26. A project has three outcomes: profit of Tk 900,000 with probability 0.25, Tk 400,000 with probability 0.45, and a loss of Tk 300,000 with probability 0.30. What is the expected value, and how should it be interpreted?

A) Tk 400,000, which is the middle outcome and is the only result that can actually occur if the project is undertaken
B) Tk 333,333, which is the most likely single outcome and guarantees a profit if the project is undertaken once
C) Tk 1,000,000, which is the sum of all possible outcomes and represents the maximum profit that can arise
D) Tk 315,000, which is the long-run average outcome and does not show the dispersion of possible results

Correct: D complex Expected value

EV = 900,000×0.25 + 400,000×0.45 − 300,000×0.30 = 225,000 + 180,000 − 90,000 = 315,000. It is a weighted average over repetitions and says nothing about spread or the chance of loss.

27. Project A has a mean return of Tk 200,000 and a standard deviation of Tk 50,000. Project B has a mean of Tk 120,000 and a standard deviation of Tk 36,000. Which project has the lower relative risk and why?

A) Project A, because its coefficient of variation is 25% compared with 30% for Project B
B) Project B, because its coefficient of variation is 30% compared with 25% for Project A
C) Project B, because its standard deviation is lower in absolute terms and so shows lower risk per taka of return
D) Neither, because the coefficient of variation can be compared only where means are identical

Correct: A complex Coefficient of variation

CV = standard deviation ÷ mean. A: 50/200 = 25%; B: 36/120 = 30%. A lower CV means less risk per unit of return, so A is better on this basis.

28. A company's warehouse is in a flood zone. Management buys flood insurance, installs raised racking and stores key records off site. Which risk responses are these, in the order of the three actions?

A) Transfer, reduction (mitigation) and reduction (mitigation)
B) Reduction, avoidance and avoidance
C) Acceptance, reduction and transfer
D) Avoidance, transfer and acceptance

Correct: A complex Risk response

Insurance transfers financial risk. Raising racking and keeping records off site reduce the likelihood or impact of loss. Avoidance would mean leaving the zone, and acceptance means taking no action.

29. A board states: 'We will not accept any single risk exposure above 2% of equity, and in total our exposures should not exceed 8% of equity.' Which term best describes the 2% and the 8% figures?

A) Risk tolerance for individual exposures and the risk appetite limit for the total, expressed as measurable boundaries
B) Residual risk for individual exposures and inherent risk for the total, expressed as the position before any controls
C) Risk capacity for individual exposures and risk aversion for the total, expressed as the investors' attitude to risk
D) Risk avoidance for individual exposures and risk transfer for the total, expressed as insurance coverage purchased

Correct: A complex Risk appetite

Appetite is the amount of risk accepted in pursuing objectives, and tolerance is the acceptable deviation, usually expressed as measurable limits. The other terms describe different concepts.

30. A bank's risk management department designs the framework and monitors compliance, while internal audit gives independent assurance to the board on how well the framework is working. Operating managers own and manage risks day to day. How do these correspond to the three lines?

A) Internal audit is the first line, operating managers the second line, and risk management the third line, with the board and the regulator standing outside all three of the lines in the model
B) The board is the first line, operating managers the second line, and external auditors the third line
C) Operating managers are the first line, risk management and compliance the second line, and internal audit the third line
D) Risk management is the first line, internal audit the second line, and operating managers the third line

Correct: C complex Three lines model

The three lines model: management owns risks; risk and compliance functions oversee; internal audit provides independent assurance.

31. After a fire destroys its data centre, a company restores systems at a pre-arranged alternative site within four hours, and then plans the return to its normal premises. Which two elements of continuity planning does this show?

A) Risk avoidance and risk acceptance, since the company took no action until the event occurred, because no recovery steps were needed after the fire at the data centre had occurred
B) Disaster recovery of IT systems and a business continuity plan covering alternative premises and return to normal operations
C) Crisis communication and risk identification, since the company identified the fire hazard during the event
D) Risk transfer and risk sharing, since an insurer assumed all responsibility for restoring the systems

Correct: B complex Business continuity

Disaster recovery restores IT, while the continuity plan covers premises and operations. These are planned responses; they are not avoidance, acceptance or transfer.

32. Which TWO items are examples of financial risk? (Select TWO.)

Multiple response
A) A change in consumer fashion
B) A key supplier failing to deliver
C) Customers failing to pay invoices (credit risk)
D) A cyber attack on the website
E) Exposure to interest rate changes on floating-rate borrowings

Correct: C, E difficult Risk types

Interest rate and credit risk are financial. Supplier failure is operational or supply risk, fashion is market risk, and a cyber attack is technology risk.

33. Which THREE statements about the normal distribution are correct? (Select THREE.)

Multiple response
A) About 95% of values lie within roughly two standard deviations of the mean
B) The standard deviation is always zero
C) Mean, median and mode coincide
D) It is symmetrical about the mean
E) It is always positively skewed

Correct: A, C, D difficult Normal distribution

The distribution is symmetrical, with measures of central tendency equal, and about 95% fall within ±2 standard deviations. It has no skew, and the standard deviation is positive.

34. Which TWO statements about measuring risk are correct? (Select TWO.)

Multiple response
A) A larger standard deviation indicates greater dispersion of outcomes
B) Expected value takes account of the spread of outcomes
C) A negatively skewed distribution has a long tail to the right
D) Standard deviation measures the expected value of the project
E) The coefficient of variation is useful when comparing options with different means

Correct: A, E difficult Risk measurement

Standard deviation measures dispersion, and CV scales it by the mean. EV is an average without regard to spread, and negative skew has a left tail.

35. Which THREE statements about business resilience are correct? (Select THREE.)

Multiple response
A) Resilience is the ability to withstand and recover from disruption
B) Measures can include diversification of suppliers and flexible operations
C) Resilience is only concerned with protecting buildings
D) It involves planning for events that cannot be fully predicted
E) Resilience ends once a continuity plan has been written and filed

Correct: A, B, D difficult Resilience

Resilience means adapting and recovering, including planning and flexibility. A plan must be tested and updated, and resilience covers more than buildings.

36. Consider stages and terms in risk management. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Risk acceptance is always inappropriate.   No

2. Risk can be assessed by likelihood and impact.   Yes

3. Risks are identified before they are assessed.   Yes

4. Risk avoidance means buying insurance against the activity's losses.   No

5. Residual risk is the risk remaining after controls.   Yes

Correct: N, Y, Y, N, Y difficult Risk management

(1) No: low risks may be accepted. (2) Yes. (3) Yes. (4) No: that is transfer; avoidance means ceasing the activity. (5) Yes.

37. Consider statistical measures. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. The coefficient of variation is expressed in the same units as the mean.   No

2. A positive skew means a tail towards higher values.   Yes

3. Expected value always equals the outcome that will occur.   No

4. A project with a higher standard deviation is riskier, other things being equal.   Yes

5. The mean of a normal distribution equals its median.   Yes

Correct: N, Y, N, Y, Y difficult Measures of risk

(1) No: CV is a ratio without units. (2) Yes. (3) No: it is an average. (4) Yes. (5) Yes.

38. Consider investor attitudes to risk and diversification. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. All risk can be removed by diversification.   No

2. Diversification can reduce specific risk.   Yes

3. A risk-averse investor prefers a certain outcome to a risky one of equal expected value.   Yes

4. A risk-neutral investor is indifferent to risk and considers only expected value.   Yes

5. A risk-seeking investor dislikes uncertainty.   No

Correct: N, Y, Y, Y, N difficult Risk attitudes

(1) No: market risk remains. (2) Yes. (3) Yes. (4) Yes. (5) No: risk-seekers accept uncertainty.

39. Consider business resilience. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Reliance on a single supplier increases vulnerability.   Yes

2. Resilience requires that no disruptions ever occur.   No

3. Duplicating critical systems always reduces resilience.   No

4. A business continuity plan needs testing.   Yes

5. Resilience can be assessed by how quickly operations are restored.   Yes

Correct: Y, N, N, Y, Y difficult Resilience measures

(1) Yes. (2) No: resilience is about recovery. (3) No: redundancy can improve resilience. (4) Yes. (5) Yes.

40. Consider controls and risk. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Preventive controls aim to stop errors occurring.   Yes

2. Controls remove the need for risk assessment.   No

3. Segregation of duties is a control to reduce fraud risk.   Yes

4. Detective controls identify errors after they occur.   Yes

5. Management override cannot defeat controls that are well designed.   No

Correct: Y, N, Y, Y, N difficult Internal control

(1) Yes. (2) No: controls respond to assessed risks. (3) Yes. (4) Yes. (5) No: override by management can defeat controls.

41. A warehouse has a 4% annual chance of a fire causing a Tk 2.5m loss, and no other losses. An insurer quotes an annual premium of Tk 85,000. Which statement is correct?

A) The expected loss is Tk 100,000, so the premium is below the expected loss
B) The expected loss is Tk 85,000, so the premium equals the expected loss and the firm should be indifferent between the two choices
C) The expected loss is Tk 10,000, so insurance is poor value and the risk should be accepted by a firm of any risk attitude
D) The expected loss is Tk 2.5m, so the premium of Tk 85,000 is far too low and insurance must not be purchased on any grounds

Correct: A complex Insurance decision

EV of loss = 0.04 × 2,500,000 = 100,000. A premium of 85,000 is below this, which is unusual (insurers load premiums), but even at a higher premium a risk-averse firm may insure.

42. Weekly demand for a product is approximately normal with mean 800 units and standard deviation 60. Using the 68%/95% rule, what is the approximate probability that demand exceeds 920 units, and how should it be used?

A) About 2.5%, because 920 is two standard deviations above the mean, which helps set safety stock levels
B) About 5%, because 920 is two standard deviations from the mean, which means 5% of values lie above it in the upper tail alone
C) About 16%, because 920 is one standard deviation above the mean, which means safety stock should cover this level of demand
D) About 0%, because values more than 100 units from the mean cannot occur in a normal distribution of this kind

Correct: A complex Normal distribution use

920 = 800 + 2×60. About 95% lie within ±2 SD, leaving about 5% in both tails, or about 2.5% above.

43. Three projects have means and standard deviations (Tk m): P 240 and 48; Q 150 and 24; R 90 and 27. Which ranking from lowest relative risk to highest is correct?

A) Q (16%), R (30%), P (20%)
B) Q (16%), P (20%), R (30%)
C) P (20%), Q (16%), R (30%)
D) R (30%), P (20%), Q (16%)

Correct: B difficult CV ranking

CV = SD ÷ mean: P 20%, Q 16%, R 30%. Lower CV means lower risk per unit of return.

44. A firm's monthly claims have mean Tk 5.4m, median Tk 4.1m and a few very large values. Which statement is correct and why does it matter for risk management?

A) The distribution is negatively skewed, so the median overstates a typical month and planning can ignore rare large claims
B) The distribution is normal, so the standard deviation is zero and the claims are certain in every month, and a normal distribution always has a zero standard deviation when the mean is above the median
C) The distribution is symmetrical, so the mean and median differ only because of rounding in the underlying data
D) The distribution is positively skewed, so the mean overstates a typical month and planning should allow for rare large claims

Correct: D difficult Skewness

Mean above median with a tail of large values indicates positive skew. Extreme events must be considered separately.

45. A risk register scores likelihood and impact from 1 to 5 and multiplies them. Risk X: likelihood 4, impact 3. Risk Y: likelihood 2, impact 5. Risk Z: likelihood 5, impact 1. Which is correct?

A) Z scores 5, so Z is ranked first because likelihood is more important than impact in every risk assessment, and the risk register should be ranked on likelihood alone, with impact reviewed only after the risk has occurred
B) X scores 7, Y scores 7, Z scores 6, so none of the risks needs a risk response because totals are close
C) Y scores 7, X scores 7, Z scores 6, so all three risks should be treated equally in the risk response plan
D) X scores 12, Y scores 10, Z scores 5, so X is ranked first, although Y may need special attention because its impact is severe

Correct: D complex Risk register

X: 12; Y: 10; Z: 5. Scores help prioritise, but severe low-likelihood risks may need attention separate from the total.

46. After a system failure, a bank's target recovery time for payments was 4 hours, but it took 7 hours, and 30 minutes of transactions were lost against a tolerance of 15 minutes. Which conclusion is correct?

A) Only the recovery time was breached, because data loss tolerance is irrelevant to payment systems
B) Only the data loss tolerance was breached, because recovery time targets are non-binding in continuity planning
C) Both the recovery time and the data loss tolerances were breached
D) Neither tolerance was breached, because the system was eventually restored and total losses were small relative to annual turnover

Correct: C complex Business continuity metrics

7 hours > 4 hours and 30 minutes > 15 minutes. Continuity metrics are set to define acceptable disruption.

47. A board sets risk appetite. Which TWO statements are correct? (Select TWO.)

Multiple response
A) Risk appetite is the same as risk capacity in every case
B) Risk appetite never changes after it is approved
C) Risk appetite is the level of risk the organisation is willing to accept in pursuit of its objectives
D) Risk tolerance sets acceptable variation around objectives

Correct: C, D difficult Risk appetite

Appetite and tolerance are correctly described. Capacity is the maximum risk that can be borne, and appetite may be reviewed.

48. A bank applies the three lines model. Which THREE statements are correct? (Select THREE.)

Multiple response
A) Management owns and manages risks in the first line
B) The board has no oversight role
C) Internal audit provides independent assurance in the third line
D) Risk and compliance functions oversee in the second line
E) Internal audit is part of the first line

Correct: A, C, D difficult Three lines

The three lines assign ownership, oversight and independent assurance. The board has oversight.

49. A company reviews responses to a cyber risk. Which TWO are examples of risk reduction? (Select TWO.)

Multiple response
A) Buying a cyber insurance policy
B) Deciding to take no action and accept the full loss
C) Installing intrusion detection and staff training
D) Splitting data across two servers in different cities

Correct: C, D difficult Risk responses

Controls and redundancy reduce risk. Insurance transfers and doing nothing accepts.

50. A manufacturer wants a more resilient supply chain. Which THREE help? (Select THREE.)

Multiple response
A) Eliminating all buffer stocks
B) Relying on one supplier to obtain a quantity discount
C) Mapping dependencies to identify single points of failure
D) Dual sourcing of critical components
E) Regular testing of the continuity plan

Correct: C, D, E difficult Resilience

Diversification, testing and mapping increase resilience.