CIMA Enterprise Risk Management 1 — Questions and Answers
Question 1: According to CIMA, which of the following best describes 'enterprise risk management' (ERM)?
- A process applied only to financial risks
- A comprehensive framework for identifying, assessing, and managing all risks across an organization (Correct answer)
- An insurance strategy for catastrophic business events
- A regulatory compliance checklist for listed companies
Correct answer: A comprehensive framework for identifying, assessing, and managing all risks across an organization
ERM is a comprehensive, organization-wide framework for identifying, assessing, and managing all categories of risk to support strategic objectives.
Question 2: In risk management, what does a 'risk register' contain?
- A list of insurance policies held by the company
- A record of identified risks, their likelihood, potential impact, and control measures (Correct answer)
- A log of past risk events and their financial impact
- A schedule of compliance and regulatory filings
Correct answer: A record of identified risks, their likelihood, potential impact, and control measures
A risk register records all identified risks along with their likelihood, potential impact, risk owner, and the controls or mitigation strategies in place.
Question 3: Which term describes the level of risk an organization is willing to accept in pursuit of its objectives?
- Risk capacity
- Risk appetite (Correct answer)
- Risk tolerance
- Residual risk
Correct answer: Risk appetite
Risk appetite is the amount of risk an organization is willing to accept in pursuit of its strategic objectives, set by the board.
Question 4: What is 'residual risk'?
- The total risk before any controls are applied
- The risk that remains after controls and mitigation measures have been applied (Correct answer)
- The risk transferred to a third party through insurance
- The risk identified but not yet acted upon
Correct answer: The risk that remains after controls and mitigation measures have been applied
Residual risk is the level of risk remaining after management has implemented controls and mitigation measures to address inherent risks.
Question 5: Which risk response involves an organization choosing not to pursue an activity because the risk is unacceptable?
- Risk reduction
- Risk transfer
- Risk avoidance (Correct answer)
- Risk retention
Correct answer: Risk avoidance
Risk avoidance involves deciding not to proceed with an activity or withdraw from it entirely because the associated risk is too high.
Question 6: In a risk heat map (risk matrix), risks are typically plotted on two dimensions. What are these dimensions?
- Cost and time
- Likelihood and impact (Correct answer)
- Severity and frequency
- Controllability and visibility
Correct answer: Likelihood and impact
A risk heat map plots risks on a matrix with likelihood (probability) on one axis and impact (severity) on the other to prioritize risk management efforts.
CIMA Enterprise Risk Management 1
According to CIMA, which of the following best describes 'enterprise risk management' (ERM)?