51. A project has outcomes Tk 600m (p=0.5), Tk 200m (p=0.3) and −Tk 100m (p=0.2). Consider the following. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. The spread of outcomes is shown by the expected value.   No

2. The expected value is the outcome that will definitely occur.   No

3. The probability of a loss is 20%.   Yes

4. The expected value is Tk 340m.   Yes

5. Expected value is a weighted average of outcomes.   Yes

Correct: N, N, Y, Y, Y complex Expected values

(1) No: spread is shown by standard deviation. (2) No. (3) Yes. (4) Yes: 300 + 60 − 20 = 340. (5) Yes.

52. A hotel chain reviews risks. Consider the following. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Avoiding risk may mean not undertaking an activity.   Yes

2. Risk responses should consider cost and benefit.   Yes

3. Accepting risk is never appropriate.   No

4. Residual risk is the risk that exists before any controls are applied.   No

5. Transferring risk can be achieved through insurance or outsourcing.   Yes

Correct: Y, Y, N, N, Y difficult Risk treatment

(1) Yes. (2) Yes. (3) No. (4) No: residual risk remains after controls. (5) Yes.

53. A bank analyses loan losses. Consider the following. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A higher standard deviation shows greater variability.   Yes

2. Coefficient of variation is expressed in monetary units.   No

3. Skewness has no relevance to risk.   No

4. Negative skew means a long tail to the left.   Yes

5. In a normal distribution the mean equals the median.   Yes

Correct: Y, N, N, Y, Y difficult Statistics and risk

(1) Yes. (2) No. (3) No. (4) Yes. (5) Yes.

54. A telecom firm faces a major outage. Consider the following. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Roles for a crisis team should be defined in advance.   Yes

2. Disaster recovery is concerned mainly with restoring customer confidence through communication.   No

3. Crisis management is needed only after the media have reported the event.   No

4. A continuity plan should be tested.   Yes

5. Crisis communication to customers is part of crisis management.   Yes

Correct: Y, N, N, Y, Y difficult Continuity and crisis

(1) Yes. (2) No: disaster recovery is mainly about restoring systems and data. (3) No. (4) Yes. (5) Yes.

55. A listed company reviews risk governance. Consider the following. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A risk committee can support the board.   Yes

2. Internal control eliminates all risk.   No

3. Risk appetite statements guide decisions.   Yes

4. Risk culture influences behaviour.   Yes

5. Responsibility for risk management rests with internal audit alone.   No

Correct: Y, N, Y, Y, N difficult Risk governance

(1) Yes. (2) No. (3) Yes. (4) Yes. (5) No: the board is ultimately responsible.

56. A risk has likelihood 4 and impact 5 on 1–5 scales, and the risk score is likelihood × impact. A new control cuts likelihood to 2. The board's appetite is a score of no more than 8 for this risk. What is the position?

A) Inherent score 20 falls to a residual score of 10, which is below the appetite of 8, so no further action is required on this risk
B) Inherent score 20 falls to a residual score of 10, a 50% reduction, but it is still above the appetite of 8, so further treatment or a board decision to accept is needed
C) Inherent score 20 is unchanged at 20, because controls change the impact only and never affect the likelihood of the event occurring
D) Inherent score 9 falls to a residual score of 7, a 22% reduction, which is within the appetite of 8, so the risk should be accepted

Correct: B complex Residual risk and appetite

Inherent = 4 × 5 = 20. Residual = 2 × 5 = 10, which is 50% lower but still exceeds the appetite of 8. Controls can reduce either likelihood or impact.

57. A bank's four risk decisions are: (1) stop lending to start-ups with no collateral, (2) buy cover for losses from fraud, (3) put a limit on exposure to any one borrower, (4) accept small losses on card misuse within budget. Which matching is correct?

A) (1) transfer, (2) reduce, (3) accept, (4) avoid
B) (1) avoid, (2) reduce, (3) accept, (4) transfer
C) (1) reduce, (2) avoid, (3) transfer, (4) accept
D) (1) avoid, (2) transfer, (3) reduce, (4) accept

Correct: D complex Risk response TARA

Stopping an activity is avoidance, insurance is transfer, limits reduce exposure, and knowingly bearing small losses is acceptance.

58. A company's head of internal audit is asked to design and implement the controls for a new payments system and then to give the audit committee assurance that the controls work. Which statement is most appropriate?

A) This is required because the second line must always report to the first line when new systems are introduced to the business
B) This is the best use of internal audit because the function knows the controls well and can therefore give more reliable assurance
C) This weakens independence because designing controls is a first-line management task, so internal audit should provide independent assurance and leave the design to management
D) This is acceptable because the third line is responsible for owning and operating all the controls within the company's systems

Correct: C difficult Three lines model

Management (first line) owns risks and controls, the second line oversees, and internal audit (third line) gives independent assurance. Designing the controls compromises objectivity.

59. Project A has a 50% chance of a profit of Tk 100m and a 50% chance of zero. Project B gives a certain profit of Tk 45m. Which statement is correct?

A) The projects have equal expected values of Tk 45m, so the company should choose by the size of the standard deviation only
B) Project B has the higher expected value because it is certain, so every company should prefer B whatever its attitude to risk
C) Project A has the higher expected value, Tk 50m against Tk 45m, so a risk-neutral company prefers it
D) Project A has an expected value of Tk 100m, so every company should choose it because its upper outcome is greater

Correct: C difficult Expected value and risk attitude

EV(A) = 0.5 × 100 = 50 versus 45 for B. Risk-neutral decision-makers use expected values; risk-averse ones may accept a lower expected value for certainty.

60. A bank wants an early-warning measure for the risk of payment processing errors. Which indicator is the best key risk indicator and why?

A) The bank's annual profit before tax, because a falling profit proves that payment processing risk has increased in the year
B) The monthly overtime hours and vacancy rate in the payments team, because they are leading indicators that may signal a rising error rate before losses occur
C) The total value of losses written off last year, because losses show exactly when controls will fail in the coming period
D) The number of customer complaints received after the errors, because this is a leading measure which precedes the errors themselves

Correct: B difficult Key risk indicators

A key risk indicator should warn of rising risk before loss happens, so leading measures such as workload and vacancies are suitable. Losses and complaints are lagging, and profit is not specific to the risk.

61. A Bangladeshi importer must pay USD 500,000 in three months. The spot rate is Tk 120 per USD and the bank offers a three-month forward at Tk 122. If the spot rate in three months is Tk 126, which statement is correct?

A) The forward fixes the cost at Tk 61m, whereas leaving the exposure open would cost Tk 63m, so the hedge saves Tk 2m
B) The forward cost depends on the spot rate in three months, so the hedge does not remove the uncertainty about the final taka cost
C) The forward fixes the cost at Tk 63m, whereas leaving the exposure open would cost Tk 61m
D) The forward fixes the cost at Tk 60m, whereas leaving the exposure open would cost Tk 63m

Correct: A complex Forward cover

Forward cost = 500,000 × 122 = Tk 61m. Unhedged at 126 = Tk 63m, a saving of Tk 2m. If the spot rate were below 122 the hedge would have been dearer. The forward removes uncertainty about the taka amount.

62. A company's finance director lists risks. Which THREE of the following are financial risks? (Select THREE.)

Multiple response
A) Interest rate risk on floating-rate borrowings
B) Credit risk from customers who fail to pay
C) Compliance risk from a failure to meet filing deadlines
D) Liquidity risk from an inability to meet short-term obligations
E) Reputational risk from an adverse news story

Correct: A, B, D difficult Financial risks

Credit, liquidity and interest rate risks are financial. Reputational and compliance risks are non-financial in nature, although they may have financial effects.

63. Which THREE features indicate a healthy risk culture? (Select THREE.)

Multiple response
A) Risk is discussed only at the annual strategy meeting
B) Incentives are consistent with the risk appetite
C) Staff report near misses without fear of blame
D) Each risk has a clearly named owner
E) Bad news is kept from the board until the year-end

Correct: B, C, D difficult Risk culture

Open reporting, ownership and aligned incentives support a sound risk culture. Hiding bad news and an annual-only discussion are signs of a weak one.

64. A company prepares a business continuity plan. Which THREE are elements of good practice? (Select THREE.)

Multiple response
A) Recovery time objectives for critical processes
B) Reliance on insurance alone to restore operations
C) A business impact analysis identifying critical processes
D) Tested off-site backups and an alternate work site
E) A plan covering IT systems only

Correct: A, C, D difficult Business continuity

Impact analysis, recovery time objectives and tested backups with an alternate site are standard. Insurance pays for losses but does not restore operations, and the plan must cover people, premises and suppliers as well as IT.

65. Which TWO statements about risk appetite and risk tolerance are correct? (Select TWO.)

Multiple response
A) Risk appetite is the amount of risk an organisation is willing to accept in pursuing its objectives
B) Risk tolerance is the acceptable variation around a specific objective
C) Risk appetite and risk capacity are the same thing
D) Risk appetite is set only by operational staff without board input
E) Risk tolerance has no connection with thresholds or limits

Correct: A, B difficult Appetite and tolerance

Appetite is the broad willingness to take risk; tolerance sets acceptable deviation, often as thresholds. The board sets appetite, and capacity is the maximum risk that can be borne.

66. A risk manager classifies risks. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A failure of internal controls over payroll is an operational risk.   Yes

2. A new competitor taking market share is a strategic risk.   Yes

3. A fine for breaching a regulation is a compliance risk.   Yes

4. A change in exchange rates is an operational risk only.   No

5. A systemic risk affects only one department in one company.   No

Correct: Y, Y, Y, N, N difficult Categories of risk

(1) Yes. (2) Yes. (3) Yes. (4) No: exchange rate changes are a market (financial) risk. (5) No: systemic risk affects the wider system.

67. A manager reviews risk treatments. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Reducing a risk can alter likelihood, impact or both.   Yes

2. Transferring a risk always removes reputational damage.   No

3. Avoidance reduces the likelihood of a risk but keeps the activity unchanged.   No

4. Insurance transfers the financial effect of some risks but not responsibility for managing them.   Yes

5. Accepting a risk means the company must have a plan for losses that exceed the tolerance.   Yes

Correct: Y, N, N, Y, Y difficult Risk responses

(1) Yes. (2) No: reputation cannot be transferred. (3) No: avoidance removes the risk by not carrying out the activity. (4) Yes. (5) Yes: the acceptance should be informed and monitored.

68. An internal auditor classifies controls. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A corrective control repairs the effect after an event.   Yes

2. A bank reconciliation is a detective control.   Yes

3. Passwords restricting system access are preventive controls.   Yes

4. Authorisation limits for purchases are detective controls.   No

5. Segregation of duties is a detective control only.   No

Correct: Y, Y, Y, N, N difficult Internal controls

(1) Yes. (2) Yes. (3) Yes. (4) No: authorisation limits are preventive controls. (5) No: segregation is preventive.

69. A board is considering enterprise risk management. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. ERM replaces the need for internal control.   No

2. ERM can help align risk-taking with strategy and appetite.   Yes

3. ERM guarantees that no objective will be missed.   No

4. ERM depends on people's judgement, which can be wrong.   Yes

5. ERM takes an integrated view of risks across the organisation.   Yes

Correct: N, Y, N, Y, Y difficult Enterprise risk management

(1) No: internal control is part of ERM. (2) Yes. (3) No: it gives reasonable and not absolute assurance. (4) Yes. (5) Yes.

70. A risk matrix shows a risk with high likelihood and low impact, and another with low likelihood and very high impact. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. The first risk may be managed by routine controls.   Yes

2. A matrix removes all subjectivity from risk assessment.   No

3. Risks with the same score always require the same response.   No

4. The second risk may justify insurance or contingency planning.   Yes

5. A matrix can understate the importance of rare, severe events.   Yes

Correct: Y, N, N, Y, Y complex Probability-impact matrix

(1) Yes. (2) No: ratings rest on judgement. (3) No: similar scores can need different responses. (4) Yes. (5) Yes.

71. A bank has a loan exposure at default of Tk 500m. The probability of default is 2% and the loss given default is 45%. What is the expected loss, and what happens if the borrower's probability of default doubles?

A) Tk 225m, rising to Tk 450m if the probability of default doubles to 4%
B) Tk 4.5m, remaining at Tk 4.5m if the probability of default doubles
C) Tk 10.0m, rising to Tk 20.0m if the probability of default doubles to 4%
D) Tk 4.5m, rising to Tk 9.0m if the probability of default doubles to 4%

Correct: D complex Expected credit loss

Expected loss = PD × LGD × EAD = 0.02 × 0.45 × 500 = 4.5m. Doubling PD to 4% gives 0.04 × 0.45 × 500 = 9.0m. Expected loss is proportional to each component.

72. A cashier with large gambling debts takes cash from the till, telling himself he will repay it after his next win. The branch has no cash counts and one person handles both receipts and records. Which control most directly addresses the opportunity element of the fraud triangle?

A) A higher salary for the cashier, because this removes the pressure and so eliminates the opportunity for theft
B) A code of conduct lecture, because this removes the rationalisation and so eliminates the opportunity for theft
C) Segregation of duties between cash handling and recording, with surprise cash counts,
D) Counselling on gambling debts, because this removes the pressure and so eliminates the opportunity for theft

Correct: C complex Fraud triangle

The fraud triangle is pressure, opportunity and rationalisation. Controls like segregation and cash counts reduce opportunity. The other options address pressure or rationalisation, which a firm cannot fully control.

73. An insurer finds that people with the highest risk of loss are the most eager to buy cover, and that insured customers become less careful about preventing loss once covered. Which terms describe these two problems?

A) Both are moral hazard
B) Both are adverse selection
C) The first is moral hazard and the second is adverse selection
D) The first is adverse selection and the second is moral hazard

Correct: D difficult Moral hazard and adverse selection

Adverse selection arises before the contract, when higher-risk customers are more likely to buy. Moral hazard arises after the contract, when the insured behave less carefully.

74. A business faces a 10% annual chance of a Tk 20m loss. An insurer offers cover for an annual premium of Tk 1.8m with an excess of Tk 2m per claim. Ignoring tax and risk attitudes, how do the expected annual costs compare?

A) Insuring costs Tk 1.8m and not insuring costs Tk 2.0m, so insurance is cheaper in expected terms and should always be bought
B) Insuring costs Tk 2.0m and not insuring costs Tk 20m, so the business should insure whatever its attitude to risk
C) Both are Tk 2.0m: insuring costs 1.8m plus an expected 0.2m excess, and not insuring costs 10% × 20m
D) Insuring costs Tk 3.8m and not insuring costs Tk 2.0m, so insurance is dearer in expected terms and should never be bought

Correct: C complex Insurance with an excess

Insured: premium 1.8m + 10% × 2m excess = 2.0m. Uninsured: 10% × 20m = 2.0m. Equal expected cost, so the decision turns on risk aversion and whether the business could survive a loss of 20m.

75. Two investments each have an expected return of 10% and a standard deviation of 20%. A portfolio puts half in each. If the returns are uncorrelated, what is the portfolio's standard deviation, and what would it be if the correlation were +1?

A) About 10.0% if uncorrelated, and 20% if perfectly positively correlated, so diversification reduces both risk and expected return
B) About 14.1% if uncorrelated, and 10% if perfectly positively correlated, so diversification has the greatest effect when correlation is +1
C) About 20% if uncorrelated, and 14.1% if perfectly positively correlated, so diversification works best when returns move together
D) About 14.1% if uncorrelated, and 20% if perfectly positively correlated, so diversification reduces risk without reducing expected return

Correct: D complex Diversification

Uncorrelated: √(0.5² × 0.2² + 0.5² × 0.2²) = √0.02 = 14.1%. With correlation +1, the standard deviation is 20%, the weighted average. Expected return stays at 10% in both cases.