76. A bank has capital of Tk 120m against risk-weighted assets of Tk 1,000m (12%) and must keep at least 10%. A stress test assumes 8% of a Tk 1,000m loan book defaults with a loss given default of 50%. Risk-weighted assets are unchanged. What is the result?

A) The loss is Tk 80m, capital falls to Tk 40m (4%), below the 10% minimum
B) The loss is Tk 40m, capital stays at Tk 120m (12%),
C) The loss is Tk 40m, capital falls to Tk 80m (8%), below the 10% minimum
D) The loss is Tk 40m, capital falls to Tk 80m (8%), above the 10% minimum, so no action is needed

Correct: C complex Stress testing

Defaults = 8% × 1,000 = 80; loss = 80 × 50% = 40. Capital = 120 − 40 = 80, which is 8% of 1,000. This is below 10%, so the bank fails the stress test.

77. Which THREE are components of a recognised enterprise risk management framework? (Select THREE.)

Multiple response
A) Strategy and objective-setting
B) Preparing the payroll
C) Performance, including identification and assessment of risk
D) Maximising the dividend each year
E) Governance and culture

Correct: A, C, E difficult Enterprise risk management components

Recognised frameworks cover governance and culture, strategy, performance, review and information. Payroll and dividends are not components.

78. Which THREE are examples of operational risk? (Select THREE.)

Multiple response
A) Errors by employees in processing payments
B) A customer's failure to repay a loan
C) Failure of a core IT system
D) Damage to premises by flooding
E) A fall in the market price of the company's investments

Correct: A, C, D difficult Operational risk examples

Operational risk arises from people, processes, systems and external events. Investment price falls are market risk and loan non-payment is credit risk.

79. Which THREE situations show concentration risk? (Select THREE.)

Multiple response
A) One supplier provides 70% of a manufacturer's raw materials
B) 60% of a bank's loans are to a single industry
C) One customer provides 40% of revenue
D) Revenue is spread evenly over many customers and regions
E) A portfolio is spread across unrelated sectors

Correct: A, B, C difficult Concentration risk

Heavy reliance on a single supplier, customer or industry creates concentration risk. A spread across many reduces it.

80. A lender wants to reduce credit risk. Which TWO controls are suitable? (Select TWO.)

Multiple response
A) Requiring collateral from borrowers
B) Lending more to customers who have already missed payments
C) Removing credit checks to speed up lending
D) Ignoring concentration of lending
E) Setting credit limits by borrower and sector

Correct: A, E difficult Credit risk controls

Collateral and limits reduce exposure and loss. The other actions raise credit risk.

81. An auditor discusses fraud risk with a client. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Fraud involves intentional acts, whereas error is unintentional.   Yes

2. Management has no responsibility for preventing fraud.   No

3. Management override of controls is a risk that standard controls may not prevent.   Yes

4. The fraud triangle consists of pressure, opportunity and rationalisation.   Yes

5. Fraud cannot occur in organisations with strong controls.   No

Correct: Y, N, Y, Y, N difficult Fraud and error

(1) Yes. (2) No: management is responsible for prevention and detection. (3) Yes. (4) Yes. (5) No: controls reduce but do not eliminate fraud.

82. A business owner reviews insurance. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A higher excess usually lowers the premium.   Yes

2. Insurance covers every possible type of loss without exception.   No

3. Insurance makes controls for the insured risk unnecessary.   No

4. Insurable interest means the policyholder must have a financial stake in the item insured.   Yes

5. Insurance transfers part of the financial risk to the insurer.   Yes

Correct: Y, N, N, Y, Y difficult Insurance concepts

(1) Yes. (2) No: policies have exclusions. (3) No: controls are still needed and insurers expect them. (4) Yes. (5) Yes.

83. A risk committee uses several techniques. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Interviews with staff can reveal risks not visible to senior management.   Yes

2. Brainstorming workshops can identify risks from different departments.   Yes

3. Risk identification should be done once and need not be repeated.   No

4. A checklist based on past experience will identify every new risk.   No

5. SWOT analysis can identify threats to objectives.   Yes

Correct: Y, Y, N, N, Y difficult Risk identification

(1) Yes. (2) Yes. (3) No: it is a continuing process. (4) No: a checklist may miss new risks. (5) Yes.

84. A treasurer classifies exposures. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Interest rate risk affects only companies with no borrowing.   No

2. Credit risk is the risk of losses from changes in the weather.   No

3. Liquidity risk is the risk of being unable to meet obligations as they fall due.   Yes

4. Market risk includes the effect of changes in prices of financial instruments.   Yes

5. Foreign exchange risk arises when values change because of exchange-rate movements.   Yes

Correct: N, N, Y, Y, Y difficult Financial risk types

(1) No: floating-rate borrowers are exposed to interest rate changes. (2) No: credit risk is the risk that a counterparty fails to pay. (3) Yes. (4) Yes. (5) Yes.

85. A board sets up its risk oversight. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A risk register records identified risks, owners and responses.   Yes

2. A risk committee can support the board's oversight.   Yes

3. Risk ownership should be unassigned to avoid blame.   No

4. The board is ultimately responsible for risk management.   Yes

5. Risk appetite statements should be kept confidential from management.   No

Correct: Y, Y, N, Y, N difficult Risk governance

(1) Yes. (2) Yes. (3) No: each risk needs a named owner. (4) Yes. (5) No: they should be communicated so that managers act within them.

86. A bank's one-day 99% value at risk on its bond portfolio is Tk 20m. Which interpretation is correct?

A) On 99% of days the portfolio will lose exactly Tk 20m, while on the other days it will make a profit equal to this amount
B) The maximum possible loss on any day is Tk 20m, so no further capital is needed to cover market risk under extreme events
C) On 99% of days, losses should not exceed Tk 20m under the model's assumptions, but it says nothing about how large losses may be on the remaining 1% of days
D) There is a 1% chance that the portfolio will lose Tk 20m on every day in the coming year because losses are cumulative

Correct: C difficult Value at risk

VaR is a threshold at a confidence level. It does not give the maximum loss, and tail losses beyond the threshold can be much larger. Stress testing supplements it.

87. A board sets a risk appetite of 'no more than 5% of annual profit lost to operational incidents'. Profit is Tk 400m and operational losses so far this year are Tk 18m with three months remaining. Which statement is correct?

A) The tolerance limit is Tk 20m, so only Tk 2m of headroom remains and management should review controls and escalate before the limit is breached
B) The limit is Tk 80m, so there is ample headroom and no action is required until losses reach 20% of profit
C) The limit is Tk 20m, and since losses are below it, the board should relax controls to use up the remaining capacity
D) The limit is Tk 2m, so it has already been breached because losses of Tk 18m exceed it

Correct: A complex Risk appetite and tolerance

5% of Tk 400m = Tk 20m. Losses of Tk 18m leave Tk 2m of headroom, which is small. A risk-aware response is to strengthen controls and escalate.

88. A manufacturer faces a 2% yearly chance of a Tk 150m factory fire. Insurance would cost Tk 4m a year, covering the whole loss. Which response analysis is correct?

A) Expected annual loss is Tk 3m, below the Tk 4m premium
B) Expected annual loss is Tk 150m, because a fire would destroy the factory
C) Expected annual loss is Tk 3m, below the Tk 4m premium, but the company may still insure
D) Expected annual loss is Tk 7.5m, above the Tk 4m premium, so insurance gives a clear financial saving over retention

Correct: C difficult Risk response

Expected loss = 2% × 150m = 3m. Premium 4m exceeds this because it includes insurer costs and profit. Decisions on severe, low-probability risks consider tolerance and stability as well as expected value.

89. A bank's core system is down for 6 hours. Its business continuity plan has a recovery time objective of 4 hours and a recovery point objective of 15 minutes. Which statement is correct?

A) The recovery time objective was met, because the recovery point objective of 15 minutes is the maximum permitted outage
B) The recovery time objective was missed by two hours, so the plan failed on time, and the recovery point objective relates to how much data can be lost, here up to 15 minutes
C) Both objectives were met, because objectives are only targets and cannot be judged against actual outages
D) The recovery point objective was missed by 5 hours 45 minutes, because it is the maximum permitted downtime

Correct: B complex Business continuity

RTO is the maximum acceptable downtime (4 hours), exceeded here by 2 hours. RPO is the maximum acceptable data loss measured in time (15 minutes).

90. An investor holds two assets with identical expected returns and standard deviations. Which change in correlation between them would most reduce portfolio risk?

A) Moving the correlation from -1 towards +1,
B) Any change in correlation,
C) Moving the correlation from +1 towards -1,
D) Moving the correlation to zero from +1 would raise portfolio risk because independent assets add variance

Correct: C difficult Risk correlation

Portfolio variance falls as correlation falls. At -1 risk can be eliminated; at +1 there is no diversification benefit.

91. A company assesses inherent risk of payment fraud as 'high'. After controls (dual approval, bank limits), likelihood falls from likely to unlikely, with impact unchanged. How should residual risk be described?

A) It equals inherent risk, because controls change only the way the risk is reported and not its probability or impact
B) It is higher than inherent risk, because controls add complexity and therefore cause more errors
C) It is nil, because dual approval removes all possibility of payment fraud once the limits are in place
D) It is lower than inherent risk because likelihood has fallen, but not nil

Correct: D difficult Residual risk

Residual risk is the exposure remaining after controls. It is reduced by effective controls but rarely eliminated, and depends on control operation.

92. Which THREE steps are part of a typical risk management process? (Select THREE.)

Multiple response
A) Eliminate every risk in the business
B) Assess likelihood and impact
C) Avoid assessing risks that seem unlikely
D) Monitor and review the responses
E) Identify risks

Correct: B, D, E difficult Risk management process

The process is identify, assess, respond, monitor. Eliminating all risk is impossible, and unlikely high-impact risks must still be assessed.

93. Which THREE are preventive controls against payment fraud? (Select THREE.)

Multiple response
A) Segregation of duties between initiating and approving payments
B) Investigating losses after discovery
C) Authorisation limits by position
D) Reviewing exception reports after payments have been made
E) Vendor bank detail changes verified by call-back

Correct: A, C, E difficult Controls against fraud

Segregation, limits and call-back verification act before the payment. Reviews after the event are detective and investigation is corrective.

94. Which THREE can increase liquidity risk for a bank? (Select THREE.)

Multiple response
A) A large stock of high-quality liquid assets
B) Diverse and stable retail deposit base
C) Heavy reliance on short-term wholesale funding
D) Long-term loans funded by short-term deposits
E) Large concentrations of deposits from a few depositors

Correct: C, D, E difficult Sources of liquidity risk

Short-term funding, concentration and maturity mismatch all raise liquidity risk. Liquid assets and diverse stable deposits reduce it.

95. Which THREE indicate a positive risk culture? (Select THREE.)

Multiple response
A) Risk matters are left only to a central risk team
B) Senior management sets the tone and follows the rules
C) Incidents are hidden to protect the department's record
D) Staff report incidents without fear of blame
E) Risk is considered in everyday decisions

Correct: B, D, E difficult Risk culture

Open reporting, tone at the top and risk awareness define the culture. Isolating risk and hiding incidents harm it.

96. A risk committee reviews its register. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Risk ratings never need to change once recorded.   No

2. Only financial risks belong in the risk register.   No

3. A risk matrix combines likelihood and impact.   Yes

4. Risk owners should be assigned to each significant risk.   Yes

5. A low-likelihood, high-impact risk may still deserve attention.   Yes

Correct: N, N, Y, Y, Y difficult Risk assessment

(1) No: ratings change with circumstances. (2) No: strategic, operational and compliance risks are included. (3) Yes. (4) Yes. (5) Yes.

97. A company imports raw materials priced in US dollars. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. An unhedged exposure is risk-free if the exchange rate has been stable.   No

2. A forward contract fixes the exchange rate for a future payment.   Yes

3. Hedging always generates a profit.   No

4. Hedging removes the chance of benefiting from favourable movements when using a forward.   Yes

5. Natural hedging aligns receipts and payments in the same currency.   Yes

Correct: N, Y, N, Y, Y difficult Hedging and risk transfer

(1) No: past stability does not guarantee future rates. (2) Yes. (3) No: it reduces uncertainty at a cost. (4) Yes. (5) Yes.

98. A bank describes its risk governance. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Operational management owns and manages risk in the first line.   Yes

2. Internal audit is part of the first line.   No

3. The first line has no responsibility for controls.   No

4. Risk and compliance functions provide oversight in the second line.   Yes

5. Internal audit provides independent assurance to the board.   Yes

Correct: Y, N, N, Y, Y difficult Three lines model

(1) Yes. (2) No: it is the third line. (3) No: first-line management owns controls. (4) Yes. (5) Yes.

99. A bank classifies loss events. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A fall in interest rates is an operational risk event.   No

2. Operational risk includes losses from failed processes, people and systems.   Yes

3. A mis-posted payment from a keying error is an execution error.   Yes

4. A rogue trader exceeding limits is an internal fraud event.   Yes

5. A power failure that stops a branch is an internal fraud event.   No

Correct: N, Y, Y, Y, N difficult Operational risk events

(1) No: it is a market risk. (2) Yes. (3) Yes. (4) Yes. (5) No: it is a business disruption event.

100. A listed company considers compliance risk. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Training staff reduces compliance risk.   Yes

2. Ignorance of the law is accepted by regulators as a full defence.   No

3. Compliance risk arises only from external law and never from internal policy.   No

4. A compliance function monitors adherence to laws and policies.   Yes

5. Non-compliance can lead to fines and reputational damage.   Yes

Correct: Y, N, N, Y, Y difficult Compliance risk

(1) Yes. (2) No: it is not. (3) No: it arises also from breaching internal policy. (4) Yes. (5) Yes.