P3: Risk Management

• Topic 01

  Risk Management Process and Tools

  53 questions
• Topic 02

  Enterprise Risk

  43 questions
• Topic 03

  Strategic Risk

  45 questions
• Topic 04

  Cyber Risk

  41 questions
• Topic 05

  Internal Controls

  68 questions

A few questions from this unit, with the answer and a full explanation. The complete bank is available when you start practising.

1. A manufacturing company discovers that one of its suppliers has been using child labour in violation of international labour standards. The company's code of conduct prohibits such practices, but there is no immediate legal liability under the company's home jurisdiction. The supplier provides 40% of a critical component and switching suppliers would take 9-12 months. Which risk classification and response strategy is most appropriate?

   • A
     This is primarily a compliance risk (reputational and ethical breach) requiring immediate action to avoid the supplier, despite operational disruption, as it violates stated ethical standards
     Correct answer
   • B
     This is primarily an operational risk requiring a reduce strategy by diversifying suppliers over the 9-12 month transition period
   • C
     This is a strategic risk that should be accepted temporarily while maintaining the supplier relationship and implementing monitoring controls
   • D
     This is a reputational risk only, requiring a communications strategy rather than operational changes
   Explanation

   Although there is no immediate legal liability in the home jurisdiction, this situation represents compliance risk because it violates the company's own ethical code of conduct and international labour standards (such as ILO conventions). Modern enterprise risk management recognizes that compliance extends beyond legal requirements to include ethical obligations and ESG commitments.

   The appropriate response is risk avoidance — terminating the supplier relationship despite significant operational disruption. The reputational damage and stakeholder consequences of continuing the relationship would far exceed the operational costs of switching suppliers. The company's stated commitment creates a binding ethical obligation that must be upheld.

   This question tests understanding of:

   • Compliance risk extending beyond legal requirements to ethical/ESG commitments
   • Risk response prioritization when competing risks conflict (operational vs. compliance)
   • The board's duty to uphold stated values even at operational cost

2. A company has identified three risks: Risk A (high probability, low impact), Risk B (medium probability, medium impact), and Risk C (low probability, high impact). Using a probability-impact matrix, which risk(s) should be prioritized first?

   • A
     Risk A only, because prevention is better than cure
   • B
     Risk A only, because it is most likely to occur
   • C
     Only Risk C, because high impact always takes priority
   • D
     Risk B and Risk C, as they both fall in or near the red zone requiring immediate attention
     Correct answer
   Explanation

   On a probability-impact matrix, risks are prioritized based on their combined score. Risk B (medium/medium) and Risk C (low/high) typically fall in the red or yellow zones requiring attention, while Risk A (high/low) usually falls in the green or yellow zone. High-impact risks like Risk C must be managed even if probability is low, as the consequences could be catastrophic. Risk B represents a balanced threat requiring action. The matrix helps visualize this prioritization quickly.

3. A manufacturing company has established a mature risk management process with quarterly risk assessments, detailed risk registers, and board-level reporting. However, a major supply chain disruption recently occurred that was not on any risk register. The board is reviewing why this risk was missed. Which aspect of risk identification MOST likely failed?

   • A
     The systematic risk identification process was not comprehensive enough to capture emerging external environment risks
     Correct answer
   • B
     The risk response planning failed to establish adequate contingency arrangements
   • C
     The risk assessment methodology used incorrect probability calculations for supply chain events
   • D
     The risk reporting format did not effectively communicate supply chain risks to the board
   Explanation

   This scenario highlights a failure in the risk identification step itself — the risk was never identified and therefore never appeared on the risk register. While the company had mature processes for assessing, responding to, monitoring, and reporting risks, these steps can only address risks that have been identified. The supply chain disruption represents an emerging external risk that should have been captured through comprehensive identification techniques such as horizon scanning, external environment analysis, or scenario planning. This demonstrates why risk identification must be both systematic and comprehensive, covering internal operations, external environment changes, and strategic initiatives.