- A company uses 3-year fixed-price contracts with customers. Raw materials represent 70% of costs and increased 25% over the past 3 years while contract prices were fixed. Management proposes the same structure for the next cycle. Which risk management recommendation is most appropriate?
Answer: Introduce price escalation clauses or shorter contract terms; the 25% input cost increase with no revenue pass-through compressed margins severely, and the same structure perpetuates this exposure if input costs remain volatile
Three years of evidence shows the fixed-price structure creates significant margin risk when input costs are volatile. The appropriate response is to redesign the contract structure to limit this exposure: price escalation clauses tied to commodity indices allow price adjustments when raw material costs move beyond defined thresholds; shorter contract terms reduce the duration of fixed-price commitment; or minimum pricing floors protect against input cost spikes. Option A perpetuates a structure that produced margin compression without protecting against recurrence. Option C hedging input costs is a complementary tool but does not address the structural contract pricing problem. Option D is operationally disruptive and may not be contractually possible mid-term.
- In enterprise risk management, 'risk appetite' refers to which of the following?
Answer: The level and type of risk an organization is willing to accept in pursuit of its business objectives
Risk appetite is a deliberate strategic choice: how much risk, and of what kind, management and the board are prepared to accept in order to achieve business objectives. It guides risk-taking decisions and defines the boundary between acceptable and unacceptable risk levels. Option A describes total risk exposure, a measurement concept. Option C describes risk capacity (ability to absorb losses financially), which is related but distinct from risk appetite (willingness to accept risk). Option D describes a hurdle rate concept, not risk appetite.
- A company is evaluating self-insurance versus property insurance ($480,000 annual premium). Self-insurance requires a $3,000,000 reserve. Historical annual losses average $95,000, with one loss exceeding $1,000,000 over 15 years. Which analysis is most relevant to this decision?
Answer: Evaluate the financial capacity to absorb tail risk: while average losses favor self-insurance, assess whether a $1,000,000+ event (once in 15 years historically) is survivable without an insurance payout, and whether holding a $3,000,000 reserve represents an acceptable opportunity cost
The average annual loss ($95,000) is substantially below the premium ($480,000), suggesting self-insurance appears favorable on average. However, the relevant risk management question is not just the average - it is the tail. Can the company absorb a $1,000,000+ loss without impairing operations? Is tying up $3,000,000 in a reserve an acceptable opportunity cost? Insurance is most valuable for low-probability, high-severity events; if the tail event would be financially catastrophic, the premium represents valuable protection. Option A focuses only on averages, ignoring tail risk. Option B makes an unsupported universal claim. Option D uses a simplistic break-even that does not capture the insurance value of tail protection.
- A pension fund has $10,000,000 in liabilities and invests 90% of assets in equities. A 20% equity market decline would reduce assets by approximately $1,800,000. Which risk mitigation recommendation is most appropriate?
Answer: A liability-driven investment strategy that matches asset duration and risk profile to the pension obligation would reduce funding status volatility; the 90% equity concentration creates excessive funding gap risk and should be reduced through diversification into fixed income and liability-matching instruments
Pension fund risk management differs from general investment management because the goal is to meet a specific, measurable liability - not to maximize returns. A liability-driven investment (LDI) strategy aligns asset characteristics (duration, interest rate sensitivity, cash flow timing) with the pension obligation, reducing the risk that assets and liabilities diverge in value. A 90% equity allocation creates high funding status volatility because equity values are poorly correlated with pension liability values. A 20% equity decline creating $1,800,000 in asset loss against fixed liabilities can quickly create a funding deficit. Option A ignores liability matching. Option B overcorrects by eliminating growth assets entirely. Option C dismisses a structural asset-liability mismatch.
- In risk management, 'residual risk' is defined as:
Answer: The level of risk remaining after all applicable controls and mitigations have been applied
Residual risk is what remains after controls are applied - the risk that cannot be fully eliminated. It is the gap between inherent risk (the starting exposure) and the protection provided by controls. Management evaluates whether residual risk is within the organization's risk appetite. If residual risk exceeds appetite, additional controls are needed. Option B describes inherent risk. Option C describes transferred risk, one component of risk response. Option D describes accepted risk, which may or may not be residual risk - residual risk can be accepted, reduced further, or transferred.
- An ERM assessment identifies a strategic risk: a new technology may render the company's core product obsolete within 5 years (35% probability, $40,000,000 revenue impact). The current response is annual monitoring. Which assessment is most analytically sound?
Answer: A 35% probability of a $40,000,000 impact represents a $14,000,000 expected loss; monitoring without action is insufficient at this magnitude, and the company should invest in R&D, explore partnerships, or develop a transition strategy
Expected loss = 0.35 x $40,000,000 = $14,000,000. This is a material strategic risk that warrants active management, not passive monitoring. A company that knows with 35% probability that its core product may be obsolete in 5 years has time to act: invest in next-generation product development, acquire or partner with companies developing the disruptive technology, or develop a strategic pivot plan. Waiting until the threat materializes leaves no time to respond. Option A uses a 50% probability threshold with no analytical basis. Option B dismisses a quantified material risk. Option D incorrectly treats strategic risks as inherently unmanageable.
- A single customer represents 35% of total accounts receivable ($1,750,000). The customer was recently downgraded to below investment grade. Which immediate risk mitigation action is most appropriate?
Answer: Reduce credit exposure by requiring partial prepayment, shorter payment terms, or a letter of credit to limit the concentration and credit quality risk
A credit downgrade to below investment grade is an early warning signal of potential default risk. The appropriate proactive response is to reduce the financial exposure before a loss materializes - through prepayment requirements, shortened terms, or a bank letter of credit that substitutes the bank's credit quality for the customer's. Option B ignores a concrete risk signal. Option C is premature; the customer has not yet defaulted, and a write-off without collection efforts destroys value unnecessarily. Option D is an accounting response at period-end, not a risk mitigation action during the period.
- A company purchases $6,000,000 of copper annually (30% of COGS). Copper prices have ranged from $3.20 to $4.80 per pound over the past 12 months. Management wants to lock in current prices at $3.20 for the next 12 months. Which instrument accomplishes this?
Answer: Enter long commodity futures contracts to purchase copper at today's price for delivery over the next 12 months
Long commodity futures contracts lock in the purchase price for future delivery, providing price certainty for a buyer. As a copper buyer seeking to lock in a favorable price, the company takes long positions - committing to buy at $3.20 across 12 months of delivery dates. Option A (put option) gives the right to sell copper, appropriate for a producer seeking price protection, not a buyer. Option B (selling futures) also represents a producer's hedge. Option C (customer contracts) does not lock in input costs - it passes price risk to customers, which may not be feasible and does not hedge the company's procurement exposure.
- A data center has no backup power generator. An outage would cost $540,000 in lost revenue and recovery costs. Outages occur approximately once every 4 years. A backup generator costs $85,000. What is the recommended risk response?
Answer: Install the generator; the expected annual benefit ($135,000) substantially exceeds the annualized generator cost
Expected annual loss = $540,000 / 4 years = $135,000. The generator costs $85,000 installed (a one-time cost), with additional annual maintenance. Even annualizing the $85,000 investment over a 10-year life ($8,500/year) plus maintenance, the expected annual benefit of $135,000 far exceeds the cost. Option A accepts a quantified, preventable loss without analysis. Option B (insurance only) transfers the financial impact but does not prevent the operational disruption. Option D (dual data centers) would exceed the $85,000 mitigation cost and is disproportionate to this specific risk.
- An annual risk assessment identifies three risks exceeding the stated risk appetite: Risk X (financial reporting, high impact), Risk Y (IT security, high impact), Risk Z (supply chain, medium impact). Management proposes addressing Risk Z first because of operational familiarity. Which recommendation is most analytically appropriate?
Answer: Address Risks X and Y first; risks exceeding the risk appetite threshold should be prioritized by expected impact, and the two high-impact risks warrant more urgent attention than the medium-impact supply chain risk regardless of operational familiarity
Risk prioritization should be impact-driven, not comfort-driven. Risks X and Y are both rated high impact and exceed the risk appetite threshold; Risk Z is medium impact. Beginning with the highest-impact risks reduces the most significant potential harm to the organization first. Prioritizing Risk Z because it is operationally familiar introduces a cognitive bias (tackling what we know rather than what matters most) that undermines sound risk management. Option B rationalizes a bias. Option C is impractical and may dilute execution quality across all three. Option D conflates risk remediation with disclosure requirements - financial reporting risks may require disclosure, but remediation should proceed regardless.
- A compliance assessment identifies that failure to meet new data privacy regulations in 6 months could result in fines up to $4,000,000. Achieving compliance costs $600,000. Which risk response is most appropriate?
Answer: Invest the $600,000 in compliance; the potential fine far exceeds the mitigation cost, and regulatory compliance is operationally and reputationally necessary
The cost-benefit analysis is straightforward: spend $600,000 to eliminate up to $4,000,000 of fine exposure. Even at a 20% probability of the maximum fine, the expected cost of non-compliance ($800,000) exceeds the cost of compliance. Beyond the financial analysis, regulatory compliance is also a strategic and reputational necessity - fines signal to customers, partners, and regulators that the company cannot be trusted with data. Option A underestimates regulatory enforcement. Option C (insurance) is unlikely to cover intentional non-compliance. Option D (exit the market) is a disproportionate response to a solvable compliance problem.
- One customer accounts for 52% of a company's total revenue. Management argues this concentration is acceptable given the 8-year relationship with no payment issues. Which risk assessment is most analytically sound?
Answer: Relationship longevity does not eliminate concentration risk; if the customer reduces orders, changes suppliers, or faces financial difficulties, the company's revenue base would be severely impaired; active revenue diversification is warranted regardless of relationship quality
A positive historical relationship is backward-looking evidence that does not protect against forward-looking risk scenarios. Concentration risk is fundamentally a structural vulnerability: if a single event - a customer strategic shift, financial distress, competitive loss, or relationship change - affects the dominant customer, the company faces severe revenue impairment. The fact that this has not happened in 8 years is not a guarantee that it will not happen. Revenue diversification is the structural solution. Options A, C, and D each dismiss a genuine structural risk without analytical basis.
- A company expects to receive €5,000,000 from a European customer in 90 days. The current EUR/USD rate is $1.10. Management wants to fully eliminate foreign exchange risk. Which instrument accomplishes this most directly?
Answer: Enter a forward contract to sell €5,000,000 at $1.10 for delivery in 90 days
A forward contract to sell the expected euros at today's rate in 90 days locks in the USD proceeds regardless of where the exchange rate moves - completely eliminating transaction exposure. Option A (call option) protects against the euro weakening but retains upside if the euro strengthens; it does not eliminate risk. Option C (money market hedge) can replicate a forward but involves borrowing and investment complexity. Option D (price adjustment) does not hedge rate risk but attempts to compensate for it through pricing, which customers may not accept and which does not truly eliminate the exposure.
- A company has $50,000,000 of variable-rate debt at Term SOFR + 1.5% (currently 6% effective rate). Management wants to eliminate interest rate variability. Which strategy accomplishes this?
Answer: Enter an interest rate swap to pay fixed and receive floating, converting the debt to a fixed rate
An interest rate swap where the company pays a fixed rate and receives floating converts the variable-rate debt to a synthetically fixed rate. The floating payments received from the swap offset the variable interest paid on the debt, resulting in a net fixed cost. Option A replaces one variable-rate obligation with another. Option B reduces the debt balance but leaves the remaining debt at a variable rate. Option D (a cap) limits maximum interest costs but does not eliminate variability - rates can still fluctuate up to the cap level, and the cap premium adds cost.
- The four primary risk responses in enterprise risk management are:
Answer: Avoid, reduce (mitigate), share (transfer), and accept - representing the strategic options available for responding to identified risks
The four risk responses form the foundation of ERM decision-making: Avoid (exit the activity that creates the risk), Reduce/Mitigate (implement controls to lower probability or impact), Share/Transfer (use insurance, hedging, or contracts to shift risk to another party), and Accept (acknowledge the risk and choose not to act, typically when risk is within appetite or mitigation cost exceeds benefit). Option B describes the risk management process cycle. Option C describes risk categories. Option D describes risk assessment dimensions.
- A manufacturer relies on a single supplier for a critical component, produced in one factory in a hurricane-prone region. Which action most directly addresses this supply chain concentration risk?
Answer: Qualify at least one additional supplier in a geographically separate region to eliminate single-source dependency
The root cause of the concentration risk is single-sourcing from one location. Adding a qualified alternate supplier in a different region directly eliminates the single point of failure. Option A reduces the financial cost of holding the risk but does not eliminate the supply chain vulnerability. Option B reduces the impact of a disruption through inventory buffering but does not address the probability of disruption. Option C (insurance) transfers the financial impact but does not prevent the operational disruption itself - customers still experience shortages even if the company is eventually compensated.
- A company has $8,000,000 of unhedged foreign revenue spread across Brazilian real (40%), South African rand (35%), and Indian rupee (25%). Which strategy most effectively creates a natural hedge?
Answer: Increase sourcing of production inputs denominated in the same three currencies to create matching payables that offset the foreign currency receivables
A natural hedge pairs foreign currency inflows with matching foreign currency outflows, so that the same currency exposure exists on both sides and changes in exchange rates affect both simultaneously. By sourcing inputs in the same currencies as the revenue, the company creates natural offsets without financial instruments. Option B eliminates foreign currency holdings but does not reduce exposure timing risk. Option C delays but does not reduce exposure. Option D (USD invoicing) shifts the FX risk to the customer, which may be contractually or competitively impractical.
- A 90-day cash forecast shows: beginning balance $800,000, projected collections $12,000,000, projected disbursements $13,500,000. Minimum required balance is $500,000. What is the projected shortfall and recommended mitigation?
Answer: Draw on the revolving credit facility or arrange bridge financing to cover the projected $1,200,000 liquidity gap
Ending cash before financing = $800,000 + $12,000,000 - $13,500,000 = -$700,000. Required minimum = $500,000. Shortfall = $500,000 - (-$700,000) = $1,200,000. A revolving credit facility is the appropriate short-term liquidity tool for a temporary cash gap caused by timing differences. Option A is speculative; operational disbursements may not be reducible. Option B (equity issuance) is an extreme and time-consuming solution for a short-term working capital gap. Option C (deferring capex) addresses only capital spending and may not close the full gap if the shortfall is driven by operating disbursements.
- A company hedges 100% of its forecasted foreign currency revenues with forward contracts. Actual revenues come in 30% below forecast due to weaker demand. Which risk management concern does this situation reveal?
Answer: Over-hedging creates its own risk: with revenues 30% below forecast, the company must purchase the shortfall in foreign currency at spot rates to fulfill forward contract delivery obligations; future hedges should be sized conservatively to expected revenues
When a company hedges based on forecasted amounts and actual volumes fall short, it has sold forward more currency than it will receive from customers. To fulfill the forward contracts, it must purchase the shortfall currency in the spot market - potentially at an unfavorable rate. This over-hedge position creates a new speculative exposure. Best practice is to hedge a conservative percentage of expected revenues (e.g., 70-80%) or use options rather than forwards for uncertain volumes. Option A incorrectly declares the hedge effective when it created a new exposure. Option C overreacts by eliminating a valid hedging approach. Option D incorrectly separates volume risk from hedging program design.
- Industry data shows 60% of breaches result from phishing attacks. A company has annual phishing training, endpoint security, and a firewall. An external audit still rates phishing vulnerability as 'high.' Which risk mitigation recommendation is most appropriate?
Answer: Enhance the phishing program: move to quarterly simulated exercises, implement multi-factor authentication to limit breach impact from compromised credentials, and establish an incident response plan to contain damage from successful attacks
An external audit rating the phishing vulnerability as 'high' despite existing controls signals that current measures are inadequate. Annual training is a known weak control - research shows its effectiveness decays within weeks. The recommended approach layers defenses: more frequent, realistic simulated phishing exercises improve awareness; multi-factor authentication ensures that a stolen password alone cannot grant system access; an incident response plan ensures rapid containment when a successful attack occurs. Option A accepts a control rated as inadequate. Option B relies on insurance as a primary mitigation rather than a complement. Option C addresses a different vulnerability than the one identified.
