101. A hospital faces a 5% annual chance of a Tk 80m loss from a system failure. A Tk 3m control would cut the chance to 1%. What is the net benefit of the control and the implication?

A) Expected loss falls from Tk 4.0m to Tk 0.8m, a saving of Tk 3.2m, so the net benefit is Tk 0.2m; the control is only marginally justified and non-financial factors may decide
B) Expected loss falls from Tk 4.0m to Tk 0.8m, a saving of Tk 3.2m, so the net benefit is Tk 3.2m because the cost is a sunk cost
C) Expected loss falls from Tk 4.0m to Tk 3.0m, a saving of Tk 1.0m, so the control should be rejected as a net cost
D) Expected loss falls from Tk 80m to Tk 3m, a saving of Tk 77m, so the control is clearly justified on financial grounds

Correct: A complex Cost-benefit of risk mitigation

Before: 5% × 80 = 4.0m; after: 1% × 80 = 0.8m; reduction 3.2m. Net benefit = 3.2 − 3.0 = 0.2m. Expected values ignore severity and reputational effects, which may justify control.

102. A bank has Tk 600m of assets and Tk 800m of liabilities that reprice within one year. Interest rates are expected to rise by 1 percentage point. What is the likely effect on net interest income, and what is the exposure type?

A) Net interest income falls by about Tk 14m, because the whole balance of both assets and liabilities is repriced
B) Net interest income rises by about Tk 2m, because liabilities reprice first and so the bank earns more on its assets
C) Net interest income falls by about Tk 2m, because more liabilities than assets reprice, which is a negative one-year gap (repricing risk)
D) Net interest income is unchanged, because the effects on assets and liabilities cancel when rates rise

Correct: C complex Interest rate gap

Gap = 600 − 800 = −200m; ΔNII = −200m × 1% = −2m. A negative gap means liabilities reprice faster, hurting income when rates rise.

103. A company has a net US dollar liability of USD 2m due in three months. The taka depreciates from Tk 110 to Tk 118 per dollar. What is the effect, and what hedge would have fixed the cost?

A) No effect, because a dollar liability is unaffected by exchange rates
B) A loss of Tk 8m, avoidable by paying the liability immediately in taka without needing a hedge
C) A loss of Tk 16m, avoidable by a forward purchase of dollars at the agreed rate or by another matching hedge
D) A gain of Tk 16m, because the taka falls in value and the dollar liability becomes smaller in taka terms and a hedge would therefore have been unnecessary

Correct: C complex Currency exposure

2m × (118 − 110) = Tk 16m more taka are needed. A forward contract or money market hedge fixes the taka cost.

104. A factory is insured for Tk 80m but its actual replacement value is Tk 100m. The policy contains an average clause. A fire causes a loss of Tk 20m. How much will the insurer pay, and what does this show?

A) Tk 4m, because only the underinsured portion of the loss is paid
B) Tk 16m (80 ÷ 100 × 20), showing that underinsurance reduces recovery proportionally
C) Tk 20m, because the loss is below the sum insured so the clause does not apply and underinsurance has no effect on the amount recovered
D) Tk 25m, because the insurer pays more to compensate for underinsurance

Correct: B complex Co-insurance

Under average, payment = sum insured ÷ value × loss = 80/100 × 20 = 16. The insured bears the balance.

105. A firm has contribution of Tk 24m and operating profit of Tk 8m. Sales fall by 10%. What is the effect on profit, and what does this indicate about risk?

A) Profit falls by 3%, because the degree of operating leverage divides the sales fall
B) Profit falls by 100%, because contribution is greater than profit
C) Profit falls by 30% (degree of operating leverage of 3)
D) Profit falls by 10%, because costs fall in proportion to sales

Correct: C difficult Operating leverage

DOL = contribution/profit = 24/8 = 3. A 10% sales fall reduces profit by 30%, i.e. Tk 2.4m (contribution falls by 2.4m, all of which reduces profit).

106. A risk committee plots a 'cyber attack' risk with likelihood 'likely' and impact 'major' in the top-right zone of its heat map. Management proposes accepting it because mitigation is expensive. What is the best response?

A) Accepting a high-rated risk exceeds typical appetite; the committee should require mitigation
B) Accept the proposal, because cost always overrides risk rating in a heat map
C) Reject any mitigation, because top-right risks cannot be reduced by controls
D) Remove the risk from the register, because high-rated risks are always unrealistic and note that the committee has no further role in the matter

Correct: A difficult Risk heat map

High likelihood and impact normally fall outside appetite and need treatment or board-level acceptance with evidence.

107. Which THREE are features of effective risk reporting to a board? (Select THREE.)

Multiple response
A) Detailed data on every minor risk
B) Clear link to risk appetite
C) Absence of any forward-looking information
D) Focus on key risks and trends
E) Information on actions and owners

Correct: B, D, E difficult Features of effective risk reporting

Boards need key risks, appetite links and actions. Too much detail and no forward view reduce usefulness.

108. A bank uses key risk indicators. Which THREE are suitable examples? (Select THREE.)

Multiple response
A) Colour of the head-office walls
B) Percentage of customers failing identity checks
C) Number of unreconciled items older than 30 days
D) Staff turnover in the payments team
E) Average coffee spend per employee

Correct: B, C, D difficult Key risk indicators

Indicators should signal changes in risk exposure. The last two are unrelated to risk.

109. Which THREE conditions increase the risk of fraud? (Select THREE.)

Multiple response
A) Regular rotation of duties in sensitive roles
B) Weak supervision and segregation of duties
C) Opportunity to override controls
D) Strong pressure to meet targets
E) Strong ethical culture with active reporting

Correct: B, C, D difficult Fraud risk factors

Weak control, pressure and override opportunity raise risk; an ethical culture and rotation lower it.

110. Which THREE risks are classified as business (strategic) risks? (Select THREE.)

Multiple response
A) A competitor launching a superior product
B) Entering a new market that fails
C) Technology change making a product obsolete
D) A cashier's keying error
E) A flood damaging the warehouse

Correct: A, B, C difficult Hazard and business risks

Business risks arise from strategic decisions and the environment. Floods and keying errors are hazard and operational risks.

111. A risk manager explains principles. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Risk appetite varies between organisations.   Yes

2. Risk can create opportunity as well as loss.   Yes

3. Risk should be considered only after a decision has been taken.   No

4. Risk responses include avoid, reduce, transfer and accept.   Yes

5. A risk once rated can never be reduced.   No

Correct: Y, Y, N, Y, N difficult Risk management principles

(1) Yes. (2) Yes. (3) No: risk should inform decisions. (4) Yes. (5) No: controls reduce rating.

112. A treasury team reviews market risk. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Currency rates affect the taka value of foreign receipts.   Yes

2. Equity prices cannot affect a bank's earnings.   No

3. Diversification cannot reduce any market risk.   No

4. Commodity price changes can affect input costs.   Yes

5. Interest rate changes affect the value of fixed-rate bonds.   Yes

Correct: Y, N, N, Y, Y difficult Market risk

(1) Yes. (2) No: trading and investment portfolios are exposed. (3) No: it can reduce specific risk. (4) Yes. (5) Yes.

113. An internal controller reviews controls. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. Management override can defeat controls.   Yes

2. Preventive controls aim to stop errors before they occur.   Yes

3. Cost of control should be proportionate to the risk.   Yes

4. Controls are effective if they exist on paper only.   No

5. Detective controls stop errors before they occur.   No

Correct: Y, Y, Y, N, N difficult Internal controls and risk

(1) Yes. (2) Yes. (3) Yes. (4) No: they must operate. (5) No: detective controls identify errors after they occur.

114. A firm tests its continuity plan. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A plan that is never tested is likely to work well in a crisis.   No

2. Staff need no knowledge of the plan.   No

3. Recovery time objectives set the target restoration time.   Yes

4. A business impact analysis identifies critical functions.   Yes

5. Alternative sites may be needed for key functions.   Yes

Correct: N, N, Y, Y, Y difficult Business continuity

(1) No: untested plans often fail. (2) No: staff must be aware. (3) Yes. (4) Yes. (5) Yes.

115. A lender reviews credit risk. Consider the following statements. For each statement, select Yes if it is correct and No if it is not.

Yes/No grid

1. A higher interest rate eliminates default risk.   No

2. Covenants can give early warning of problems.   Yes

3. Credit scoring helps assess borrower quality.   Yes

4. Collateral can reduce loss in default.   Yes

5. Concentration in one borrower cannot affect risk.   No

Correct: N, Y, Y, Y, N difficult Credit risk

(1) No: rates compensate but do not remove it. (2) Yes. (3) Yes. (4) Yes. (5) No: large exposures increase risk.

116. A lending unit earns profit of Tk 120m, expects credit losses of Tk 20m and is assigned economic capital of Tk 400m. The hurdle is 15%. What is the risk-adjusted return on capital, and what is the conclusion?

A) 30% (120 ÷ 400), above the 15% hurdle,
B) 5% (20 ÷ 400), below the 15% hurdle, because RAROC measures only the expected loss relative to capital
C) 20% ((120 − 20) ÷ 500), above the 15% hurdle, because capital includes the expected loss
D) 25% ((120 − 20) ÷ 400), above the 15% hurdle

Correct: D complex Risk-adjusted return

RAROC = (profit − expected loss)/economic capital = 100/400 = 25%. Risk adjustment ensures units that take more risk are compared fairly.

117. A bank funds at 8%. A borrower has a probability of default of 2% and a loss given default of 50%. Operating cost is 1.5% and the capital charge is 1%. What minimum lending rate covers these elements?

A) 12.5% (8% funding + 2% default probability + 1.5% operating cost + 1% capital charge), because the full default probability is added
B) 8.0% (the funding cost), because risk and costs are already included in the funding cost of the bank
C) 11.5% (8% funding + 1% expected loss + 1.5% operating cost + 1% capital charge)
D) 9.0% (8% funding + 1% expected loss), because operating cost and capital charge are paid by the bank's shareholders

Correct: C complex Risk-based loan pricing

Expected loss = 2% × 50% = 1%. Rate = 8 + 1 + 1.5 + 1 = 11.5%. Adding PD instead of expected loss would overprice.

118. A payments team has had 12 processing error events a year with an average loss of Tk 2m each. A control upgrade costing Tk 8m a year is expected to halve the frequency. What is the annual benefit and the conclusion?

A) Expected loss falls from Tk 24m to Tk 12m, a benefit of Tk 12m against a cost of Tk 8m, so the upgrade adds Tk 4m a year before non-financial benefits
B) Expected loss falls from Tk 12m to Tk 6m, a benefit of Tk 6m against a cost of Tk 8m, so the upgrade loses Tk 2m a year
C) Expected loss falls from Tk 24m to Tk 12m, a benefit of Tk 12m against a cost of Tk 8m, so the upgrade loses Tk 4m a year
D) Expected loss falls from Tk 24m to Tk 1m, a benefit of Tk 23m against a cost of Tk 8m, so the upgrade adds Tk 15m a year

Correct: A complex Expected operational loss

Frequency × severity = 12 × 2 = 24m; halving the frequency gives 12m, a saving of 12m. Net benefit = 12 − 8 = 4m.

119. A company has a property policy with a deductible of Tk 2m and a limit of Tk 10m per claim. A fire causes a loss of Tk 15m. How much does the insurer pay, and how much does the company bear?

A) The insurer pays Tk 10m (the loss less the deductible is Tk 13m
B) The insurer pays Tk 15m (the whole loss), because the deductible applies only to losses below the limit
C) The insurer pays Tk 13m (the loss less the deductible), and the company bears only the Tk 2m deductible
D) The insurer pays Tk 8m (the limit less the deductible), and the company bears Tk 7m

Correct: A complex Insurance deductible and limit

Loss after deductible = 15 − 2 = 13; payment is capped at the limit of 10; the company bears 15 − 10 = 5 (deductible 2 plus excess over the limit 3).

120. A garment exporter expects to receive USD 5m from customers in six months and to pay USD 3m to fabric suppliers at the same time. What is the net currency exposure, and what is the advantage of this position?

A) A net exposure of USD 8m, because receipts and payments in the same currency must both be hedged separately
B) A net short position of USD 2m, because payments are always larger than receipts for an exporter
C) A net long position of USD 2m only, because receipts and payments in the same currency offset naturally
D) No exposure at all, because any receipts and payments in a foreign currency cancel in every case

Correct: C complex Natural hedge

Net exposure = 5 − 3 = USD 2m receivable. Matching currency inflows and outflows reduces hedging cost.

121. A bank's internal survey shows that 40% of staff would not report an incident because they fear blame, and near-miss reports have dropped by half in a year. What does this suggest, and what is the most appropriate response?

A) A technical weakness in the reporting software only, which should be fixed without talking to staff about their fears
B) A strengthening risk culture, because fewer reports always mean fewer incidents and better controls throughout the bank
C) No cause for concern, because staff surveys are unreliable and should not be used in risk management
D) A weakening risk culture, where under-reporting hides risks; leadership should encourage no-blame reporting

Correct: D complex Risk culture indicator

A fall in reporting coupled with fear of blame suggests under-reporting. Open reporting is a leading indicator of control health.

122. Which THREE are ways of reducing the likelihood of a risk event? (Select THREE.)

Multiple response
A) Preventive controls
B) Preventive maintenance
C) Buying insurance after a loss has occurred
D) Staff training
E) Waiting for the event and then deciding what to do

Correct: A, B, D difficult Risk mitigation strategies

Controls, training and maintenance lower likelihood. Insurance after the event and waiting do not.

123. Which THREE are features of an operationally resilient bank? (Select THREE.)

Multiple response
A) Mapped critical services and dependencies
B) Tested recovery plans within impact tolerances
C) Single supplier for every critical service
D) Plans documented but never exercised
E) Diversified suppliers for critical services

Correct: A, B, E difficult Features of operational resilience

Resilience involves mapping, testing and diversification. Single suppliers and untested plans reduce resilience.

124. Which THREE are red flags for procurement fraud? (Select THREE.)

Multiple response
A) Competitive tenders with documented evaluation
B) Vendors sharing addresses with employees
C) Rotation of purchasing staff
D) Invoices just below approval limits
E) Repeated awards to one vendor without competition

Correct: B, D, E difficult Sources of fraud risk in procurement

Single sourcing, splitting below limits and conflicts of interest are red flags. Documented tenders and rotation are controls.

125. Which THREE statements about stress testing are correct? (Select THREE.)

Multiple response
A) It predicts the exact date of the next crisis
B) It complements statistical measures such as value at risk
C) It examines the effect of extreme but plausible events
D) It can inform capital and liquidity planning
E) It replaces the need for risk limits

Correct: B, C, D difficult Stress testing

Stress tests explore severe scenarios, supplement VaR and inform buffers. They do not predict dates or replace limits.