Risk Appetite and Risk Tolerance CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A bank has set its risk appetite for credit risk as 'low'. The board has approved a risk tolerance for the retail lending portfolio of a maximum 2% default rate. Due to an economic downturn, the default rate has risen to 3%. The bank's risk management team is concerned about the breach. Which of the following is the most appropriate response?

   • AIncrease the risk tolerance to 3% to reflect the new economic reality.
   • BReview the breach, assess the impact on the overall risk appetite, and consider whether the tolerance needs to be revised given the changed economic conditions.
   • CTreat the breach as a one-time event and take no action.
   • DImmediately reduce lending to bring the default rate back within the tolerance.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has set its risk appetite for market risk as 'moderate' and has established risk tolerances for its investment portfolio. Over the past year, the portfolio has consistently operated at the upper end of the tolerance. The board is concerned about the trend. What should the board do?

   • AMonitor the situation closely and consider whether the risk appetite or tolerances need to be reviewed.
   • BAssume the risk is acceptable since it is within tolerance.
   • CIncrease the risk tolerance to provide more room for the portfolio.
   • DReduce the risk appetite immediately to force the portfolio to take less risk.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How should risk tolerance levels be set for specific risks or business units?

   • AAligned with the overall risk appetite
   • BSet to zero to minimize all risk
   • CBased on the risk appetite of competitors
   • DIndependently of risk appetite to allow flexibility
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can risk appetite and tolerance be integrated into decision-making?

   • ABy including risk appetite criteria in project approval processes
   • BBy using risk appetite only for compliance reporting
   • CBy delegating risk appetite decisions to external auditors
   • DBy ignoring risk appetite in routine decisions
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A logistics company has set its risk appetite for operational disruptions as 'low'. The board has approved a risk tolerance of a maximum of 2% downtime per quarter for the IT systems. In the last quarter, the IT systems experienced 3% downtime due to a cyberattack. What should the company do?

   • AIncrease the risk tolerance to 3% to reflect the new reality of cyber threats.
   • BAccept the breach as a one-time event and take no further action.
   • CBlame the IT department for the breach and require them to work overtime without additional resources.
   • DReview the incident, identify root causes, and implement measures to reduce downtime to within the tolerance.
   Reveal Solution Discussion Select an answer first