Try 10 focused CISI Risk questions on International Risk Regulation, with answers and explanations, then continue with Securities Prep.
| Field | Detail |
|---|---|
| Exam route | CISI Risk |
| Issuer | CISI |
| Topic area | International Risk Regulation |
| Blueprint weight | 7% |
| Page purpose | Focused sample questions before returning to mixed practice |
Use this page to isolate International Risk Regulation for CISI Risk. Work through the 10 questions first, then review the explanations and return to mixed practice in Securities Prep.
| Pass | What to do | What to record |
|---|---|---|
| First attempt | Answer without checking the explanation first. | The fact, rule, calculation, or judgment point that controlled your answer. |
| Review | Read the explanation even when you were correct. | Why the best answer is stronger than the closest distractor. |
| Repair | Repeat only missed or uncertain items after a short break. | The pattern behind misses, not the answer letter. |
| Transfer | Return to mixed practice once the topic feels stable. | Whether the same skill holds up when the topic is no longer obvious. |
Blueprint context: 7% of the practice outline. A focused topic score can overstate readiness if you recognize the pattern too quickly, so use it as repair work before timed mixed sets.
These questions are original Securities Prep practice items aligned to this topic area. They are designed for self-assessment and are not official exam questions.
Topic: International Risk Regulation
A mid-sized investment firm has expanded rapidly into leveraged FX products. It relies on a single margin model, several trading-limit breaches were not escalated promptly, and board risk packs were late for two quarters. The prudential regulator schedules a risk-assessment visit and requests board minutes, stress-test results and breach logs. What should senior management expect from this visit?
Best answer: D
What this tests: International Risk Regulation
Explanation: A risk-based regulatory visit targets the areas of greatest supervisory concern rather than reviewing everything equally or checking only one metric. Here, rapid growth, model dependence, weak escalation and delayed board reporting all point to a focused review of risk management, governance and controls.
The core concept is risk-based supervision: regulators direct attention to the risks that matter most and assess whether the firm’s governance and control framework is strong enough for those risks. In this scenario, leveraged FX activity increases inherent risk, reliance on one margin model raises model risk, unescalated limit breaches suggest weak control discipline, and late board packs indicate governance weakness. A risk-assessment visit would therefore use documents, management discussions and challenge testing to judge control effectiveness and decide whether the firm needs closer supervision or remedial action. It is broader than a simple capital compliance check and is not a forum for approving business strategy.
Risk-based visits focus on the firm’s most material risks and the adequacy of governance and controls, informing supervisory intensity and any remedial action.
Topic: International Risk Regulation
A retail investment firm sells a structured income bond to retail clients. Sales bonuses depend only on volume, monitoring shows repeated failures to explain the capital-at-risk feature, and complaints have risen sharply. The firm’s capital and liquidity remain above regulatory requirements. What is the single best regulatory response?
Best answer: A
What this tests: International Risk Regulation
Explanation: The key issue is likely harm to retail clients, not a shortfall in prudential resources. Where disclosure, suitability, and product governance are weak and complaints are rising, the best response is to review customer outcomes and tighten conduct controls.
This scenario mainly engages the conduct side of the regulatory framework, especially consumer protection. The decisive facts are that retail clients are involved, the capital-at-risk feature is not being explained properly, incentives reward sales volume, and complaints are increasing. Those facts point to unsuitable or poorly understood sales and therefore a risk of unfair customer outcomes. Because the stem states that capital and liquidity remain above regulatory requirements, prudential or liquidity remediation is not the immediate priority. The strongest response is to review product governance, disclosures, suitability, monitoring, and sales incentives, and then remediate customers if necessary. Treating the issue only as an internal business-standards weakness is too narrow because customer harm is already evident.
The facts show foreseeable customer harm from weak sales and product controls, so the primary response should address consumer protection and conduct risk.
Topic: International Risk Regulation
A regulator uses a risk-based approach to target supervisory resources at firms posing the greatest threat to its objectives. For upcoming on-site risk-assessment visits, it ranks firms by:
Priority score = impact score × residual risk score
| Firm | Impact | Residual risk |
|---|---|---|
| Northbank | 5 | 2 |
| Meridian | 4 | 4 |
| Harbour | 3 | 5 |
| Cedar | 2 | 4 |
Which firm should be reviewed first?
Best answer: C
What this tests: International Risk Regulation
Explanation: Risk-based regulatory reviews prioritise firms where the combination of impact and residual risk is greatest, not those with the highest score on only one factor. Meridian has the highest combined score of 16, so it would receive the earliest risk-assessment visit.
The purpose of a risk-based review is to direct limited supervisory attention to the firms that present the greatest overall threat to regulatory objectives. In this process, the regulator combines the firm’s impact with its residual risk and then ranks firms for review.
Meridian has the highest priority score, so it should be reviewed first. The key distinction is that regulators do not focus only on size or only on riskiness; they prioritise the strongest combination of potential impact and remaining unmanaged risk.
Its priority score is 4 × 4 = 16, the highest, so a risk-based review would target it first.
Topic: International Risk Regulation
A supervisor finds that a bank’s quarterly capital adequacy return misstated risk-weighted assets because data from the credit system were not reconciled to the general ledger before submission. Which option correctly matches the regulatory-risk issue with the firm-level control issue?
Best answer: D
What this tests: International Risk Regulation
Explanation: The regulatory-risk issue is the inaccurate capital adequacy return submitted to the supervisor. The firm-level control issue is the failed reconciliation between internal data sources before submission.
This scenario combines an external regulatory obligation with an internal control failure. The regulatory-risk issue is inaccurate prudential reporting, because the bank sent a misstated capital adequacy return to its supervisor. The firm-level control issue is weak source-data reconciliation, because data from the credit system were not checked against the general ledger before the return was filed. Reconciliation is an internal control designed by the firm to support complete and accurate reporting; it is not the regulatory issue itself, but the weakness that led to it. The key distinction is between the breach of an external reporting requirement and the internal process failure that caused that breach.
The supervisor-facing issue is the misstated return, and the unreconciled system data are the internal control weakness that caused it.
Topic: International Risk Regulation
Under Basel sound-practice principles, an effective risk appetite framework should be:
Best answer: D
What this tests: International Risk Regulation
Explanation: Basel sound-practice principles require risk appetite to be more than a policy statement. It should be approved by the board and embedded in day-to-day management through limits, controls, and reporting so exposures can be monitored and challenged.
Basel sound-practice principles treat risk appetite as a governance tool that must be implemented across the firm, not merely documented. The board approves the appetite, senior management converts it into operational limits and control thresholds, and systems produce management information to monitor exposures and escalate breaches. This links governance, systems, controls, and reporting in a practical framework.
A framework is weak if it sits only with the risk function, relies only on regulatory capital metrics, or is detached from business strategy. Basel expects risk appetite to guide decision-making across the organisation. The closest distractor is risk-function ownership: the second line supports and challenges, but it does not replace board oversight and business implementation.
Basel expects risk appetite to be governed by the board and embedded through measurable limits, control processes, and timely management reporting.
Topic: International Risk Regulation
A wealth manager sells higher-risk bond funds to retail clients. Its monthly suitability-exception report has not been reviewed for three months after a staff departure. The regulator then launches a sector review of higher-risk product sales and asks the board to attest within 10 days that client risk profiling is operating effectively. What is the single best assessment of these two issues?
Best answer: C
What this tests: International Risk Regulation
Explanation: Regulatory risk is exposure to supervisory challenge, sanction, or remediation for failing external requirements. Here, that is signalled by the regulator’s sector review and request for a board attestation, while the missed suitability report review is a firm-level control weakness that may contribute to the regulatory problem.
The key distinction is between an external regulatory exposure and an internal control breakdown. The sector review and board attestation request point to regulatory risk because the firm may be unable to demonstrate compliance with conduct and suitability expectations, which could lead to supervisory intervention or remediation. By contrast, the unreviewed suitability-exception report is a firm-level control issue: a monitoring process has failed after a staff departure. That control weakness matters because it can allow unsuitable sales to go undetected, but it is not itself the regulatory category. In practice, the control failure can be a cause of regulatory risk, while the regulatory risk is the potential breach and supervisory consequence. The closest distractor confuses the internal cause with the external regulatory exposure.
Regulatory risk arises from possible breach and supervisory action, while the unreviewed exception report is an internal monitoring failure.
Topic: International Risk Regulation
Under the Basel framework, minimum Pillar 1 capital adequacy is primarily calculated against which three broad risk categories?
Best answer: D
What this tests: International Risk Regulation
Explanation: Basel’s minimum capital framework centres on three core Pillar 1 risks: credit, market and operational risk. These are the main categories used to calculate regulatory capital adequacy, while liquidity and reputational risks are important but handled elsewhere in the wider risk framework.
The Basel framework, developed through the BIS Basel Committee, sets minimum capital requirements by linking regulatory capital to a bank’s exposure to credit risk, market risk and operational risk. Credit risk covers losses from borrower or counterparty default. Market risk covers adverse movements in prices, interest rates, foreign exchange or similar market factors. Operational risk covers losses arising from failed processes, people, systems or external events.
Liquidity risk is a major concern for banks, but Basel generally addresses it through liquidity standards and supervisory expectations rather than as one of the three main Pillar 1 capital drivers. Reputational risk may be serious in practice, but it is not a core minimum-capital category. The key distinction is between capital adequacy drivers and other important risks managed through broader oversight.
Basel Pillar 1 links minimum regulatory capital mainly to credit, market and operational risk exposures.
Topic: International Risk Regulation
A wealth manager must segregate all client money daily. At close of business, client ledger balances total £6.40 million and the segregated client money account contains £6.28 million. The firm still meets its own capital and liquidity requirements. Which statement is most accurate?
Best answer: A
What this tests: International Risk Regulation
Explanation: The shortfall is £120,000 because required client money of £6.40 million exceeds segregated money of £6.28 million. Since the firm still meets its own capital and liquidity requirements, the primary regulatory issue is protection of client assets rather than prudential soundness.
This tests the distinction between consumer protection and prudential regulation. The calculation is simple: £6.40 million of client money should be segregated, but only £6.28 million has been set aside, leaving a £120,000 shortfall. Client money rules are mainly designed to protect customers by keeping their assets separate from the firm’s own resources and available for return if the firm gets into difficulty.
Poor reconciliations and controls may also indicate weak business standards, but the stem explicitly says the firm still satisfies its own capital and liquidity requirements. That removes prudential adequacy as the main issue here. The key point is that under-segregation exposes clients, so the primary regulatory concern is consumer protection.
£6.40 million minus £6.28 million gives a £120,000 client money shortfall, directly affecting protection of client assets.
Topic: International Risk Regulation
A national regulator is reviewing banks in a market where many households earn in local currency but borrow in foreign currency. All major banks still meet Basel minimum capital standards.
Exhibit:
Which supervisory response is most appropriate?
Best answer: D
What this tests: International Risk Regulation
Explanation: After the 20% depreciation, the average mortgage payment rises to 900 and the payment-to-income ratio becomes 36%. Because this is above the regulator’s 35% trigger, the national regulator should impose a local supervisory measure aimed at foreign-currency mortgage risk.
National regulators are responsible for applying supervisory measures when a vulnerability is specific to their own market, even if firms still meet Basel minimum standards. Here, the country-specific risk is that borrowers earn in local currency but repay in foreign currency, so a depreciation increases repayment strain and therefore local credit risk.
That supports tightening local underwriting or lending restrictions on new FX mortgages. The key point is that national supervisors should act on domestic vulnerabilities rather than wait for global standards to be amended.
The stressed payment is 750 × 1.20 = 900, so payment-to-income is 900 / 2,500 = 36%, above the 35% trigger for local supervisory action.
Topic: International Risk Regulation
A bank standardises risk-data definitions across subsidiaries, assigns clear data ownership, adds automated reconciliations, and can produce ad hoc group exposure reports for the board during stress. Under Basel sound-practice principles, which capability is this primarily implementing?
Best answer: B
What this tests: International Risk Regulation
Explanation: This setup is about producing accurate, comprehensive and timely risk information for decision-makers, especially during stress. Common definitions, clear ownership, reconciliation controls and rapid ad hoc reporting are core Basel sound-practice features of risk data aggregation and reporting.
Basel sound-practice principles expect firms to have governance, systems and controls that can aggregate risk data across entities and deliver reliable reports to senior management and the board. The features in the stem directly support that objective: standard definitions improve consistency, named owners improve accountability, automated reconciliations strengthen control, and ad hoc reporting improves timeliness in stress.
In practice, this capability helps a firm to:
The key point is that the described measures build the reporting infrastructure itself, rather than a separate capital, modelling or recovery tool.
These features are designed to ensure accurate, complete and timely risk information reaches senior management and the board, especially in stressed conditions.
Use the CISI Risk Practice Test page for the full Securities Prep route, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.
Read the CISI Risk guide on SecuritiesMastery.com, then return to Securities Prep for timed practice.