Free CII Introduction to Risk Management (I11) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CII Introduction to Risk Management (I11) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In the general management sense used by the Orange Book, what makes an uncertain event a risk to an organisation?

   1. A.It has an effect on an organisational objective.Correct answer: A
   2. B.It has already produced a recognised accounting loss.
   3. C.It can be assigned an exact numerical probability.
   4. D.It arises from a source outside managerial control.

   Explanation: The source states: "Risk is the effect of uncertainty on objectives." The defining connection is to objectives. An event need not already have caused a loss, have an exact probability or originate outside the organisation.

   Reference: HM Treasury, The Orange Book: Management of Risk — Annex 5, definition of Risk

2. 2Managers are choosing between possible risk responses. Which use of risk information supports an informed choice?

   1. A.Justifying a preferred response without examining its assumptions.
   2. B.Replacing current exposure analysis with last year's claim total.
   3. C.Comparing evidence about exposure and the likely effects of responses.Correct answer: C
   4. D.Selecting the response supported by the largest volume of paperwork.

   Explanation: The source states: "provide information for decision-making" Information informs choices by providing evidence on risk and possible responses. Merely defending a preference, substituting a historic total for current analysis or judging by report volume would not evaluate the options on their merits.

   Reference: HM Treasury, The Orange Book: Management of Risk — Principle D11, recording and reporting aims

3. 3Under the Orange Book approach, which comparison is central to deciding whether an analysed exposure is acceptable?

   1. A.The insured asset value against the policy's annual premium.
   2. B.The incident count against the number of controls in place.
   3. C.The current likelihood against historical likelihood alone.
   4. D.The analysed exposure against the organisation's risk appetite.Correct answer: D

   Explanation: The source states: "comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take" Evaluation compares exposure with appetite. Premium comparisons concern insurance cost, incident/control counts do not express acceptability, and historical likelihood alone omits the organisation’s willingness to take the risk.

   Reference: HM Treasury, The Orange Book: Management of Risk — Principle D6, risk evaluation

4. 4A business permanently stops a hazardous operation and no longer performs the activity that created the exposure. Which treatment has it applied to that exposure?

   1. A.Loss retention
   2. B.Risk eliminationCorrect answer: B
   3. C.Risk financing
   4. D.Risk sharing

   Explanation: The source states: "terminating the activity giving rise to the risk" Ending the source activity eliminates that exposure. Retention funds or accepts an exposure, financing addresses its cost, and sharing distributes it rather than stopping the activity.

   Reference: NHS Counter Fraud Authority, Risk Management Guidance — Terminate response

5. 5Which body should determine the organisation's appetite for its principal risks under the Orange Book governance approach?

   1. A.The board of directorsCorrect answer: A
   2. B.The external audit firm
   3. C.The insurance intermediary
   4. D.The claims handling team

   Explanation: The source states: "The board should determine and continuously assess the nature and extent of the principal risks" A3 places this strategic decision with the board. External auditors provide assurance, an intermediary arranges insurance, and claims handlers administer claims; none replaces board ownership of this decision.

   Reference: HM Treasury, The Orange Book: Management of Risk — Section A, supporting principle A3

6. 6Which benefit is a central purpose of business continuity management?

   1. A.Compensating insured financial losses through a risk-transfer contract.
   2. B.Maintaining critical operations and supporting recovery after disruption.Correct answer: B
   3. C.Estimating event probabilities before they affect the organisation.
   4. D.Quantifying provisions for claims from incidents already reported.

   Explanation: The source states: "ensuring continuity of critical functions in the event of a disruption, and effective recovery afterwards." BCM develops continuity and recovery capability. Insurance compensation finances covered losses, probability estimation analyses threats, and claim provisions estimate liabilities; these functions do not themselves keep critical operations running.

   Reference: Cabinet Office, Resilience in society: infrastructure, communities and businesses — Business Continuity, Background

7. 7A risk analyst has conflicting reports and incomplete knowledge about a possible equipment failure. Which term specifically describes this limitation in what is known?

   1. A.Severity of harm
   2. B.Risk exposure
   3. C.UncertaintyCorrect answer: C
   4. D.Risk appetite

   Explanation: The source states: "knowledge can be limited in reliability, is imprecise, can conflict with other information that could have a bearing on the event, or incomplete." The limitation concerns knowledge. Severity describes the effect of harm, exposure concerns vulnerability, and appetite concerns willingness to accept risk.

   Reference: Office for Product Safety and Standards, Risk Lexicon — Section 4, Uncertainty, note

8. 8A team records risk-management activities but never communicates the results to affected departments. Which purpose of risk information is being neglected?

   1. A.Fixing the annual probability of each event.
   2. B.Setting the insurer's contractual policy limits.
   3. C.Transferring responsibility for every risk to the recipients.
   4. D.Making activities and outcomes visible across the organisation.Correct answer: D

   Explanation: The source states: "transparently communicate risk management activities and outcomes across the organisation" Communication makes the work and its outcomes visible. Receiving a report does not fix probabilities or policy limits or automatically transfer ownership.

   Reference: HM Treasury, The Orange Book: Management of Risk — Principle D11, recording and reporting aims

9. 9Two departments use the word 'high' for substantially different likelihood levels. What is needed before their ratings can be meaningfully compared and aggregated?

   1. A.Calibrate their ratings using a common set of risk criteria.Correct answer: A
   2. B.Combine the original numerical ratings without recalibration.
   3. C.Replace their category names while retaining different scales.
   4. D.Rank their risks by the number of controls already recorded.

   Explanation: The source states: "a common set of risk criteria to foster consistent interpretation and application" Calibration makes the ratings comparable. Combining unlike scales or changing labels does not align their meanings; control counts do not substitute for likelihood criteria.

   Reference: HM Treasury, The Orange Book: Management of Risk — Principle D4, risk analysis

10. 10A plant continues operating but installs a physical barrier that lowers the likelihood of injury. Which broad treatment describes this action?

    1. A.Retaining the financial consequences.
    2. B.Transferring the exposure to an insurer.
    3. C.Controlling the risk while continuing the activity.Correct answer: C
    4. D.Eliminating the activity that creates the risk.

    Explanation: The source states: "methods of reducing the inherent risk and leaving an acceptable residual risk" The activity continues with a measure intended to reduce likelihood. This is control, rather than acceptance, financial transfer or cessation.

    Reference: NHS Counter Fraud Authority, Risk Management Guidance — Reduce response