CPA Bar Quiz: Recommend Risk Mitigation Strategies

What this quiz covers

This quiz focuses on Recommend Risk Mitigation Strategies, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Bar.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. The total amount of risk a company is exposed to across all business activities
2. The level and type of risk an organization is willing to accept in pursuit of its business objectives (correct answer)
3. The financial capacity to absorb losses without impairing operations
4. The minimum return required to justify accepting a given level of risk

Explanation: Risk appetite is a deliberate strategic choice: how much risk, and of what kind, management and the board are prepared to accept in order to achieve business objectives. It guides risk-taking decisions and defines the boundary between acceptable and unacceptable risk levels. Option A describes total risk exposure, a measurement concept. Option C describes risk capacity (ability to absorb losses financially), which is related but distinct from risk appetite (willingness to accept risk). Option D describes a hurdle rate concept, not risk appetite.

Question 2

1. Expected value analysis shows Risk 2 has the highest expected loss ($300,000 vs. Risk 1 at$160,000 and Risk 3 at $200,000); prioritizing by probability alone misallocates risk management resources (correct answer)
2. Risk 1 is correctly prioritized because likelihood is the most important risk dimension
3. All three risks should receive equal resources regardless of expected value
4. Risk 3 should be prioritized because it has the most balanced probability and impact profile

Explanation: Expected values: Risk 1 = 0.80 x $200,000 =$160,000; Risk 2 = 0.20 x $1,500,000 =$300,000; Risk 3 = 0.50 x $400,000 =$200,000. Risk 2 has the highest expected loss despite having the lowest probability. Managing risks by probability alone ignores the severity of potential outcomes. Risk prioritization should use expected value or a heat map combining probability and impact. Option B elevates probability as the sole criterion, which is analytically incorrect. Option C ignores the data entirely. Option D selects Risk 3, which has the second-highest expected value but is not the highest.

Question 3

1. The 50% hedge is optimal and no further action is warranted
2. Refinance the remaining $30,000,000 to fixed rate immediately
3. Increase the swap to 100% of debt to fully eliminate interest rate risk
4. The appropriate hedge ratio depends on management's rate outlook and risk tolerance; a 50% hedge balances downside protection with retention of potential benefit if rates decline, and increasing coverage should depend on whether the $300,000 residual exposure exceeds the company's risk appetite (correct answer)

Explanation: There is no universally correct hedge ratio. A 50% hedge provides meaningful protection while retaining some benefit if rates decline. Whether to increase the hedge ratio depends on: the company's risk appetite for interest cost variability, management's view on the rate outlook, the cost of incremental swap coverage, and whether the $300,000 residual exposure is within the company's acceptable range. Option A treats 50% as definitively optimal without analysis. Option B recommends a specific action without knowing whether the timing or rate is favorable. Option C eliminates all interest rate risk but also eliminates any benefit from potential rate declines, which may be too conservative depending on circumstances.

Question 4

1. Monitoring is appropriate because the probability is below 50%
2. The $40,000,000 impact is too speculative to influence current strategic planning
3. A 35% probability of a $40,000,000 impact represents a$14,000,000 expected loss; monitoring without action is insufficient at this magnitude, and the company should invest in R&D, explore partnerships, or develop a transition strategy (correct answer)
4. Strategic risks are always uncontrollable and monitoring is the only viable response

Explanation: Expected loss = 0.35 x $40,000,000 =$14,000,000. This is a material strategic risk that warrants active management, not passive monitoring. A company that knows with 35% probability that its core product may be obsolete in 5 years has time to act: invest in next-generation product development, acquire or partner with companies developing the disruptive technology, or develop a strategic pivot plan. Waiting until the threat materializes leaves no time to respond. Option A uses a 50% probability threshold with no analytical basis. Option B dismisses a quantified material risk. Option D incorrectly treats strategic risks as inherently unmanageable.

Question 5

1. The level of risk remaining after all applicable controls and mitigations have been applied (correct answer)
2. The total identified risk before any risk management actions are taken
3. The portion of risk that has been transferred to insurers or third parties
4. Risk that has been formally accepted by management as within the company's risk appetite

Explanation: Residual risk is what remains after controls are applied - the risk that cannot be fully eliminated. It is the gap between inherent risk (the starting exposure) and the protection provided by controls. Management evaluates whether residual risk is within the organization's risk appetite. If residual risk exceeds appetite, additional controls are needed. Option B describes inherent risk. Option C describes transferred risk, one component of risk response. Option D describes accepted risk, which may or may not be residual risk - residual risk can be accepted, reduced further, or transferred.

Question 6

1. Address Risks X and Y first; risks exceeding the risk appetite threshold should be prioritized by expected impact, and the two high-impact risks warrant more urgent attention than the medium-impact supply chain risk regardless of operational familiarity (correct answer)
2. Address Risk Z first because management familiarity improves the probability of execution success
3. Address all three risks simultaneously to demonstrate comprehensive risk management
4. Risk X requires immediate external disclosure before any remediation can begin

Explanation: Risk prioritization should be impact-driven, not comfort-driven. Risks X and Y are both rated high impact and exceed the risk appetite threshold; Risk Z is medium impact. Beginning with the highest-impact risks reduces the most significant potential harm to the organization first. Prioritizing Risk Z because it is operationally familiar introduces a cognitive bias (tackling what we know rather than what matters most) that undermines sound risk management. Option B rationalizes a bias. Option C is impractical and may dilute execution quality across all three. Option D conflates risk remediation with disclosure requirements - financial reporting risks may require disclosure, but remediation should proceed regardless.

Question 7

1. The long relationship fully mitigates the concentration risk
2. Relationship longevity does not eliminate concentration risk; if the customer reduces orders, changes suppliers, or faces financial difficulties, the company's revenue base would be severely impaired; active revenue diversification is warranted regardless of relationship quality (correct answer)
3. 52% revenue concentration is typical and requires no specific mitigation
4. Concentration risk only applies when the customer is publicly traded

Explanation: A positive historical relationship is backward-looking evidence that does not protect against forward-looking risk scenarios. Concentration risk is fundamentally a structural vulnerability: if a single event - a customer strategic shift, financial distress, competitive loss, or relationship change - affects the dominant customer, the company faces severe revenue impairment. The fact that this has not happened in 8 years is not a guarantee that it will not happen. Revenue diversification is the structural solution. Options A, C, and D each dismiss a genuine structural risk without analytical basis.

Question 8

1. Self-insure; the average annual loss of $95,000 is far below the$480,000 premium
2. Purchase insurance; premiums are always the economically superior choice
3. Evaluate the financial capacity to absorb tail risk: while average losses favor self-insurance, assess whether a $1,000,000+ event (once in 15 years historically) is survivable without an insurance payout, and whether holding a$3,000,000 reserve represents an acceptable opportunity cost (correct answer)
4. Self-insure only if total losses over 15 years exceed $7,200,000 in premium costs

Explanation: The average annual loss ($95,000) is substantially below the premium ($480,000), suggesting self-insurance appears favorable on average. However, the relevant risk management question is not just the average - it is the tail. Can the company absorb a $1,000,000+ loss without impairing operations? Is tying up$3,000,000 in a reserve an acceptable opportunity cost? Insurance is most valuable for low-probability, high-severity events; if the tail event would be financially catastrophic, the premium represents valuable protection. Option A focuses only on averages, ignoring tail risk. Option B makes an unsupported universal claim. Option D uses a simplistic break-even that does not capture the insurance value of tail protection.

Question 9

1. Annual phishing training is industry-standard and sufficient
2. Purchase cyber insurance as the primary mitigation approach
3. Upgrade only the firewall as the most technically sophisticated control
4. Enhance the phishing program: move to quarterly simulated exercises, implement multi-factor authentication to limit breach impact from compromised credentials, and establish an incident response plan to contain damage from successful attacks (correct answer)

Explanation: An external audit rating the phishing vulnerability as 'high' despite existing controls signals that current measures are inadequate. Annual training is a known weak control - research shows its effectiveness decays within weeks. The recommended approach layers defenses: more frequent, realistic simulated phishing exercises improve awareness; multi-factor authentication ensures that a stolen password alone cannot grant system access; an incident response plan ensures rapid containment when a successful attack occurs. Option A accepts a control rated as inadequate. Option B relies on insurance as a primary mitigation rather than a complement. Option C addresses a different vulnerability than the one identified.

Question 10

1. No action needed; disbursements can be reduced to offset the shortfall
2. Raise equity capital to address the liquidity gap
3. Defer all capital expenditures until after the 90-day period
4. Draw on the revolving credit facility or arrange bridge financing to cover the projected $1,200,000 liquidity gap (correct answer)

Explanation: Ending cash before financing = $800,000 +$12,000,000 - $13,500,000 = -$700,000. Required minimum = $500,000. Shortfall =$500,000 - (-$700,000) =$1,200,000. A revolving credit facility is the appropriate short-term liquidity tool for a temporary cash gap caused by timing differences. Option A is speculative; operational disbursements may not be reducible. Option B (equity issuance) is an extreme and time-consuming solution for a short-term working capital gap. Option C (deferring capex) addresses only capital spending and may not close the full gap if the shortfall is driven by operating disbursements.

Question 11

1. Negotiate a lower price from the existing supplier as compensation for the risk
2. Increase finished goods safety stock to buffer against potential supply disruption
3. Purchase business interruption insurance to cover revenue losses during disruption
4. Qualify at least one additional supplier in a geographically separate region to eliminate single-source dependency (correct answer)

Explanation: The root cause of the concentration risk is single-sourcing from one location. Adding a qualified alternate supplier in a different region directly eliminates the single point of failure. Option A reduces the financial cost of holding the risk but does not eliminate the supply chain vulnerability. Option B reduces the impact of a disruption through inventory buffering but does not address the probability of disruption. Option C (insurance) transfers the financial impact but does not prevent the operational disruption itself - customers still experience shortages even if the company is eventually compensated.

Question 12

1. The hedge was effective because all forecasted revenues were protected
2. Over-hedging creates its own risk: with revenues 30% below forecast, the company must purchase the shortfall in foreign currency at spot rates to fulfill forward contract delivery obligations; future hedges should be sized conservatively to expected revenues (correct answer)
3. Forward contracts should never be used for anticipated revenues because actual volumes are uncertain
4. The revenue shortfall is a strategic matter unrelated to the hedging program

Explanation: When a company hedges based on forecasted amounts and actual volumes fall short, it has sold forward more currency than it will receive from customers. To fulfill the forward contracts, it must purchase the shortfall currency in the spot market - potentially at an unfavorable rate. This over-hedge position creates a new speculative exposure. Best practice is to hedge a conservative percentage of expected revenues (e.g., 70-80%) or use options rather than forwards for uncertain volumes. Option A incorrectly declares the hedge effective when it created a new exposure. Option C overreacts by eliminating a valid hedging approach. Option D incorrectly separates volume risk from hedging program design.

Question 13

1. Invest 100% in equities to maximize long-term returns
2. Move all assets to cash equivalents to eliminate investment risk
3. The 90% equity allocation is appropriate; short-term volatility is normal for pension funds
4. A liability-driven investment strategy that matches asset duration and risk profile to the pension obligation would reduce funding status volatility; the 90% equity concentration creates excessive funding gap risk and should be reduced through diversification into fixed income and liability-matching instruments (correct answer)

Explanation: Pension fund risk management differs from general investment management because the goal is to meet a specific, measurable liability - not to maximize returns. A liability-driven investment (LDI) strategy aligns asset characteristics (duration, interest rate sensitivity, cash flow timing) with the pension obligation, reducing the risk that assets and liabilities diverge in value. A 90% equity allocation creates high funding status volatility because equity values are poorly correlated with pension liability values. A 20% equity decline creating $1,800,000 in asset loss against fixed liabilities can quickly create a funding deficit. Option A ignores liability matching. Option B overcorrects by eliminating growth assets entirely. Option C dismisses a structural asset-liability mismatch.

Question 14

1. Reduce credit exposure by requiring partial prepayment, shorter payment terms, or a letter of credit to limit the concentration and credit quality risk (correct answer)
2. Maintain current terms; credit downgrades are typically temporary
3. Write off the entire $1,750,000 balance as uncollectible
4. Increase the allowance for doubtful accounts at year-end

Explanation: A credit downgrade to below investment grade is an early warning signal of potential default risk. The appropriate proactive response is to reduce the financial exposure before a loss materializes - through prepayment requirements, shortened terms, or a bank letter of credit that substitutes the bank's credit quality for the customer's. Option B ignores a concrete risk signal. Option C is premature; the customer has not yet defaulted, and a write-off without collection efforts destroys value unnecessarily. Option D is an accounting response at period-end, not a risk mitigation action during the period.

Question 15

1. Accept the risk; the maximum fine is unlikely to be fully imposed
2. Invest the $600,000 in compliance; the potential fine far exceeds the mitigation cost, and regulatory compliance is operationally and reputationally necessary (correct answer)
3. Transfer the risk through regulatory liability insurance
4. Avoid the risk by exiting the regulated market

Explanation: The cost-benefit analysis is straightforward: spend $600,000 to eliminate up to$4,000,000 of fine exposure. Even at a 20% probability of the maximum fine, the expected cost of non-compliance ($800,000) exceeds the cost of compliance. Beyond the financial analysis, regulatory compliance is also a strategic and reputational necessity - fines signal to customers, partners, and regulators that the company cannot be trusted with data. Option A underestimates regulatory enforcement. Option C (insurance) is unlikely to cover intentional non-compliance. Option D (exit the market) is a disproportionate response to a solvable compliance problem.

Question 16

1. Maintain fixed-price contracts; they provide revenue certainty to customers
2. Introduce price escalation clauses or shorter contract terms; the 25% input cost increase with no revenue pass-through compressed margins severely, and the same structure perpetuates this exposure if input costs remain volatile (correct answer)
3. Hedge all raw material costs before renewing at fixed prices
4. Renegotiate all existing contracts to variable pricing immediately

Explanation: Three years of evidence shows the fixed-price structure creates significant margin risk when input costs are volatile. The appropriate response is to redesign the contract structure to limit this exposure: price escalation clauses tied to commodity indices allow price adjustments when raw material costs move beyond defined thresholds; shorter contract terms reduce the duration of fixed-price commitment; or minimum pricing floors protect against input cost spikes. Option A perpetuates a structure that produced margin compression without protecting against recurrence. Option C hedging input costs is a complementary tool but does not address the structural contract pricing problem. Option D is operationally disruptive and may not be contractually possible mid-term.

Question 17

1. Implement the system; the $64,800 annual savings from error reduction provides a payback of approximately 3.4 years, with additional non-financial benefits in customer experience (correct answer)
2. Accept the risk; $72,000 of annual loss is immaterial to most organizations
3. Hire additional quality control staff to manually review all orders
4. Transfer the risk by requiring customers to confirm all orders before shipment

Explanation: Annual benefit = 90% x $72,000 =$64,800. Simple payback = $220,000 /$64,800 = 3.4 years. This is a reasonable payback for an operational improvement that also delivers customer experience benefits and reduces reputational risk from shipment errors. Option B dismisses the financial loss without comparing it to the mitigation cost - the $64,800 annual savings exceeds many companies' thresholds for investment returns. Option C (additional manual review) adds ongoing headcount cost without addressing the root cause. Option D shifts risk to customers, which may damage relationships and does not eliminate the company's operational errors.

Question 18

1. Purchase a copper put option
2. Sell copper futures contracts
3. Negotiate fixed-price contracts with customers to offset input price variability
4. Enter long commodity futures contracts to purchase copper at today's price for delivery over the next 12 months (correct answer)

Explanation: Long commodity futures contracts lock in the purchase price for future delivery, providing price certainty for a buyer. As a copper buyer seeking to lock in a favorable price, the company takes long positions - committing to buy at $3.20 across 12 months of delivery dates. Option A (put option) gives the right to sell copper, appropriate for a producer seeking price protection, not a buyer. Option B (selling futures) also represents a producer's hedge. Option C (customer contracts) does not lock in input costs - it passes price risk to customers, which may not be feasible and does not hedge the company's procurement exposure.

Question 19

1. Accept the outages as within the SLA since the guarantee was not technically breached
2. Terminate the vendor contract and rebuild the system in-house
3. Pursue both contractual remedies (enhanced SLA terms, financial credits) and invest in technical redundancy such as failover systems; the $800,000 annual impact warrants investment in resilience beyond vendor contractual commitments alone (correct answer)
4. The risk is fully mitigated once SLA financial credits are received

Explanation: Four 6-hour outages per year equals 24 hours of downtime - approximately 0.27% downtime, which may technically satisfy a 99.5% uptime guarantee. But the business impact ($800,000) is real regardless of contractual compliance. The recommendation has two dimensions: contractual (negotiate enhanced SLA terms, financial penalties, and escalation rights) and technical (implement failover systems, redundant infrastructure, or cloud backup to reduce actual outage frequency and duration). Financial credits compensate but do not prevent future outages. Option A accepts unacceptable business impact because of a contractual technicality. Option B is a drastic response. Option D relies entirely on financial credits, which compensate loss but do not prevent it.

Question 20

1. Buy a EUR/USD call option to protect against adverse rate movements
2. Enter a forward contract to sell €5,000,000 at $1.10 for delivery in 90 days (correct answer)
3. Borrow euros today and invest the proceeds in a money market fund
4. Increase the invoice price to the European customer to absorb potential rate movements

Explanation: A forward contract to sell the expected euros at today's rate in 90 days locks in the USD proceeds regardless of where the exchange rate moves - completely eliminating transaction exposure. Option A (call option) protects against the euro weakening but retains upside if the euro strengthens; it does not eliminate risk. Option C (money market hedge) can replicate a forward but involves borrowing and investment complexity. Option D (price adjustment) does not hedge rate risk but attempts to compensate for it through pricing, which customers may not accept and which does not truly eliminate the exposure.