only if a loss occurs.   No

4. Risk appetite is the amount of risk an organisation is willing to accept.   Yes

Correct: Y, N, N, Y difficult Risk management process

(1) Yes. (2) No: monitoring and review are continuous. (3) No: risks should be monitored and reviewed regularly. (4) Yes.

22. Consider business risks. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Reputation risk cannot arise from social media.   No

2. Financial risk is limited to the risk that customers fail to pay.   No

3. Operational risk arises from failures in processes, people or systems.   Yes

4. Regulatory risk is the risk of changes in law harming a business.   Yes

Correct: N, N, Y, Y difficult Types of business risk

(1) No: social media can quickly damage reputation. (2) No: financial risk also includes interest rate and currency exposure. (3) Yes. (4) Yes.

23. Consider crisis management and continuity planning. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Business continuity planning aims to keep critical operations running.   Yes

2. Disaster recovery focuses on restoring customer goodwill after a public-relations incident.   No

3. A business continuity plan needs no testing.   No

4. A crisis management plan names who takes control during a crisis.   Yes

Correct: Y, N, N, Y difficult Crisis and continuity

(1) Yes. (2) No: disaster recovery focuses on restoring systems and data. (3) No: plans should be tested and updated. (4) Yes.

24. Consider skewed distributions. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. In a negatively skewed distribution the mean is greater than the median.   No

2. A symmetrical distribution has skewness.   No

3. Skewness can distort the interpretation of the mean.   Yes

4. In a positively skewed distribution the mean is greater than the median.   Yes

Correct: N, N, Y, Y difficult Skewness

(1) No: in a negatively skewed distribution the mean is lower than the median. (2) No: symmetrical distributions have no skew. (3) Yes. (4) Yes.

25. Consider attitudes to risk. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A risk-averse investor demands higher return for higher risk.   Yes

2. A risk-neutral investor chooses on expected value.   Yes

3. A risk-seeking investor requires a higher expected return than a risk-averse investor for the same risk.   No

4. Risk appetite is identical for all organisations.   No

Correct: Y, Y, N, N difficult Risk attitudes

(1) Yes. (2) Yes. (3) No: a risk-seeker may accept less. (4) No: appetite varies by organisation.