Try 10 focused CISI Risk questions on Principles of Risk Management, with answers and explanations, then continue with Securities Prep.
| Field | Detail |
|---|---|
| Exam route | CISI Risk |
| Issuer | CISI |
| Topic area | Principles of Risk Management |
| Blueprint weight | 14% |
| Page purpose | Focused sample questions before returning to mixed practice |
Use this page to isolate Principles of Risk Management for CISI Risk. Work through the 10 questions first, then review the explanations and return to mixed practice in Securities Prep.
| Pass | What to do | What to record |
|---|---|---|
| First attempt | Answer without checking the explanation first. | The fact, rule, calculation, or judgment point that controlled your answer. |
| Review | Read the explanation even when you were correct. | Why the best answer is stronger than the closest distractor. |
| Repair | Repeat only missed or uncertain items after a short break. | The pattern behind misses, not the answer letter. |
| Transfer | Return to mixed practice once the topic feels stable. | Whether the same skill holds up when the topic is no longer obvious. |
Blueprint context: 14% of the practice outline. A focused topic score can overstate readiness if you recognize the pattern too quickly, so use it as repair work before timed mixed sets.
These questions are original Securities Prep practice items aligned to this topic area. They are designed for self-assessment and are not official exam questions.
Topic: Principles of Risk Management
A financial services group introduces a central treasury control to net same-day internal cash positions before borrowing externally.
| Business unit | Cash position |
|---|---|
| Retail banking | -£9m |
| Custody services | +£4m |
| Asset management | +£3m |
| Group operations | -£2m |
A negative figure means the unit needs cash; a positive figure means surplus cash. By how much does netting reduce the group 7s external funding requirement?
Best answer: D
What this tests: Principles of Risk Management
Explanation: Without netting, the units with deficits would need £11m of external funding. Netting allows the £7m of internal surpluses to offset part of that need, leaving only £4m to borrow, so the reduction is £7m.
This tests how a simple risk management control can protect and add value to an organisation. Central cash netting reduces unnecessary external borrowing by using surplus liquidity in one part of the group to offset deficits elsewhere.
Here, the gross cash shortfall is £9m + £2m = £11m. The available internal surplus is £4m + £3m = £7m. After netting, the group only needs £11m - £7m = £4m from external sources. The benefit created by the control is therefore a £7m reduction in external funding need.
That protects stakeholders by lowering liquidity pressure and funding cost, while improving group-wide use of cash.
Gross funding needed is £11m, net funding needed after offsetting £7m of surpluses is £4m, so the reduction is £7m.
Topic: Principles of Risk Management
A firm wants to trial a new digital onboarding tool. It wants to learn from limited live use while keeping operational, conduct and compliance exposure tightly controlled through caps, monitoring and a clear rollback trigger. Which option best matches this approach?
Best answer: A
What this tests: Principles of Risk Management
Explanation: The best match is a controlled pilot because it combines innovation with practical risk containment. It permits real-world learning, but only within pre-set boundaries, with monitoring and a stop mechanism if outcomes are unacceptable.
A controlled pilot is a standard way to balance innovation benefit against control risk in financial services. It allows a firm to test a new tool on a small scale in live conditions, while limiting the size of any operational, conduct or compliance failure. The key features are restricted scope, explicit limits, enhanced oversight and predefined rollback or stop criteria.
This makes it different from related tools:
The key takeaway is that innovation is best controlled through phased deployment with clear guardrails, not by governance statements or analysis alone.
This approach allows measured live testing while capping exposure and preserving a defined exit route if control issues emerge.
Topic: Principles of Risk Management
A mid-sized bank relies heavily on short-term wholesale funding and provides payment services to several smaller financial firms. After market rumours trigger sharp liquidity outflows, the board finds that its recovery options and operational continuity arrangements for resolution have not been updated. What is the single best reason robust recovery and resolution planning matters here?
Best answer: A
What this tests: Principles of Risk Management
Explanation: Recovery and resolution planning prepares a firm and the authorities for severe stress before a crisis escalates. In this case, the bank’s funding weakness and payment-service role mean planning is important both for restoring viability and for maintaining critical services if recovery fails.
The core concept is that recovery planning and resolution planning serve different but linked purposes. Recovery planning is the firm’s pre-agreed set of actions to stabilise itself under severe stress, such as raising liquidity, reducing risk or selling assets. Resolution planning is for the case where recovery is not enough: it allows the firm to fail in an orderly way while preserving critical functions, such as payment services, and limiting contagion to the wider system.
That matters here because the bank has concentrated wholesale funding and performs services used by other firms. Without credible plans, a liquidity shock could become a disorderly failure that disrupts financial stability. Automatic public support is not the objective; continuity and orderly loss allocation are.
Recovery and resolution planning is meant to restore viability if possible and, if not, support an orderly failure while keeping critical services running.
Topic: Principles of Risk Management
An investment firm has board-approved trading limits, daily management information and a monthly risk committee. In practice, desk heads discourage staff from reporting small limit breaches, and repeated exceptions are relabelled as “timing issues” so dashboards appear within appetite. Which action would best apply sound risk management principles?
Best answer: B
What this tests: Principles of Risk Management
Explanation: The main weakness is not the formal framework but the reluctance to escalate bad news. Giving the independent risk function direct authority to challenge and escalate breaches reinforces risk appetite, supports effective second-line oversight and reduces the chance that front-line pressure will hide issues.
This scenario shows how weak risk culture can undermine otherwise sound controls. The firm already has limits, management information and a risk committee, but those tools fail if staff are discouraged from reporting breaches and managers can reclassify exceptions to avoid scrutiny. The best application of sound risk management is to strengthen independent escalation so the second line can challenge the first line and report breaches or overrides without front-line veto.
A healthy framework needs both design and behaviour:
More reporting or later review helps less if the underlying culture still suppresses information. The key point is that governance only works when escalation is trusted and protected.
This addresses the cultural failure by ensuring independent challenge and escalation cannot be blocked by front-line management.
Topic: Principles of Risk Management
An investment firm adopts a regtech platform to map a new regulatory rule to existing controls, assign action owners, and flag overdue remediation. The board wants the tool to improve compliance monitoring without weakening accountability. Which implementation best applies the three lines of defence?
Best answer: A
What this tests: Principles of Risk Management
Explanation: Regtech should strengthen governance, not replace it. The best use keeps first-line ownership of controls and remediation, gives the second line oversight and escalation, and leaves internal audit independent.
The core principle is that regtech supports risk identification, monitoring, reporting, and compliance processes, but it does not transfer accountability away from the business. In a three-lines-of-defence model, the first line owns the controls and fixes gaps, the second line validates regulatory interpretation and monitors exceptions, and the third line provides independent assurance after the fact. A regtech platform can map rules to controls, track overdue actions, and produce exception reports, but those functions must sit within clear governance. Using internal audit for live control ownership would weaken its independence, while having compliance or individual desks own remediation would blur responsibilities and reduce effective challenge. The key point is that technology improves control discipline and visibility; it does not change who is accountable.
This keeps remediation with the first line, oversight and escalation with compliance, and independent assurance with internal audit.
Topic: Principles of Risk Management
A lender plans to distribute loans through a large retail platform. The risk team is mainly concerned about dependence on one partner for customer access, very thin margins, and the growth assumptions needed to break even, rather than the loan features themselves. Which risk-management focus best matches this review?
Best answer: A
What this tests: Principles of Risk Management
Explanation: This is about whether the firm’s proposed way of making money is sustainable, not whether the product itself is well designed. Reliance on one platform, low margins and optimistic growth assumptions are classic business-model risk indicators.
Business-model risk arises when a firm’s strategy, revenue drivers or distribution approach may not be commercially sustainable under realistic conditions. In the scenario, the main concern is not the loan product’s features or customer suitability, but whether the lender can profitably and safely operate through a single external platform with thin margins and ambitious growth assumptions.
That makes the review a business-model risk assessment because it is testing:
A new product approval review would focus more on product design, target market, disclosures and customer outcomes. The key takeaway is that emerging business-model risk often sits in how the firm plans to distribute and monetise a product, not only in the product innovation itself.
The review is challenging the sustainability of distribution, margins and growth assumptions, which are business-model issues rather than product-design issues.
Topic: Principles of Risk Management
A wealth manager routes most client equity orders through an outsourced order-management platform.
Exhibit:
Based on the exhibit, which conclusion is most appropriate?
Best answer: C
What this tests: Principles of Risk Management
Explanation: The outsourced platform carries 85% of 2,400 orders, so 2,040 orders per hour depend on the provider. Over 4 hours that is 8,160 orders; after using 1,200 orders of manual fallback capacity, 6,960 remain unprocessed, showing a significant resilience gap caused by third-party dependence.
The core concept is that outsourcing a critical activity can create concentration, control and operational resilience risk if the fallback arrangement is much weaker than normal processing capacity. Here, 85% of 2,400 orders means 2,040 orders per hour rely on the external platform. Over a 4-hour outage, that equals 8,160 affected orders. Manual fallback handles 300 per hour, or 1,200 over 4 hours, so the residual backlog is 6,960 orders.
That large shortfall shows the firm remains heavily dependent on the third party even though a fallback exists. In risk terms, the control is insufficient to maintain service through a plausible disruption. Price movement may be a consequence of delay, but the primary issue shown by the figures is weak resilience in an outsourced critical process.
It correctly nets manual fallback capacity against outsourced order volume, leaving 6,960 unprocessed orders and evidencing material reliance on a critical supplier.
Topic: Principles of Risk Management
A bank activates its recovery plan after severe funding stress.
Exhibit:
| Item | £m |
|---|---|
| Projected cash outflows over 5 days | 900 |
| Projected cash inflows over 5 days | 300 |
| Cash raised from recovery actions | 450 |
Using the exhibit, which statement best explains why recovery and resolution planning both matter?
Best answer: D
What this tests: Principles of Risk Management
Explanation: The exhibit shows a £600m net cash gap before recovery actions and a remaining £150m shortfall after them. Recovery planning aims to restore viability, while resolution planning matters because it provides an orderly way to maintain critical functions and limit wider disruption if recovery is not enough.
Recovery and resolution planning are complementary parts of systemic resilience. From the exhibit, net cash outflow over 5 days is £900m minus £300m, which equals £600m. Recovery actions raise £450m, so a £150m shortfall remains. That means management actions in the recovery plan may still be insufficient to return the firm to viability.
A recovery plan sets out actions the firm can take in stress, such as asset sales or use of eligible collateral. A resolution plan prepares for the situation where those actions do not fully work, so authorities can resolve the firm in an orderly way, maintain critical functions, and reduce contagion to the wider financial system. The key point is that resolution planning is the backstop when recovery cannot fully close the gap.
Net outflows are £600m and recovery actions cover £450m, leaving a £150m shortfall that makes orderly resolution planning important if viability cannot be restored.
Topic: Principles of Risk Management
A dealer’s interest-rate derivatives book moves sharply against it. Counterparties remain solvent, systems operate normally, and no other funding is available today.
Exhibit:
Which statement best describes the risk impact?
Best answer: C
What this tests: Principles of Risk Management
Explanation: The primary event is a market risk loss on the derivatives book. That loss triggers a same-day margin payment of GBP 6 million, but only GBP 4 million cash is available, so it also creates a GBP 2 million liquidity shortfall.
One risk event can spill into another risk category. Here, the initial problem is market risk: the value of the derivatives book has fallen by GBP 6 million. Because variation margin of GBP 6 million must be paid today and only GBP 4 million cash is available, the firm also faces a liquidity problem.
So the correct interpretation is a market risk event with a secondary liquidity consequence. It is not credit risk, because the stem explicitly says counterparties remain solvent.
The market move is the primary event, and the same-day funding gap is GBP 6 million minus GBP 4 million, or GBP 2 million.
Topic: Principles of Risk Management
A broker launches a commission-free mobile trading app. Management initially labels the main emerging risk as “product innovation”. Assume the platform and controls operate as intended, and the broker does not take principal market positions.
| Item per active client | Amount |
|---|---|
| Revenue per year | £28 |
| Servicing and compliance cost per year | £22 |
| Customer acquisition cost upfront | £25 |
| Average client life | 2 years |
Assume no other material revenues or costs. Based on the figures, which interpretation is most appropriate?
Best answer: B
What this tests: Principles of Risk Management
Explanation: The figures show weak unit economics, not just novelty. Annual contribution is £6 per client, so over a two-year life the broker earns £12 before acquisition cost, which is less than the £25 spent to win the client. That makes the core issue business-model sustainability.
Business-model risk arises when a firm’s strategy or revenue model is not economically sustainable, even if the product itself is innovative and operations work properly. Here, the app generates annual contribution of £6 per client (£28 revenue less £22 servicing and compliance cost). Over the stated two-year average client life, that totals £12. After the £25 upfront acquisition cost, expected lifetime value is -£13 per client.
Negative unit economics mean growth would scale losses rather than solve them, so the main emerging risk is the viability of the business model. The closest distractor is product innovation, but the stem’s figures show the bigger issue is monetisation, not novelty.
Each client produces only £12 of contribution over two years versus £25 acquisition cost, so the expected lifetime loss indicates business-model risk.
Use the CISI Risk Practice Test page for the full Securities Prep route, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.
Read the CISI Risk guide on SecuritiesMastery.com, then return to Securities Prep for timed practice.