Risk, Governance, Ethics and Responsible Growth

Introduction

Growth creates value, but it also increases exposure. A small venture may survive informal decision-making, founder oversight and a limited customer base. A scaling venture cannot rely on these arrangements indefinitely. As employees, markets, suppliers, investors, technologies and regulatory obligations multiply, the organisation becomes a more complex system. Decisions made in one function can create consequences elsewhere: an aggressive sales promise can generate legal liability; a rapid technology deployment can expose customer data; weak cash controls can threaten solvency; and misleading sustainability claims can damage trust.

Responsible growth is therefore not simply growth that is profitable. It is growth that is strategically coherent, financially resilient, operationally controlled, legally compliant, ethically defensible and accountable to affected stakeholders. Governance provides the structures through which decisions are made and monitored. Internal controls reduce the probability and impact of errors, fraud and abuse. Risk management helps the organisation anticipate uncertainty. Ethics guides choices where legal rules are incomplete or where commercially attractive actions may cause unreasonable harm.

For entrepreneurs, these subjects are not merely administrative concerns. They are strategic capabilities. Investors, employees, customers, lenders and business partners increasingly evaluate how an enterprise manages data, labour, environmental effects, algorithmic decisions and public commitments. Strong governance can improve access to capital, accelerate reliable decision-making and protect the organisation’s licence to operate.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the relationship among risk management, governance, internal control, compliance and ethics.
2. Classify strategic, financial, operational, cyber and reputational risks.
3. Design a proportionate governance and internal-control system for a growing venture.
4. Evaluate risks using likelihood, impact, velocity and control effectiveness.
5. Apply stakeholder-accountability principles to difficult growth decisions.
6. Identify harmful, deceptive or irresponsible growth practices and propose alternatives.
7. Analyse an applied case involving rapid expansion, control failure and ethical risk.

1. Growth as an Expansion of Risk Exposure

Risk is the effect of uncertainty on objectives. The effect may be negative, such as a data breach, or positive, such as an unexpected market opportunity. In entrepreneurial practice, however, risk management usually focuses on threats that could prevent the venture from achieving its objectives.

Risk differs from a problem. A risk is uncertain and may occur in the future; a problem has already occurred. A risk also differs from a cause. For example, “inadequate access controls” is a cause, “unauthorised access to customer records” is an event, and “regulatory penalties and loss of trust” are consequences.

A useful risk statement follows this structure:

Because of [cause], [event] may occur, leading to [consequence] for [objective].

For example: “Because customer-service accounts use shared passwords, an unauthorised person may access customer records, leading to privacy violations, regulatory penalties and reputational damage.” This format prevents vague risk descriptions and supports the selection of controls.

As a venture scales, risk exposure changes in five important ways:

• Volume: More transactions, employees, customers and suppliers create more opportunities for failure.
• Interdependence: A failure in one system can spread through the organisation.
• Visibility: Larger ventures attract greater media, investor and regulatory attention.
• Irreversibility: Decisions about data, employment, infrastructure or market entry may be expensive to reverse.
• Delegation: Founders can no longer personally observe every decision, requiring reliable systems of accountability.

Growth does not mean eliminating all risk. Innovation requires experimentation and uncertainty. The objective is to understand risk, choose an acceptable level of exposure and ensure that decisions are deliberate rather than accidental.

2. A Framework for Enterprise Risk Management

An enterprise risk-management process normally includes the following activities:

1. Establish objectives and context. Define strategic, financial, operational and ethical objectives, together with relevant laws, stakeholders and constraints.
2. Identify risks. Use workshops, interviews, process maps, incident data, scenario analysis and external intelligence.
3. Assess risks. Estimate likelihood, impact, velocity and existing control effectiveness.
4. Respond to risks. Avoid, reduce, transfer, accept or pursue the risk, depending on the situation.
5. Monitor and report. Track indicators, incidents, control performance and changes in the external environment.
6. Learn and improve. Investigate near misses and update processes rather than blaming individuals alone.

A common prioritisation method estimates inherent risk before controls and residual risk after controls. A simple model is:

Here, R is the risk score, L is the likelihood score and I is the impact score. Both scores must use an explicitly defined ordinal scale, such as 1 to 5. The multiplication is a prioritisation convention, not a probability theorem. It assumes that the organisation is using a consistent scale and that the product is useful for comparison. It should not be interpreted as a precise monetary loss estimate.

A more complete assessment may consider velocity and control effectiveness:

P is a prioritisation index; V represents the speed at which consequences materialise; and C represents control effectiveness, expressed between 0 and 1. This model is useful only when the scales are defined consistently. It is not universally standard, and management should avoid false precision.

Expected monetary loss is a different concept:

Here, EMV is expected monetary value, p_i is the probability of scenario i, and L_i is the monetary loss in that scenario. Probabilities must be between 0 and 1, losses must use the same currency and time basis, and the scenarios should be sufficiently distinct to avoid double counting. Expected value is useful for comparing alternatives but can conceal catastrophic outcomes; a low-probability event may still require action because of legal, ethical or existential consequences.

Risk responses

• Avoid: Do not undertake the activity or redesign it so the exposure disappears.
• Reduce: Introduce preventive or detective controls.
• Transfer or share: Use insurance, contractual allocation or specialist providers, while recognising that responsibility is rarely transferred completely.
• Accept: Retain the risk knowingly within approved limits.
• Pursue: Take additional risk when it is necessary to achieve a valuable opportunity and the organisation has the capability to manage it.

A responsible risk register records the risk owner, causes, consequences, inherent rating, controls, residual rating, action plan, deadline and escalation threshold. Ownership must be assigned to a person with authority and resources, not merely to a department.

3. Principal Risk Categories in Scaling Ventures

Strategic risk

Strategic risk arises when assumptions about customers, competition, technology, regulation or the business model prove wrong. Examples include entering a market without understanding local rules, relying on one distribution channel, expanding before achieving product–market fit, or pursuing revenue that conflicts with the organisation’s capabilities.

Strategic controls include documented assumptions, stage-gate investment decisions, scenario planning, competitor monitoring, customer research and periodic review of the business model. Boards and founders should distinguish growth metrics from strategic health. Rising user numbers may coexist with poor retention, excessive discounts or unsustainable acquisition costs.

Financial risk

Financial risks include liquidity shortages, credit losses, foreign-exchange exposure, fraud, inaccurate reporting and excessive dependence on one customer or investor. Growth can worsen financial risk because the venture may pay for staff, inventory and infrastructure before receiving customer cash.

Important controls include rolling cash forecasts, approval limits, segregation of duties, bank reconciliations, budget variance analysis, credit policies and timely financial reporting. A basic cash-flow identity is:

This identity applies over a defined period and requires inflows and outflows to be measured on a consistent cash basis. It is not the same as accounting profit. A venture may report profit while experiencing a cash shortage because customers have not paid or because inventory and capital expenditure have absorbed cash.

Operational risk

Operational risk results from failed people, processes, systems or external events. Examples include poor quality, supply interruption, inadequate staffing, unsafe workplaces, weak procurement and failure to maintain critical equipment.

Operational resilience requires process documentation, role clarity, training, supplier due diligence, quality checks, business-continuity plans and incident escalation. Controls should be designed around critical processes rather than around paperwork. A control that employees routinely bypass is not an effective control, even if a policy document exists.

Cyber and information risk

Cyber risk includes unauthorised access, ransomware, service disruption, data loss, insider misuse and insecure third-party integrations. Scaling ventures often accumulate customer, employee and payment data faster than they develop security capability.

A proportionate cyber programme includes asset inventories, multi-factor authentication, least-privilege access, secure software development, encryption where appropriate, patch management, backups, monitoring, incident response and tested recovery procedures. Privacy should be considered at the design stage through data minimisation, purpose limitation, retention controls and transparent notices. Compliance with a privacy law is a baseline, not a substitute for responsible data stewardship.

Artificial intelligence creates additional risks, including biased outputs, confidential-data leakage, fabricated content, opaque decisions and overreliance on automated recommendations. Before deploying AI, an organisation should identify the decision’s consequences, define human oversight, test performance across relevant groups, document data sources and establish a process for appeal and correction.

Reputational and conduct risk

Reputation is an outcome of repeated stakeholder experiences, not merely a communications asset. Misleading advertising, exploitative pricing, abusive workplace practices, environmental harm, poor complaint handling or concealment of incidents can damage trust.

Reputation should not be managed by suppressing criticism. The stronger approach is to improve conduct, communicate accurately, acknowledge errors and provide remedy. Key indicators may include substantiated complaints, product returns, safety incidents, employee turnover, supplier grievances and correction rates for public claims.

4. Governance for Entrepreneurial Growth

Governance is the system by which an organisation is directed, controlled and held accountable. It includes decision rights, oversight bodies, reporting relationships, policies, incentives and stakeholder engagement. Governance is not synonymous with bureaucracy. Good governance makes authority visible, decisions reviewable and misconduct more difficult.

Governance structures

The appropriate structure depends on ownership, legal form, size, sector and risk. A growing venture may need:

• a board or advisory board with relevant independence and expertise;
• clearly defined founder, executive and board responsibilities;
• committees or designated oversight for audit, risk, remuneration, technology or safety;
• documented delegated authorities;
• conflict-of-interest declarations;
• reliable management information; and
• protected channels for raising concerns.

A board should not become an operational substitute for management. Its role is to challenge assumptions, approve strategy and risk appetite, oversee performance, appoint and evaluate senior leadership, and ensure accountability. Management is responsible for execution and for establishing effective controls.

A practical authority matrix identifies who is responsible, accountable, consulted and informed for significant decisions. For example, a chief technology officer may be responsible for security implementation, the chief executive accountable for the risk posture, legal counsel consulted on privacy obligations, and the board informed through periodic reporting. Ambiguity in these roles creates delays and allows important matters to fall between functions.

Proportionality and risk appetite

Controls should be proportionate to the organisation’s risk profile. A two-person consultancy does not need the same governance architecture as a regulated financial institution. Nevertheless, small size does not justify unsafe or deceptive conduct. At minimum, every venture needs basic financial discipline, legal awareness, privacy protection, incident escalation and ethical leadership.

Risk appetite states the amount and type of risk the organisation is willing to accept in pursuit of objectives. It may be expressed qualitatively, such as zero tolerance for bribery, deliberate privacy violations or unsafe products, and limited tolerance for temporary volatility in marketing expenditure. Risk appetite should guide approval thresholds and escalation rather than remain as a symbolic statement.

5. Internal Controls and the Three Lines of Responsibility

Internal controls are policies, procedures, behaviours and systems designed to provide reasonable assurance that objectives will be achieved. They support effective operations, reliable reporting, legal compliance and protection of assets.

Controls may be:

• Preventive: Stop an error or abuse before it occurs, such as access restrictions.
• Detective: Identify an event after it occurs, such as reconciliation or exception reporting.
• Corrective: Restore operations or prevent recurrence, such as a recovery plan.
• Manual or automated: Performed by people or embedded in technology.
• Entity-level or process-level: Applied across the organisation or within a specific workflow.

The principle of segregation of duties is especially important. Where feasible, different people should authorise a transaction, record it and reconcile the resulting asset. In a very small venture this may not be fully possible; compensating controls could include founder review, bank alerts, external bookkeeping and periodic independent examination.

The three-lines model provides a useful allocation of responsibility:

1. First line: Operational managers own risks and operate controls.
2. Second line: Risk, compliance, security or finance functions advise, set standards and monitor.
3. Third line: Internal audit or an equivalent independent function provides assurance.

The model is a governance aid, not a mandatory organisational design. In a small business, one person may perform several functions, but the lack of separation should be recognised and offset.

Controls also have limitations. Collusion can defeat segregation; senior managers can override procedures; poorly designed incentives can encourage circumvention; and excessive controls can slow legitimate innovation. The aim is reasonable assurance, not certainty.

6. Compliance, Ethics and Stakeholder Accountability

Compliance means meeting applicable legal and regulatory requirements. Ethics concerns what ought to be done, including responsibilities that may exceed minimum legal standards. An action can be legal yet unethical—for example, exploiting an information asymmetry to mislead vulnerable customers. Conversely, ethical conduct may require action before legislation catches up with technology or business models.

A compliance programme should identify obligations, assign owners, assess exposure, train relevant personnel, monitor adherence, retain evidence and update requirements. Entrepreneurs should obtain qualified local advice because employment, tax, consumer protection, competition, data protection, financial services, health and safety and environmental rules vary across jurisdictions.

Ethical reasoning can be strengthened through several questions:

• Is the claim truthful, complete enough and understandable to the intended audience?
• Who benefits and who bears the risk?
• Would the decision remain defensible if publicly disclosed?
• Does it respect consent, dignity, privacy and fair treatment?
• Are vulnerable groups disproportionately affected?
• Can affected people challenge, correct or obtain remedy for the decision?
• Does the incentive system reward responsible behaviour or concealment?

Stakeholder accountability recognises that shareholders are not the only parties affected by growth. Customers, employees, suppliers, communities, regulators, investors and the natural environment may bear consequences. Stakeholder analysis should identify interests, power, vulnerability, likely impact and appropriate engagement. Consultation is not a substitute for responsibility: an organisation cannot justify foreseeable harm simply because it asked stakeholders for opinions.

7. Avoiding Harmful and Deceptive Growth Practices

Pressure to grow can distort judgement. Common harmful practices include:

• Misleading acquisition: hidden fees, fabricated testimonials, unclear subscription renewal or dark patterns that steer users into unwanted choices.
• Misrepresentation: inflated performance claims, selective statistics, fake scarcity or unsupported sustainability claims.
• Exploitative monetisation: targeting children or vulnerable people with manipulative products, excessive penalties or deliberately confusing terms.
• Unsafe scaling: launching products before adequate testing, support or safety controls exist.
• Labour exploitation: misclassifying workers, withholding pay, imposing unrealistic targets or shifting unreasonable risk to contractors.
• Metric manipulation: purchasing fake users, suppressing complaints, changing definitions or presenting vanity metrics as evidence of sustainable performance.
• Regulatory evasion: designing transactions or corporate structures primarily to conceal responsibility or avoid legitimate oversight.

Responsible alternatives include plain-language disclosures, informed consent, easy cancellation, substantiated claims, independent product testing, fair complaint resolution, worker protections and transparent performance metrics. Growth experiments should have ethical guardrails, stopping rules and post-launch monitoring. A/B testing should not expose one group to material harm merely to improve conversion.

8. A Practical Responsible-Growth Architecture

A venture can build a governance architecture in stages.

Stage 1: Foundation

Document the purpose, legal structure, key obligations, decision rights, financial controls, data assets and critical processes. Establish a code of conduct and a confidential route for raising concerns. Identify risks that could threaten survival or cause serious harm.

Stage 2: Formalisation

Create a risk register, approval matrix, incident-management process, supplier due-diligence procedure and recurring management dashboard. Introduce access controls, reconciliations, contract review and documented board or advisory meetings.

Stage 3: Integration

Link risk indicators to strategy and resource allocation. Include risk and ethical analysis in product development, market entry, acquisitions, pricing and incentive design. Test business continuity, cyber recovery and crisis communications.

Stage 4: Assurance and learning

Review whether controls operate in practice. Use internal reviews, external assurance, customer feedback, employee voice and post-incident analysis. Track remediation to completion and report unresolved high risks to the appropriate authority.

A useful dashboard combines lagging and leading indicators. A lagging indicator might be the number of confirmed data breaches; a leading indicator might be the percentage of privileged accounts protected by multi-factor authentication. Financial measures should be balanced with safety, quality, employee, customer, compliance and environmental indicators.

9. Applied Case: Rapid Expansion at CareConnect

The following is an illustrative fictional case.

Background

CareConnect is a digital platform connecting older adults with independent home-care providers. After gaining traction in one city, the venture received investment conditional on expanding to ten cities within twelve months. Management announced a target of 100,000 registered users and introduced automated matching based on customer preferences, provider ratings and historical booking data.

Problem

To accelerate expansion, the company shortened provider checks, allowed customer-service staff to share accounts, and retained identity documents indefinitely. Marketing described providers as “verified professionals,” although verification consisted mainly of identity confirmation and references. The algorithm systematically gave lower visibility to providers with non-standard work histories. Customer complaints rose, but the growth team excluded them from the investor dashboard because they were classified as “non-conversion interactions.” A serious injury occurred during a booking, revealing that insurance coverage and incident escalation responsibilities were unclear.

Analysis

The venture faced interconnected risks:

• Strategic: expansion exceeded the capacity of training, supervision and support.
• Operational: inconsistent provider screening and unclear incident procedures.
• Cyber and privacy: excessive retention of sensitive identity documents and shared accounts.
• Legal and compliance: potentially misleading verification claims and uncertain worker classification.
• Ethical: vulnerable customers were encouraged to rely on a level of assurance the company could not substantiate.
• Reputational: concealment of complaints threatened trust and investor confidence.

The central governance failure was not one defective algorithm or one careless employee. It was the absence of aligned accountability. Growth incentives rewarded registrations, while no senior owner was accountable for safety outcomes. The board received volume metrics without risk indicators.

Approach and solution

The company paused expansion in the highest-risk categories and established a safety and trust committee. It revised marketing claims to distinguish identity checks, references, qualifications and background screening. It introduced documented provider tiers, minimum insurance requirements, incident reporting and customer compensation rules. Access to identity documents was restricted, retention periods were defined, and shared accounts were replaced with individual accounts protected by multi-factor authentication.

The matching system was reviewed for disparate effects. Management documented the factors used, tested outcomes across relevant groups and created a human review and appeal process. Complaints were reported as a quality metric rather than excluded from performance reporting. Expansion became conditional on readiness criteria: trained support capacity, verified providers, tested incident response, acceptable complaint trends and board review.

Outcome

Growth slowed temporarily, but customer retention improved, serious incidents were escalated more quickly and the venture gained stronger confidence from insurers and institutional partners. The company did not eliminate risk; instead, it made risk visible, assigned ownership and aligned growth with capability.

Learning points

1. A growth target is not a control system.
2. Claims must match the evidence supporting them.
3. Data minimisation and access discipline are strategic safeguards.
4. Complaints are information about product quality, not merely obstacles to conversion.
5. Responsible scaling requires readiness gates and accountable leadership.

10. Challenges and Limitations

Risk frameworks can fail when they become compliance rituals. Risk registers may be copied forward, ratings may be influenced by politics, and dashboards may measure what is easy rather than what matters. Quantitative scores can create false confidence, especially where data is limited or consequences are difficult to monetise.

Entrepreneurs also face resource constraints. Independent directors, legal advice, security tools and audit activities can be expensive. The response should be prioritisation, not neglect. Start with risks that could cause severe harm, legal breach, loss of essential cash, or irreversible reputational damage. Use external specialists where internal expertise is insufficient.

There are also genuine tensions. Strong privacy may limit personalisation; cautious product testing may slow launch; fair employment practices may increase short-term cost; and transparent reporting may make performance appear weaker than competitors. These tensions should be analysed openly rather than hidden behind slogans. Responsible growth is not risk-free growth. It is growth in which trade-offs are explicit, justified and subject to accountability.

11. Contemporary Developments and Professional Implications

Several developments are reshaping governance. Digital platforms create complex relationships in which the organisation may influence work, pricing and access without being a traditional employer. Generative AI increases the speed and scale of content and decision-making while creating new risks of error and opacity. Supply-chain regulation is increasing expectations around labour and environmental due diligence. Investors and customers increasingly examine non-financial performance, but this also creates incentives for superficial reporting or greenwashing.

Future managers therefore need hybrid competence. They must understand strategy and finance, but also data governance, cyber hygiene, employment responsibilities, consumer protection, sustainability claims and organisational culture. Employability increasingly depends on the ability to ask difficult questions: What evidence supports this claim? Who owns this risk? What happens when the system fails? Can the affected person obtain an explanation or remedy? Would the organisation accept this practice if competitors, employees and regulators could observe it?

Best-Practice Checklist

Before approving a major growth initiative, management should be able to answer “yes” to most of the following:

• Are the objective, assumptions and success measures explicit?
• Has a cross-functional risk assessment been completed?
• Is there a named risk owner with authority and resources?
• Are legal, privacy, safety and ethical implications understood?
• Are controls designed into the process rather than added later?
• Can financial and non-financial performance be reported accurately?
• Are claims to customers and investors supported by evidence?
• Have vulnerable stakeholders and unintended consequences been considered?
• Are incident, complaint, whistleblowing and remedy processes available?
• Is there a clear stop, pause or escalation condition?
• Has the organisation tested its ability to recover from failure?
• Will the board or equivalent oversight body receive information sufficient to challenge the decision?

Chapter Summary

Scaling increases not only opportunity but also complexity, interdependence and accountability. Responsible growth integrates enterprise risk management, governance, internal controls, compliance and ethics into strategic decision-making. Risk should be described clearly, assessed using consistent assumptions and assigned to accountable owners. Strategic, financial, operational, cyber and reputational risks require different but connected controls.

Governance clarifies authority and oversight; internal controls provide reasonable assurance; compliance establishes the legal baseline; and ethics addresses responsibilities that law may not fully capture. Stakeholder accountability requires attention to customers, workers, suppliers, communities, investors and the environment. Deceptive acquisition, misleading claims, unsafe scaling, exploitative labour and metric manipulation may produce short-term growth but undermine long-term legitimacy.

The CareConnect case demonstrates that responsible growth depends on readiness, truthful communication, data discipline, incident learning and aligned incentives. Effective entrepreneurs do not attempt to eliminate uncertainty. They create systems that make uncertainty visible, constrain unacceptable conduct, support informed decisions and provide remedy when harm occurs.

Key Terms

Risk: The effect of uncertainty on objectives.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls operate.

Risk owner: The person accountable for managing a specified risk.

Governance: The system by which an organisation is directed, controlled and held accountable.

Internal control: A policy, process or behaviour designed to provide reasonable assurance about objectives.

Compliance: Conformity with applicable legal and regulatory requirements.

Ethics: Principles concerning responsible and justifiable conduct.

Stakeholder: A party that affects or is affected by the organisation.

Segregation of duties: Dividing authorisation, recording and reconciliation responsibilities.

Preventive control: A control intended to stop an error or abuse before it occurs.

Detective control: A control intended to identify an event after it occurs.

Corrective control: A control intended to restore operations or prevent recurrence.

Risk register: A structured record of risks, controls, owners and actions.

Risk velocity: The speed at which a risk produces consequences.

Residual risk: The risk remaining after control measures are considered.

Responsible growth: Expansion that is strategically, financially, operationally, legally and ethically sustainable.

Dark pattern: A design practice that manipulates users into choices they may not otherwise make.

Greenwashing: Misleading communication that exaggerates or falsely presents environmental performance.

Review Questions

Short Answer Questions

1. How does a risk differ from a problem and from a cause?
2. What is the purpose of a risk appetite statement?
3. Distinguish preventive, detective and corrective controls.
4. Why is compliance not equivalent to ethics?
5. What is the purpose of segregation of duties?

Long Answer Questions

1. Explain how growth changes a venture’s strategic, financial, operational, cyber and reputational risk exposure.
2. Discuss the role of governance and the board in a scaling entrepreneurial venture.
3. Explain the three lines of responsibility and evaluate their usefulness in a small enterprise.
4. Analyse how incentives and performance metrics can encourage harmful or deceptive growth.
5. Develop a proportionate responsible-growth architecture for a venture expanding into a new country.

Analytical / Application Questions

1. A subscription start-up reports rising sign-ups but also increasing cancellations, complaints and refund requests. Identify the likely governance and ethical issues, and recommend controls and indicators.
2. A company wants to use customer data to train an AI recommendation system. Analyse the privacy, fairness, security and accountability questions that should be answered before deployment.
3. A founder proposes entering a market quickly despite incomplete supplier checks because a competitor is preparing to launch. Use risk-response and stakeholder-accountability principles to evaluate the proposal and recommend a decision process.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk before any controls are considered

B. Risk remaining after controls are considered

C. A problem that has already occurred

D. Risk transferred entirely to an insurer

Correct Answer: B. Risk remaining after controls are considered

Question 2

In the simple prioritisation model R = L × I, what do L and I represent?

A. Liquidity and income

B. Loss and insurance

C. Likelihood and impact

D. Legal exposure and investment

Correct Answer: C. Likelihood and impact

Question 3

Which is primarily a preventive control?

A. A post-incident investigation

B. A bank reconciliation

C. Multi-factor authentication before account access

D. A customer complaint report

Correct Answer: C. Multi-factor authentication before account access

Question 4

Which responsibility generally belongs to the first line of the three-lines model?

A. Operating controls within business processes

B. Providing independent assurance

C. Setting external accounting standards

D. Replacing the board of directors

Correct Answer: A. Operating controls within business processes

Question 5

Why can a venture report accounting profit while experiencing a cash shortage?

A. Profit always excludes revenue

B. Cash flow and profit are identical measures

C. Customers may not yet have paid and cash may be tied up in inventory or investment

D. Cash shortages occur only when sales are increasing

Correct Answer: C. Customers may not yet have paid and cash may be tied up in inventory or investment

Question 6

Which practice is an example of a dark pattern?

A. Providing a clear cancellation button

B. Explaining data use in plain language

C. Using confusing design to steer users into unwanted recurring charges

D. Offering customers a choice between two clearly labelled plans

Correct Answer: C. Using confusing design to steer users into unwanted recurring charges

Question 7

What is the principal purpose of a risk owner?

A. To guarantee that the risk cannot occur

B. To accept accountability for managing and escalating the risk

C. To transfer every risk to an external provider

D. To prepare marketing material about the risk

Correct Answer: B. To accept accountability for managing and escalating the risk

Question 8

Which statement about expected monetary value is most accurate?

A. It eliminates the need to consider catastrophic low-probability events

B. It is calculated by summing probability multiplied by loss across defined scenarios

C. It can be calculated without estimating probabilities

D. It is the same as an ordinal risk score

Correct Answer: B. It is calculated by summing probability multiplied by loss across defined scenarios

Question 9

A company advertises providers as fully verified when it has only confirmed their identity. What is the central issue?

A. Excessive segregation of duties

B. Potentially misleading representation and inadequate assurance

C. A harmless branding choice

D. A purely technical network problem

Correct Answer: B. Potentially misleading representation and inadequate assurance

Question 10

Which action best demonstrates responsible scaling?

A. Excluding complaints from investor reports to protect conversion metrics

B. Expanding first and designing safety controls after incidents occur

C. Making expansion conditional on capability, controls and monitored outcomes

D. Using the same risk controls regardless of sector or organisation size

Correct Answer: C. Making expansion conditional on capability, controls and monitored outcomes