Quiz CIMAPRA19-P03-1: P3 Risk Management (Online)

COSO’s Enterprise Risk Management framework emphasizes an organization-wide, integrated approach to identifying and managing risk. The correct answers are A, B, and D.
Why A is correct:
The creation of a risk aware culture
COSO ERM promotes embedding risk awareness throughout the organization. Risk management is not just a technical function; it should be part of the organizational culture, supported by leadership and understood by employees.
Why B is correct:
A comprehensive and holistic approach to risk management
COSO ERM is built on the idea that risks should be considered across the whole enterprise, not in isolated departments or silos. This means looking at all types of risks together and understanding how they interact.
Why D is correct:
Consideration of risk management in the context of business strategy
COSO stresses that risk management should be aligned with strategy and objectives. Risks must be assessed when making strategic decisions, so the organization can balance risk and opportunity effectively.
Why C is incorrect:
Risk management is the responsibility of the risk committee
This is too narrow. Under COSO, risk management is the responsibility of the entire organization, including the board, management, and employees. A risk committee may support the process, but it is not solely responsible for ERM.
Why E is incorrect:
Consideration of the main risk only which is financial risk
COSO ERM is not limited to financial risk. It covers a broad range of risks, including strategic, operational, compliance, and reputational risks.
In summary:
COSO ERM principles focus on a culture of risk awareness, a holistic enterprise-wide view, and integration with strategy. Therefore, the correct choices are A, B, and D.

The correct answers are E and F.
Here is why.
K Ltd already knows it has a strategic concern: its range of holidays is too narrow. Before it rushes into new products or markets, it should first understand its current customers and the wider market environment. That is why the best immediate actions are:
E. Review the customer base looking at feedback, repeat sales and single visit statistics.
This helps K Ltd understand who its current customers are, what they value, how loyal they are, and whether the business is dependent on a narrow customer segment. It may reveal whether the company is serving mostly one type of traveller, whether customers return, and what problems or preferences exist. This is essential information before any diversification decision is made.
F. Engage market researchers to look at future trends in holiday requirements.
This helps K Ltd assess what the market is likely to want in the future. Diversification should be based on evidence, not guesswork. Market research can identify growing demand, changing customer preferences, new travel trends, and potential opportunities that fit the business.
Why the other options are not the best immediate actions:
A. Set up a number of activity holidays; adventure, sports and trekking for example.
This is a direct diversification move, but it is premature. K Ltd has not yet investigated whether there is demand for such holidays or whether this fits its capabilities.
B. Bulk book cruise accommodation and create a special package deal for retired couples.
Again, this is a specific diversification into a new segment, but it is an assumption rather than a researched decision. It may be a good idea later, but not immediately.
C. Expand the number of locations it currently serves.
This is an expansion of the existing offer, but it may simply spread the current business more thinly without solving the core issue. K Ltd should first understand its customers and market before deciding where to expand.
D. Re-image the locations it currently serves to make them more exotic and family friendly.
This is a marketing change rather than a strategic review. It might help reposition the business, but it does not first address the need to understand the customer base and future market trends.
In summary, the correct immediate actions are to analyse current customers and research future market demand. That gives K Ltd the evidence it needs to make sensible diversification decisions.
If you want, I can also explain how to spot the difference between strategic analysis actions and diversification actions in exam questions.

The correct answers are C and E.
Here is why each option is correct or incorrect:
A. It is always possible to remove all risks when undertaking large projects.
This is false. Large projects almost always involve some degree of uncertainty, such as technical issues, cost overruns, delays, market changes, or legal problems. Risks can sometimes be reduced or managed, but they cannot always be eliminated completely.
B. If a project has high risks it should always be accepted as the rewards will always be high.
This is false. High risk does not guarantee high reward. Some high-risk projects fail or produce poor returns. A project must be judged by both its possible benefits and the likelihood of success.
C. If a project has low risks it will usually have relatively low returns.
This is correct. In general, lower-risk projects tend to offer lower potential returns because the expected reward is smaller in exchange for the lower uncertainty. This is a common risk-return relationship.
D. Risk can always be transferred to someone else.
This is false. Some risks can be transferred, for example through insurance or outsourcing, but not all risks can be fully transferred. Certain risks remain with the original decision-maker.
E. Risk should be carefully considered when evaluating possible future projects.
This is correct. Risk assessment is an important part of project evaluation because it helps decision-makers compare options, anticipate problems, and choose projects that are suitable and sustainable.
Summary:
The correct statements are C and E because they reflect the typical relationship between risk and return and the importance of risk assessment in project evaluation.

The correct answers are A and D.
The question is about reducing the hospital’s exposure to patient litigation risk. Litigation risk is the risk that patients may claim the hospital was negligent, failed to inform them properly, or did not provide adequate care or records. The best controls are those that improve consent, evidence, and defensibility of care.
Why A is correct:
Ensuring that patients sign documentation confirming that risks have been explained to them and that they understand is a standard informed-consent control.
This helps show that:
- the patient was warned about known risks,
- the hospital communicated clearly,
- the patient agreed to proceed with awareness of those risks.
If a patient later claims they were not informed, this signed documentation can be important evidence in the hospital’s defense.
Why D is correct:
Proper documentation for all patients, including symptoms, treatments, and test results, is essential in managing litigation risk.
Good records:
- support clinical decisions,
- show what treatment was given and why,
- help demonstrate that care was reasonable and timely,
- provide evidence if a complaint or legal claim arises.
In litigation, poor records often weaken the hospital’s position because if it is not documented, it may be assumed not to have happened.
Why the other options are not correct:
B. Allocating a risk score and refusing to admit higher-risk patients is not appropriate
This would be unethical and likely contrary to the hospital’s duty of care, especially in a public health service. Hospitals cannot simply refuse patients because they are higher risk. Managing risk means treating patients safely, not avoiding them.
C. Transferring or discharging critically ill patients to minimise fatalities is not appropriate
This would be unsafe and could itself create serious negligence and legal risks. Critically ill patients should be managed according to clinical need, not moved or discharged simply to reduce the hospital’s apparent mortality figures.
E. Refusing to participate in the Major Accident Plan is not appropriate
A major accident plan is meant to coordinate emergency response. Refusing to participate could expose the hospital to greater operational and legal risk, not less. It would not be a sensible risk management measure.
Conclusion:
The two appropriate steps are:
- A: obtain documented informed consent
- D: maintain proper clinical records
These directly reduce the risk of successful patient litigation by improving evidence, communication, and accountability.

The correct answer is C. Transfer.
A risk map classifies risks by likelihood and impact. In this question, the two risks are described as medium likelihood and high impact. That means:
- The risks are fairly possible, but not certain
- If they happen, the consequences would be serious
The best mitigation for this type of risk is usually to transfer it. Transfer means shifting some or all of the responsibility for the risk to a third party, often through insurance, outsourcing, warranties, or contracts.
Why C is best:
- High-impact risks can be very costly if they occur
- Medium likelihood means the risk is real enough to need action
- Transfer helps reduce the organization’s exposure to financial or operational damage without completely stopping the activity
Why the other options are less suitable:
A. Accept
- Accepting a risk means doing nothing special beyond monitoring it
- This is usually suitable only for low-impact or very unlikely risks
- It is not a good choice for high-impact risks
B. Reduce
- Reducing risk means taking steps to lower the likelihood or impact
- This can be appropriate for many risks
- However, for the specific combination of medium likelihood and high impact, transferring the risk is often the best option when possible, especially in a large industrial setting like an oil refinery
D. Avoid
- Avoiding risk means stopping the activity entirely
- This is only appropriate when the risk is unacceptable and no other solution works
- In a refinery, many risks cannot be avoided because the business activity itself involves them
In summary:
- Medium likelihood + high impact = a serious but not certain risk
- The best mitigation is usually to transfer it to another party
- Therefore, the correct answer is C. Transfer

The correct answers are D, E, and F.
Here is why each option is correct or incorrect:
A. Staff should be penalised for being associated with negative events.
Incorrect. An effective risk management culture encourages openness and reporting of problems, near misses, and incidents. If staff fear punishment, they may hide risks or mistakes, which weakens risk management.
B. All risk should be eliminated.
Incorrect. Risk cannot usually be eliminated entirely in a business. The goal is to identify, assess, and manage risk to an acceptable level, not to remove all risk.
C. Responsibility for risk management should be devolved to a risk manager.
Incorrect. While a risk manager may coordinate the process, risk management should not be left to one person alone. It is everyone’s responsibility, from directors to operational staff.
D. All staff should be aware of risks affecting the entity.
Correct. A good risk culture means employees understand the risks relevant to their work and the organisation as a whole. This helps people act appropriately and report issues early.
E. Risk management should be regarded as part of the overall business strategy.
Correct. Risk management should support decision-making and strategy, not exist as a separate administrative function. It should be integrated into planning, operations, and performance management.
F. The directors should take an active interest in risk management.
Correct. Leadership is essential. If directors are actively involved, they set the tone from the top and show that risk management is important to the organisation.
Summary:
An effective risk management culture is one where risk awareness is shared across the organisation, risk management is integrated into strategy, and directors lead by example.

The correct answers are A, B, and C.
Here is why:
The incident shows that the factory manager responded to a known safety problem in a way that encouraged unsafe behavior. Instead of stopping work until the safety guard was repaired, management punished the operator who refused to take the risk and rewarded the operator who agreed to continue working with defective equipment.
This tells us several important things about the control environment:
A. Management is not particularly concerned with managing risks.
Yes. A strong control environment requires management to take risks seriously and respond appropriately to hazards. Here, management appears to value production over safety, which suggests weak risk awareness and poor risk management.
B. Employees will perceive that management does not care about health and safety risks.
Yes. Employees observe management’s actions, not just its policies. When one worker is suspended for refusing unsafe work and another is rewarded for taking the risk, employees are likely to conclude that safety is not a real priority.
C. This factory's safety record is likely to be poor.
Yes. If unsafe practices are tolerated or encouraged, accidents and incidents become more likely. This kind of culture usually leads to a poor health and safety record.
Why the other options are not correct:
D. Employees are motivated to maintain productivity.
Not the best answer. The bonus shows an attempt to maintain output, but the question is asking about the control environment, especially the attitude toward risk. The main issue is not employee motivation to be productive, but management’s poor safety culture.
E. Management has a proportionate and considered attitude towards risk.
No. A proportionate and considered attitude would mean stopping work, fixing the guard, and only then resuming operations. Rewarding unsafe operation is the opposite of that.
In summary, the incident suggests weak management commitment to risk control, poor perceived concern for health and safety, and a likely poor safety record.

The correct answer is C, D and E.
Here is why each option is right or wrong:
A. The shareholders should not invest because there is still a residual risk.
This is incorrect. All businesses have some level of risk, and investment decisions are based on the overall balance of risk and return, not on the mere existence of any risk. In a mining company, some risk is expected because of the nature of the work. A residual risk does not automatically mean shareholders should avoid investing.
B. The directors are avoiding their responsibilities by saying there is a residual risk.
This is incorrect. Directors are not avoiding responsibility by acknowledging residual risk. In fact, it is part of proper risk management to identify risks, put controls in place, and then explain that some risk still remains. That is a realistic and responsible disclosure, not an attempt to evade responsibility.
C. Some risks cannot be eliminated.
This is correct. In many industries, especially mining, it is impossible to remove all risk completely. Even with training, compliance, and safety systems, accidents and injuries may still occur. The best management can often do is reduce the risk to an acceptable level.
D. Accepting a residual risk does not imply the company is reckless.
This is correct. Recognising that some risk remains after controls have been applied is not the same as being careless or reckless. Recklessness would suggest ignoring risks or failing to take reasonable precautions. Here, the company has staff training and complies with health and safety regulations, which shows it is taking reasonable steps.
E. Most companies in this industry will say something similar in their risk report.
This is correct. Because mining is inherently hazardous, other companies in the same industry would likely disclose similar residual risks in their reports. It is normal for risk statements in high-risk industries to acknowledge that some dangers remain even after control measures.
Summary:
The statement is describing a realistic approach to risk management. The company has controls in place, but because it operates in a dangerous industry, some risk cannot be completely removed. Therefore, C, D and E are correct.

The correct answer is D.
Here is why:
N is asking you to postpone recording purchase invoices so that profit margin appears better in the current quarter. This would mean intentionally manipulating the timing of accounting entries to influence reported results. Even if no law has yet been broken, this would be improper and inconsistent with professional ethics, because it would misstate the financial position and performance of P Ltd.
As a Senior Management Accountant, your responsibility is not only to help the business perform well, but also to act with integrity, objectivity, and professional competence. You must not agree to anything that would create misleading financial information.
Why D is best:
- It directly refuses the request to delay recording invoices.
- It makes clear that N must follow professional codes and ethical standards.
- It protects the accuracy and reliability of the accounts.
- It addresses the issue immediately rather than passively recording it for later.
Why the other options are not as good:
- A. Collect all the facts, distance yourself from the situation but say nothing.
This is too passive. You would be failing to challenge an unethical request.
- B. Write up the facts of the issue and put it on your files.
Documentation may be useful, but doing only this does not address the problem or prevent the wrongdoing.
- C. Document the situation and present the facts to your manager.
Escalation may be appropriate if the issue continues, but first you should tell N that you cannot comply and explain why.
Since the question asks what you should do, the best immediate action is to refuse and remind him of the ethical rules.
In summary:
N is asking for an unethical accounting adjustment. You should not comply. The proper response is to tell him clearly that you cannot do this and that he must abide by the professional codes.