Risk Response, Control and Risk Financing

Introduction and context

Enterprise risk management (ERM) becomes valuable only when risk assessment leads to disciplined action. Identifying a risk, estimating its likelihood and impact, and placing it on a risk register do not by themselves protect an organisation. Management must decide whether to change the activity that creates the exposure, reduce its probability or consequence, share it with another party, retain it deliberately, or pursue an associated opportunity. It must then design controls, allocate financial resources, and monitor whether the chosen response remains effective.

Risk response, control and risk financing are therefore connected but distinct. A risk response is the strategic decision made about an uncertainty. A control is a mechanism that changes the likelihood or effect of an event, or improves the organisation’s ability to detect and respond to it. Risk financing is the arrangement through which the organisation funds losses that remain after prevention, mitigation and contractual allocation.

A sound response is not necessarily the one that eliminates the greatest amount of risk. Elimination may destroy valuable economic activity, create excessive cost, or transfer risk to a party less able to manage it. The managerial task is to select a response that is proportionate to the organisation’s risk appetite, legal duties, resilience objectives, capital capacity and strategic purpose.

Learning objectives

By the end of this chapter, students should be able to:

1. Distinguish avoidance, acceptance, mitigation, transfer and opportunity exploitation.
2. Select a response using risk appetite, expected loss, variability, tail exposure and strategic value.
3. Evaluate preventive, detective, corrective and directive controls.
4. Assess control design, operating effectiveness and residual risk.
5. Compare insurance, derivatives, contractual allocation and captive insurance.
6. Apply cost-benefit and risk-adjusted decision principles to response selection.
7. Recognise governance, ethical, regulatory and behavioural limitations in risk financing.

1. The response decision: from inherent to residual risk

Inherent risk is the exposure before considering controls or other responses. Residual risk is the exposure remaining after the selected response has operated. A response should be assessed against the organisation’s risk appetite, not merely against an abstract goal of minimisation.

A useful conceptual sequence is:

1. Define the objective and risk event.
2. Estimate inherent likelihood, impact and uncertainty.
3. Identify legal, regulatory and contractual constraints.
4. Generate response alternatives.
5. Estimate the cost, benefit and residual exposure of each alternative.
6. Select, approve and implement the response.
7. Monitor performance and revise the decision when assumptions change.

Expected loss is often a useful first comparison, although it is insufficient for risks with severe tails or strategic consequences. Under a simplified discrete model:

where p_i is the probability of outcome i, L_i is the monetary loss in that outcome, and the probabilities sum to one. The formula assumes that outcomes and losses can be reasonably specified and that management is comparing monetary consequences on a consistent basis. It does not capture risk aversion, liquidity effects, correlations, reputational damage or non-monetary harm.

If a loss occurs with probability 2% and would cost $10 million, its annual expected loss is:

EL = 0.02 × $10,000,000 = $200,000.

An organisation should not automatically spend $200,000 to eliminate it. The loss may be volatile, correlated with other losses, uninsured, legally unacceptable, or concentrated in a period when cash is scarce. Conversely, a control costing more than expected loss may still be justified if it prevents catastrophic outcomes or fulfils a duty of care.

Risk appetite and capacity

Risk appetite expresses the amount and type of risk an organisation is willing to pursue or retain in achieving objectives. Risk capacity is the maximum exposure the organisation can withstand without threatening its viability, regulatory compliance or critical stakeholders. Capacity is usually more restrictive than appetite. A board may have an appetite for moderate foreign-exchange volatility but no capacity for a liquidity event that could cause covenant breach.

Response selection should consider:

• frequency and severity of the exposure;
• volatility and tail loss;
• speed of loss development;
• correlation with existing risks;
• liquidity and capital requirements;
• reversibility of the decision;
• legal and regulatory obligations;
• effect on customers, employees and communities;
• cost and reliability of controls; and
• strategic upside associated with the uncertainty.

2. The principal risk responses

Avoidance

Avoidance changes or abandons the activity that creates the exposure. Examples include withdrawing from a prohibited market, refusing a contract with unacceptable liability, or discontinuing a hazardous production process. Avoidance is appropriate where the risk exceeds capacity, cannot be controlled reliably, or violates law or ethical commitments.

Avoidance has an opportunity cost. It may sacrifice revenue, learning, innovation or social value. It can also displace risk to another jurisdiction or supplier rather than eliminate it. A decision to exit should therefore identify the risk actually avoided, the risks introduced by exit, and the value forgone.

Acceptance or retention

Acceptance means consciously retaining the exposure. It may be appropriate where the risk lies within appetite, mitigation is inefficient, or the organisation has a comparative advantage in bearing it. Acceptance is not the absence of action. It normally requires a documented rationale, a funding mechanism, thresholds for escalation and monitoring.

Retention can be unfunded, in which case the organisation simply absorbs a loss, or funded, through reserves, provisions, a dedicated liquidity facility or a captive. Deliberate acceptance should be distinguished from passive retention caused by neglect.

Mitigation or reduction

Mitigation reduces probability, consequence or both. Examples include segregation of duties, preventive maintenance, cybersecurity controls, diversification, dual sourcing, staff training and business continuity arrangements. Mitigation may target the source, the pathway or the impact of an event.

A control that reduces probability from p₀ to p₁ and severity from L₀ to L₁ produces, under the expected-loss model:

The percentage reduction in expected loss is:

This calculation is applicable only when monetary loss estimates are comparable and the changes are not double-counted. It should not be interpreted as a complete measure of control value.

Transfer or sharing

Transfer reallocates some financial consequence, responsibility or operational exposure to another party. Common mechanisms include insurance, indemnities, warranties, outsourcing, hedging contracts and joint ventures. Transfer does not necessarily remove the underlying risk. It may create counterparty, basis, legal, conduct or moral-hazard risk.

Effective transfer requires analysis of the recipient’s capacity and incentives. A supplier indemnity is weak protection if the supplier lacks assets, insurance or enforceable obligations. Contractual language must address scope, exclusions, limits, deductibles, evidence, claims procedures, governing law and termination.

Opportunity exploitation and enhancement

Risk is not only downside. Uncertainty can generate favourable outcomes. Exploitation seeks to ensure that a positive opportunity occurs—for example, reserving scarce capacity, acquiring a strategic capability or committing resources to a high-value innovation. Enhancement increases the probability or effect of an opportunity without guaranteeing it.

Opportunity responses should be governed with the same discipline as threats. Management should define upside objectives, downside limits, decision rights, triggers and exit conditions. Pursuing an opportunity without controlling its downside is speculation rather than ERM.

3. Control design and evaluation

A control is effective only when it is suitably designed and operates as intended. A well-designed control addresses a defined risk, is performed by a competent and authorised person or system, generates evidence, and has a clear response to exceptions.

Control objectives and types

Controls should be linked to an objective such as accuracy, safeguarding of assets, compliance, continuity, confidentiality or reliable reporting. Important classifications include:

• Preventive controls: stop an undesirable event before it occurs, such as access restrictions or approval limits.
• Detective controls: identify an event or error after or while it occurs, such as reconciliations, alerts and inventory counts.
• Corrective controls: restore conditions or reduce consequences, such as backups, incident response and recovery plans.
• Directive controls: establish expected behaviour, such as policies, training and codes of conduct.
• Manual controls: performed by people.
• Automated controls: embedded in applications, workflows or infrastructure.
• Entity-level controls: governance, culture, risk oversight and internal audit.
• Transaction-level controls: checks applied to individual transactions or events.

A mature control architecture uses layers. For example, a payment process may contain delegated authority, system segregation, sanctions screening, exception reporting, bank reconciliation and independent audit. No single control should be assumed infallible.

Design effectiveness and operating effectiveness

Design effectiveness asks whether the control, if performed correctly, would address the stated risk. Operating effectiveness asks whether it actually operated consistently, by the right person or system, at the required frequency and with sufficient evidence.

A control evaluation should specify:

1. the risk and control objective;
2. control owner and performer;
3. timing and frequency;
4. population or transactions covered;
5. inputs, rules and thresholds;
6. evidence retained;
7. exception handling and escalation;
8. dependencies on technology or other controls; and
9. testing method and remediation deadline.

Control reliance should be proportionate to evidence. A policy document proves that a policy exists; it does not prove that employees followed it. Similarly, a system configuration may demonstrate intended logic but not the quality of input data.

Control cost and benefit

Control cost includes design, implementation, training, maintenance, testing, delay, reduced flexibility and possible false positives. Benefits include avoided loss, reduced volatility, compliance, customer trust, resilience and improved information.

A simple decision rule is to choose a control when its incremental expected benefit exceeds its incremental cost, subject to non-financial constraints:

where ΔB is incremental benefit and ΔC is incremental cost. In a monetary expected-loss comparison, ΔB may include EL₀ − EL₁, but only after considering implementation cost, residual risk and uncertainty. The rule is not decisive where law, safety or fundamental rights require action regardless of financial return.

Worked example: layered control investment

An operational disruption has an annual probability of 5% and a loss of $4 million. The initial expected loss is:

EL₀ = 0.05 × $4,000,000 = $200,000.

A preventive control costing $90,000 per year is expected to reduce probability to 2%, while a continuity control costing $60,000 is expected to reduce severity to $1.5 million if disruption occurs. Assuming the effects are independent and estimates are reliable, the combined expected loss is:

EL₁ = 0.02 × $1,500,000 = $30,000.

The expected-loss reduction is $170,000. The annual control cost is $150,000, producing a simplified net expected benefit of $20,000. The conclusion is not that the controls are automatically optimal: management must test the independence assumption, consider implementation risk, assess residual tail exposure, and include non-financial benefits and costs.

4. Risk financing

Risk financing concerns how an organisation pays for losses that remain. It should be designed after operational responses, because financing a preventable loss can encourage weak controls. The principal alternatives are retention, insurance, derivatives, contractual allocation and captives.

Retention and reserves

Retention is efficient when losses are predictable, relatively small, within liquidity capacity and expensive to transfer. Organisations may retain losses through a general balance sheet, a designated reserve, a self-insured retention or a high deductible.

Retention requires more than an accounting entry. A reserve may recognise an expected obligation under applicable reporting rules, but it does not necessarily provide cash. Treasury should assess the timing of payments, stress liquidity, identify concentration and establish authority for drawing funds.

Insurance

Insurance exchanges a premium for contingent protection against specified losses. A simplified risk-financing comparison is:

This is a decision framework rather than an accounting formula. It assumes that premium, retained loss and avoided loss are measured over a comparable period and that policy terms are understood.

Important insurance concepts include:

• Limit: maximum insurer payment for covered loss.
• Deductible or excess: initial amount borne by the insured.
• Coinsurance: sharing of a covered loss, often stated as a percentage.
• Exclusion: circumstance or loss not covered.
• Aggregate limit: maximum payment over a policy period.
• Occurrence and claims-made coverage: different triggers for coverage.
• Subrogation: insurer’s right to pursue a responsible third party after payment.
• Parametric insurance: payment triggered by an objective parameter, such as wind speed, rather than proof of actual loss.

Insurance is vulnerable to coverage gaps, exclusions, claims uncertainty, insurer failure, premium cycles and basis risk. It can also produce moral hazard if insured parties reduce prevention. Underwriting information, policy wording and claims governance are therefore central to risk management.

Derivatives and hedging

Derivatives transfer or reshape market risk. Futures and forwards can lock an exchange rate or commodity price. Options provide a right but not an obligation and therefore preserve some upside at a premium. Swaps exchange streams of payments, such as fixed and floating interest rates.

For a simple foreign-currency payable, a forward hedge fixes the domestic-currency cost. If the payable is F units of foreign currency and the forward rate is K domestic currency units per foreign unit, the locked cost is:

This assumes the notional, currency, maturity and settlement align with the exposure and that counterparty performance is reliable. If the actual exposure differs from the hedge notional or timing, basis and over-hedging risk arise.

A hedge should have a documented purpose, identified exposure, approved instrument, counterparty limits, valuation method, collateral policy and effectiveness-monitoring process. Speculation occurs when the derivative position is not linked to a genuine exposure or approved risk objective.

Contractual allocation

Contracts allocate risk through price, indemnities, warranties, limitation-of-liability clauses, service levels, insurance requirements, retention of title and termination rights. Allocation should follow the party best able and incentivised to control the risk, not simply the party with weaker bargaining power.

Contract review should ask:

• Is the obligation clearly defined and measurable?
• Is liability capped, uncapped or subject to consequential-loss exclusions?
• Does the indemnity cover third-party claims and regulatory penalties where legally permitted?
• Is insurance evidence required and monitored?
• Are subcontractors and supply-chain dependencies addressed?
• What happens upon force majeure, insolvency or data breach?
• Are audit, notification, dispute and remediation rights practical?

Contractual transfer is ineffective if it cannot be enforced, if the counterparty is insolvent, or if the organisation remains liable to customers and regulators despite private allocation.

Captive insurance

A captive is an insurance company established and controlled by a parent or group to insure group risks. It may improve access to coverage, retain underwriting profit, provide data and cover risks unavailable or expensive in the commercial market. It may also support disciplined loss prevention.

Captives introduce formation, capital, actuarial, governance, regulatory, tax, claims and investment costs. They should be justified by credible loss data, stable exposures, professional management and a clear economic purpose. A captive is not a device for disguising inadequate capital or evading legitimate regulation. Fronting arrangements, reinsurance and jurisdictional requirements may be necessary.

5. Integrating response and financing decisions

A response portfolio often combines methods. For example, a firm may mitigate cyber risk through architecture and training, transfer residual financial risk through insurance, retain a deductible, require contractual controls from suppliers, and maintain a recovery facility. The question is not “Which single response is correct?” but “What combination produces acceptable residual risk at an efficient total cost?”

Portfolio analysis matters because risks can be correlated. Separate insurance policies may exclude the same systemic event. Diversification may fail during a common shock. A derivative may reduce price volatility but increase liquidity requirements through margin calls. A supplier transfer may fail precisely when many suppliers are distressed.

A practical decision matrix evaluates each alternative against multiple criteria:

Where alternatives have different timing, management may use present value. If a cash flow CF_t occurs at time t and the appropriate discount rate is r, its present value is:

The rate should reflect currency, timing and relevant risk assumptions; uncertain losses should not be made artificially precise by discounting alone. Scenario analysis and stress testing are essential complements.

6. Governance, ethics and regulation

The board normally approves risk appetite and oversees material exposures. Senior management designs the response portfolio, while risk, finance, treasury, legal, procurement, operations and internal audit provide complementary challenge. Responsibilities should be separated: the person who benefits from retaining risk should not unilaterally determine its measurement or financing.

Governance weaknesses commonly include:

• treating insurance as a substitute for controls;
• relying on modelled losses without challenging assumptions;
• purchasing coverage to satisfy a checklist rather than protect objectives;
• using derivatives without clear hedging authority;
• shifting risk to workers, customers or suppliers who cannot absorb it;
• failing to disclose material exposures and concentrations; and
• rewarding short-term earnings while externalising long-term harm.

Ethically, a response must consider stakeholders beyond shareholders. Avoiding a risk by transferring hazardous work to an under-regulated supplier may improve reported results while increasing social harm. Contractual allocation cannot ethically justify ignoring foreseeable consequences. Regulatory expectations increasingly emphasise operational resilience, climate and sustainability risk, cyber governance, consumer protection, model governance and third-party oversight. Specific requirements vary by jurisdiction and sector, so organisations must obtain current legal advice.

7. Technology, data and contemporary developments

Digital controls can improve speed and coverage through continuous monitoring, anomaly detection, automated reconciliations and workflow approvals. Artificial intelligence can support claims triage, fraud detection, scenario generation and control testing. However, AI introduces data-quality, explainability, bias, privacy, cybersecurity, model-drift and accountability risks. Human governance remains necessary for material decisions.

Climate change, geopolitical fragmentation, pandemics, cyber concentration and supply-chain interdependence make historical loss data less reliable. Organisations increasingly combine scenario analysis, reverse stress testing, external data and expert judgement. A useful stress test asks not merely “What is the most likely loss?” but “What combination of events would threaten objectives, liquidity or solvency?”

Parametric insurance, catastrophe bonds, supply-chain finance and cloud-resilience contracts are evolving responses. Their value depends on transparent triggers, basis-risk analysis, counterparty strength and operational readiness. Technology does not remove the need for sound definitions, controls and accountability.

8. Illustrative case: Northstar Components Ltd.

Background

Northstar Components Ltd. is a manufacturer whose revenue depends on a specialised semiconductor supplied by two overseas producers. A disruption could stop production. The firm also has substantial euro-denominated purchases and faces increasing ransomware exposure. Its board permits moderate operating volatility but requires protection against events that could threaten debt covenants.

Problem

The initial risk assessment estimates that a major supply disruption has a 10% annual probability and would cause a $12 million gross loss. A cyber event has a 6% probability and a $5 million gross loss. The estimates are uncertain and the risks may be correlated during geopolitical stress. Management proposes buying broad insurance and entering large foreign-exchange derivatives, but the risk committee questions whether transfer alone is appropriate.

Analysis

Northstar first separates response decisions. For supply risk, it qualifies a third supplier, redesigns one product to accept an alternative chip, and holds strategic inventory. These measures reduce probability and severity but create inventory and obsolescence costs. It negotiates supplier service levels, notification duties, audit rights and business-continuity requirements. It purchases contingent business-interruption coverage with a deductible, subject to verification of supplier coverage and policy exclusions.

For currency risk, treasury identifies forecast euro purchases and separates firm commitments from uncertain forecasts. It hedges a proportion of committed purchases with forwards and uses options for less certain exposures. The hedge documentation states the business purpose, notional, maturity and counterparty limits. The company avoids hedging speculative volumes.

For cyber risk, Northstar prioritises multifactor authentication, privileged-access management, offline backups, segmentation, patch management and tested incident response. It retains a deductible and purchases cyber insurance after reviewing sublimits, ransomware conditions, exclusions for inadequate controls and notification requirements. Critical suppliers must meet minimum security standards, but Northstar recognises that contractual rights do not replace its own controls.

Approach and solution

The final portfolio combines mitigation, selective transfer and funded retention. The board approves risk indicators: supplier concentration, days of critical inventory, backup restoration time, hedge coverage ratio, privileged-access exceptions and insurance exposure gaps. A quarterly committee reviews whether assumptions, policy terms and counterparty credit remain valid.

Outcome

A later supplier outage lasts three weeks. The alternative supplier and redesigned product preserve a substantial proportion of production. Inventory absorbs the initial delay, while insurance responds to the covered residual loss after the deductible. Because the firm retained some exposure deliberately, treasury had reserved liquidity rather than assuming immediate insurer payment. The event reveals that a supplier’s notification was late, leading to a contract remediation programme.

Learning points

1. A financial transfer is most effective when supported by operational mitigation.
2. Risk financing must account for timing, exclusions, deductibles and counterparty performance.
3. Hedging should correspond to a genuine and measurable exposure.
4. Controls require indicators and testing, not merely written policies.
5. A response portfolio should be revised after incidents and near misses.

Challenges and limitations

Risk-response analysis is constrained by incomplete data, parameter uncertainty, changing correlations and behavioural bias. Expected-loss estimates can understate rare catastrophic events. Cost-benefit analysis may undervalue human life, trust, equity and legal rights. Insurance prices can be cyclical, and coverage may contract after major losses. Derivatives may generate collateral calls when the organisation most needs cash. Captives may create concentration rather than diversification. Contracts may allocate paper liability but not operational responsibility.

Managers should therefore use ranges rather than false precision, document assumptions, perform sensitivity and reverse-stress tests, and distinguish model uncertainty from ordinary statistical variation. Independent challenge is especially important where a response improves short-term earnings but increases long-term tail risk.

Best-practice implementation checklist

A robust programme should:

• link every material response to an objective and risk owner;
• document inherent and residual exposure;
• distinguish prevention, detection, correction and recovery;
• test both control design and operating effectiveness;
• finance retained losses with adequate liquidity;
• review insurance wording rather than relying on policy names;
• align derivatives with documented exposures;
• assess counterparty and correlation risk;
• include contractual monitoring and enforceability analysis;
• use scenario analysis for severe and systemic events;
• establish escalation triggers and board reporting; and
• review responses after incidents, market changes and strategy changes.

Chapter Summary

Risk response is the disciplined selection of avoidance, acceptance, mitigation, transfer or opportunity exploitation. The correct choice depends on risk appetite and capacity, expected and tail loss, liquidity, legal requirements, strategic value and the organisation’s ability to control or finance the exposure. Mitigation changes probability or consequence; transfer shares consequences but does not eliminate the underlying risk; acceptance requires deliberate funding and monitoring; and opportunity responses govern upside as well as downside.

Controls must be assessed for design effectiveness and operating effectiveness. Preventive, detective, corrective and directive controls should operate in complementary layers. Cost-benefit analysis is useful but must be supplemented by stress testing, ethical judgement and regulatory requirements.

Risk financing includes retention, insurance, derivatives, contractual allocation and captives. Each mechanism involves costs, limits, exclusions, incentives, counterparty risks and possible basis risk. An integrated portfolio combines operational controls with selective financial transfer and adequate liquidity. Effective ERM is dynamic: assumptions, exposures, technology, regulation and counterparties change, so responses require continuous monitoring and governance.

Key Terms

Risk response: A deliberate decision about how an organisation will address uncertainty.

Inherent risk: Exposure before considering controls or other responses.

Residual risk: Exposure remaining after a response operates.

Risk appetite: Amount and type of risk an organisation is willing to pursue or retain.

Risk capacity: Maximum exposure an organisation can withstand without unacceptable harm.

Avoidance: Stopping or redesigning an activity that creates unacceptable exposure.

Acceptance: Deliberately retaining a risk within approved boundaries.

Mitigation: Reducing the probability or consequence of a risk event.

Risk transfer: Sharing financial or operational consequences with another party.

Opportunity exploitation: Acting to ensure or maximise a favourable uncertain outcome.

Preventive control: A control intended to stop an event before it occurs.

Detective control: A control intended to identify an event, error or deviation.

Corrective control: A control intended to restore conditions or reduce consequences.

Design effectiveness: The extent to which a control, if performed, addresses its stated risk.

Operating effectiveness: The extent to which a control operates consistently as designed.

Expected loss: Probability-weighted average loss across specified outcomes.

Deductible: The amount of an insured loss borne by the insured before coverage responds.

Basis risk: Risk that a hedge, index or transferred instrument does not match the actual exposure.

Captive insurer: An insurance company established and controlled by an organisation or group.

Moral hazard: Increased risk-taking or reduced prevention resulting from protection against loss.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk.
2. Why is acceptance not equivalent to inaction?
3. State the difference between design effectiveness and operating effectiveness.
4. Identify two limitations of insurance as a risk-transfer mechanism.
5. What is basis risk in a derivatives or parametric-insurance context?

Long Answer Questions

1. Compare avoidance, mitigation, transfer and acceptance, including situations in which each may be appropriate.
2. Explain how a board’s risk appetite and risk capacity influence risk-response decisions.
3. Discuss how an organisation should evaluate the design and operation of a layered control system.
4. Compare insurance, contractual allocation, derivatives and captives as methods of risk financing.
5. Explain why expected-loss analysis should be supplemented by liquidity analysis, stress testing and ethical judgement.

Analytical / Application Questions

1. A project has a 4% annual probability of producing a $6 million loss. A control costing $100,000 annually reduces probability to 1.5%. Calculate the initial and residual expected losses, then evaluate the simplified expected-loss case for the control. State two reasons why the financial calculation may not be decisive.
2. A company has uncertain foreign-currency purchases, firm orders for 10 million euros and forecast orders for a further 5 million euros. Design a hedging approach that distinguishes committed exposure from uncertain exposure, and identify at least three risks created by the hedge.
3. A supplier offers a broad indemnity but has weak financial resources and no verified insurance. Analyse whether the buyer should rely on the indemnity, and recommend an integrated response involving controls, contract terms and risk financing.

Multiple Choice Questions with Answers

Question 1

Which response deliberately retains an exposure within approved boundaries?

A. Avoidance

B. Acceptance

C. Transfer

D. Exploitation

Correct Answer: B. Acceptance

Question 2

A control that identifies unauthorised payments through post-transaction review is primarily what type of control?

A. Preventive

B. Directive

C. Detective

D. Opportunity-enhancing

Correct Answer: C. Detective

Question 3

A loss has a 3% probability and a severity of $2 million. What is its simplified expected loss?

A. $6,000

B. $60,000

C. $600,000

D. $2,060,000

Correct Answer: B. $60,000

Question 4

Which statement best describes residual risk?

A. Risk before any controls exist

B. The maximum risk an organisation can withstand

C. Risk remaining after the selected response operates

D. Risk transferred entirely to an insurer

Correct Answer: C. Risk remaining after the selected response operates

Question 5

What is a principal limitation of contractual risk transfer?

A. Contracts always eliminate operational risk

B. The counterparty may lack resources or the obligation may be unenforceable

C. Contracts cannot specify service levels

D. Contracts remove the need for monitoring

Correct Answer: B. The counterparty may lack resources or the obligation may be unenforceable

Question 6

A deductible in an insurance policy is generally the:

A. Maximum insurer payment

B. Premium paid to the insurer

C. Initial portion of a covered loss borne by the insured

D. Amount of investment income earned by the insurer

Correct Answer: C. Initial portion of a covered loss borne by the insured

Question 7

Which derivative gives the holder a right but not an obligation to transact?

A. Option

B. Forward

C. Swap

D. Fixed-rate loan

Correct Answer: A. Option

Question 8

A captive insurer is best described as:

A. A government regulator of insurers

B. An insurer established and controlled by a parent or group

C. An uninsured supplier indemnity

D. A derivative exchange

Correct Answer: B. An insurer established and controlled by a parent or group

Question 9

Why can a large derivative hedge create liquidity risk?

A. It guarantees that the underlying exposure will disappear

B. It may require collateral or margin payments during adverse market movements

C. It prevents all counterparty assessment

D. It converts every loss into an accounting profit

Correct Answer: B. It may require collateral or margin payments during adverse market movements

Question 10

Which criterion is especially important when assessing whether a risk transfer will work during a major loss event?

A. The colour of the policy document

B. Counterparty capacity and correlation with the organisation’s other exposures

C. Whether the risk register has fewer pages

D. Whether the transfer avoids all monitoring

Correct Answer: B. Counterparty capacity and correlation with the organisation’s other exposures