CIMA Risk Management (P3) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which objective is concerned with preventing unauthorized data modification?
• Difference between control effectiveness and control efficiency?
• May weaken Kwirtmak's market position, profitability, and innovation capability?
• How should risk capacity influence risk-taking decisions?
• Which risk category is most associated with data security breaches affecting stakeholder confidence?
• Which audit type confirms whether controls are operating effectively?
• What is a Key Risk Indicator (KRI) and how is it used in the risk dashboard?
• What best defines a data breach?
• Which audit type focuses on key strategic, operational, and financial risks?
• Which factor drives risk behavior and is typically measured by surveys, incident rates, governance metrics, and management conduct?
• Give an example of ethical decision-making under risk in a corporate setting.
• Creates operational and strategic risk across global operations?
• Which party is most typically responsible for independent assurance on the data used in sustainability reporting?
• Which audit type assesses the accuracy and validity of financial and operational transactions?
• Which statement best distinguishes governance from management in risk oversight?
• Which of the following risks is mentioned as potentially recorded in the risk register?
• Which objective guards against the improper use of data during processing?
• Which risk type describes the possibility that internal or external events may prevent achieving long-term strategic objectives and competitive advantage?
• Responsible for risk awareness and sustainability across the business?
• What is the purpose of Key Risk Indicators (KRIs) in risk management?
• In the four lines of defense model, which line provides independent assurance?
• Distinguish inherent risk from residual risk and provide an example.
• Which factor increases the risk of unauthorized access during data transfer?
• What is the primary purpose of root cause analysis (RCA) in risk management?
• How should climate risk feature in risk management?
• Which of the following best describes a sign of a mature risk culture?
• Weak cybersecurity controls or employee error could lead to which consequences?
• How can insurance be used as a risk transfer mechanism?
• Which risk describes changes may increase compliance costs and operational complexity?
• In the context of risk management, why is internal audit data validation important for sustainability reporting?
• Helps protect reputation, operational performance, and long-term sustainability?
• Which component is commonly associated with fraud prevention?
• Most directly concerned with testing cyber security through multiple testing types?
• Which audit type evaluates the effectiveness of internal control systems and processes?
• Which risk category exposes Kwirtmak to economic uncertainty?
• Which risk could disrupt international supply chains and manufacturing operations?
• Which combination of measures is described as required for protecting data in global digital operations?
• Which risk category could result from sustainability pressures and regulatory requirements?
• Which risk could affect access to raw materials, suppliers, and global markets?
• Which term describes attacks such as Denial of Service and Buffer Overflow?
• Hot backup site, warm backup site, and cold backup site are examples of what?
• Which category includes ransomware, Trojans, malvertising, and viruses?
• Which risk category could result in catastrophic reputational and legal consequences?
• What is control self-assessment (CSA) and the role of line managers?
• Which of the following is an example of a physical control?
• A system for management to control certain risks and therefore help businesses achieve objectives is known as what?
• What are the five components of the COSO internal control framework?
• The risk of financial loss, disruption, or damage to reputation due to IT system issues?
• The Global Reporting Initiative (GRI) provides guidance on the content of which report, but these are not mandatory?
• Which risk category is most closely associated with potential catastrophic reputational and legal consequences?
• What is the purpose of a risk register and what information does it typically include?
• Which risk category is associated with regulation changes impacting access to raw materials globally?
• What best describes data used in sustainability reporting?
• Which audit type is used to test and confirm the operating effectiveness of internal controls?
• Which audit type reviews adherence to laws, regulations, policies, and procedures?
• Which element is essential when evaluating risk treatment options using cost-benefit analysis?
• How do KRIs differ from KPIs in a risk-reporting context?
• Define tail risk and give an example.
• Represents the risk of dependency on external suppliers across global operations?
• Which outcome is most associated with root cause analysis in risk management?
• Which audit type is described as an independent and objective assurance activity designed to add value and improve organisational operations?
• What does monitoring and reporting of risks entail in ERM?
• Name four major financial risks and a primary mitigation approach for each.
• Which audit type evaluates whether projects achieved expected objectives and benefits?
• What is enterprise risk management (ERM)?
• How should risk management be integrated with strategic planning?
• Name three qualitative risk identification techniques.
• Which audit type assesses efficiency, economy, and effectiveness of operations?
• Which committee should regularly review and monitor the effectiveness of the risk register and associated controls?
• What is a typical outcome of implementing internal controls?
• How should risk information be communicated to the board?
• Which risk category is defined as the possibility that factors arising from operations, environment, or strategic decisions may negatively affect objectives, profitability, and long-term success?
• Which statement best describes hackers in cybersecurity?
• Which measures are required to reduce data breach risk?
• Which of the following is NOT typically a primary source of operational risk?
• During a data breach, which role is tasked with keeping the business functioning and minimizing losses?
• How do incident reporting and near-miss reporting differ, and why are both important?
• Which statement best describes assurance activities within risk management?
• Which audit type would be most appropriate to ensure the organization is achieving value for money in its operations?
• What term describes dishonestly obtaining an advantage, avoiding an obligation or causing a loss to another party?
• Which combination best describes the scope of internal audit in sustainability reporting?
• Which risk management technique evaluates how an organisation would perform under extreme but plausible adverse scenarios?
• Which audit type focuses on the overall management of risk, prioritizing strategic, operational, and financial risks?
• What should a risk appetite statement communicate to the organization?
• What are the four major risk responses and give a brief example of each?
• Which statement best describes climate risk disclosures within risk management?
• Which of the following is NOT a qualitative risk identification technique?
• Supports awareness of cybersecurity, product quality, compliance, and sustainability risks?
• Which risk concerns the possibility that negative events may damage an organisation's reputation, stakeholder trust, and long-term performance?
• Which function is best suited to validate the accuracy and reliability of the data used in sustainability reporting?
• Explain the four lines of defense model and where risk ownership lies.
• What does risk treatment involve?
• What activity should internal audit perform to validate sustainability data?
• Which strategic management technique evaluates how an organization may respond to different possible future events, uncertainties, or business conditions?
• Which objective ensures systems and data are available when needed?
• What is the primary objective of internal audit in sustainability reporting?
• Inherent risk vs residual risk: which statement is true?
• Which risk category may be damaged by cybersecurity breaches or theft of sensitive data?
• The items IT policies and policy management, software updates, configurations, and security products illustrate which category?
• Identify risk areas, understand and assess the scale of risk, develop risk response strategy, implement strategy and allocate responsibilities, implement and monitoring, review and refine process
• What is a probability–impact matrix and how is it used in risk assessment?
• What is a likely impact of customer data breaches on stakeholder relationships?
• What is the role of a risk appetite statement in decision-making?
• Which term describes governance, accountability, protecting important files, monitoring detection, and backup?
• Probability distributions in risk modeling are used to describe what?
• What is the difference between a control objective and a control activity?
• In the COSO framework, which component focuses on the flow of information and communication to support internal control?
• Which components are associated with fraud prevention?
• Which aspect does internal audit primarily validate in sustainability reporting?
• Data security management is concerned with changes that could affect cyber security risks, such as expansion, acquisition, or hardware updates.
• What is the role of data protection measures during transfers?
• What is a risk-adjusted discount rate and how is it used in project appraisal?
• How would you assess risk likelihood and impact for a new project?
• What is the relationship between internal audit and sustainability governance?
• Which outcome most clearly indicates risk if sustainability data is not validated by internal audit?
• Which items are examples of internal control techniques?
• What is assurance mapping and why is it used?
• Which term describes the identification of weaknesses or reasons why controls may not be working?
• Which risk category concerns the possibility that negative events arising from operations or the environment may harm long-term business performance?
• What is the primary role of the risk committee in a typical governance structure?
• Data transfers may increase which types of risks?
• What term refers to the movement of data between systems, locations, organizations, or users?
• Qualitative risk assessment uses what?
• Which area concerns changes such as expansion, acquisition, and hardware updates that could affect cyber security risks?
• List the main steps in the risk management process.
• Is sustainability reporting content governed by mandatory requirements under the GRI guidance?
• How can risk management be linked to performance management?
• Which term describes a decentralised, distributed and public digital ledger used to record transactions across many computers so that the record cannot be altered?
• What measures are essential to protect data during transfer?
• Which risk category relates to potential disruption from geopolitical events affecting supply chains?
• Which control should internal audit examine to validate sustainability data?
• Distinguish risk appetite from risk tolerance in practice.
• Which is a key benefit of internal audit review in sustainability reporting?
• What is a risk heat map and what does it show?
• Increases the risk due to rapid technological change within the additive manufacturing industry?
• What is horizon scanning in risk management and why is it useful?
• What is the COSO objective of safeguarding assets?
• Which audit type would be used to verify that sustainability and environmental requirements are being met?
• Which risk involves political decisions, government actions, regulations, or geopolitical instability that may affect operations or profitability?
• What is the primary purpose of stress testing in liquidity risk management?
• Which risk could result from product quality failures?
• What is the purpose of strong measures such as access controls and encryption in global digital operations?
• To enhance resilience and backup capabilities, which measure is most directly relevant?
• Which outcome best describes the effect of root cause analysis on risk controls?
• Which statement best captures the essence of blockchain as described?
• Which sector's data are noted as potentially at higher risk of unauthorized access?
• Which phase of the CIMA risk management cycle involves deciding how to respond to identified risks?
• How would you structure an ERM framework using ISO 31000 principles?
• What is the purpose of business continuity planning (BCP)?
• Hot backup site, warm backup site, and cold backup site are described as examples of backups.
• What best defines risk appetite creep?
• Which outcome is indicative of effective internal audit involvement in sustainability reporting?
• What is operational risk and what are the main sources?
• Who sets risk policy and appetite in a typical risk governance structure?
• Why is near-miss reporting important in risk management?
• Which audit type reviews sustainability, CSR, and environmental compliance?
• Oversees risk awareness, sustainability, and internal controls across the business?
• Which risk category focuses on the possibility that political decisions or geopolitical instability may affect profitability?
• Which term refers to the identification of weaknesses or reasons why controls may not be working properly?
• Horizon scanning is primarily used to do what in risk management?
• How should emerging risks be identified and monitored?
• Which risk would be implicated if failure to comply creates reputational and legal damage?
• What does the risk appetite process include?
• What governance aspect supports the internal audit's role in sustainability data validation?
• Which practice helps prevent risk appetite creep?
• What is the role of the Risk Reporting System?
• What is the primary purpose of an integrated report?
• Which of the following risks may be recorded in the risk register?
• Differentiate risk appetite from risk capacity?
• In a risk management context, what is the primary use of KRIs?
• Which includes penetration testing, vulnerability testing, access control testing, system resilience and recovery testing?
• What is one of the value-enhancing aspects of ERM?
• What is regulatory risk and how can it be managed?
• Which audit type reviews manufacturing standards, product quality, and operational reliability?
• Which risk is associated with increases in compliance costs due to sustainability and regulatory pressures?
• How does internal audit support risk management?
• A data breach is a security incident where sensitive or confidential information is accessed by an unauthorized person. What is the corresponding response called?
• Which statement best describes substantive testing?
• Which audit type would primarily assess the accuracy of financial data and supporting records?
• Which framework term describes the alignment of risk management with business strategy and embedding a risk management culture into operations?
• Which risk category directly affects external perception and confidence due to data security incidents?
• Which of the following is NOT one of the five components of the COSO internal control framework?
• Theft or exposure of sensitive CAD files may damage what?
• How would you apply a cost–benefit analysis to risk treatments?
• Outline a typical risk governance structure with board, risk committee, and management roles.
• What type of assurance can internal audit provide regarding sustainability data?
• Which body is described as overseeing the organisation's risk management framework and monitoring key strategic risks?
• Explain the relationship between risk culture and risk governance.
• Describes obsolescence due to rapid technological change in the additive manufacturing sector?
• ISO 31000 activity NOT typical in ERM?
• How can cyber risk be managed within an ERM framework?
• Which items are listed as cybersecurity objectives?
• Differentiate scenario planning from stress testing in risk management.
• Which report is designed to explain to stakeholders and providers of financial capital how an organization creates value over time?