Ethics, Governance, Sustainability and Enterprise Risk

Introduction

International business creates value through cross-border investment, trade, technology, finance, employment and knowledge transfer. It also exposes firms to ethical dilemmas and interconnected risks. A multinational enterprise may face bribery demands from public officials, unsafe working conditions in a supplier facility, forced labour in a raw-material chain, rapidly changing climate regulation, aggressive tax-planning criticism, cyber-enabled fraud and political instability—all within one strategic decision.

These issues should not be managed as isolated compliance topics. They are connected through stakeholder relationships, governance systems, organisational incentives and enterprise risk management. A decision that appears financially attractive may create legal liability, supply disruption, environmental damage and reputational loss. Conversely, strong ethical conduct and sustainability capabilities can support resilience, innovation, market access and stakeholder trust.

This chapter develops an integrated approach to ethics, environmental, social and governance (ESG) performance, corporate governance and enterprise risk. It focuses on corruption, human rights, responsible sourcing, climate risk, tax conduct and compliance, while showing how political, operational and reputational risks can be identified, assessed, treated and monitored.

Learning Objectives

By the end of this chapter, readers should be able to:

1. Explain stakeholder theory and its relevance to international business decisions.
2. Distinguish ESG performance, corporate responsibility, compliance and sustainability.
3. Evaluate governance controls for corruption, human rights, sourcing, tax and climate risk.
4. Construct an integrated political, operational and reputational risk system.
5. Apply risk assessment, due diligence, escalation and assurance processes to managerial problems.
6. Critically assess the limitations of ESG metrics, voluntary standards and compliance-based approaches.

1. Stakeholder Theory and Responsible International Business

1.1 From shareholder primacy to stakeholder accountability

Shareholder-oriented theories emphasise the firm's duty to create lawful economic value for owners. Stakeholder theory broadens the analysis by recognising that firms affect, and depend upon, employees, customers, suppliers, communities, governments, investors, creditors, civil society and the natural environment. Stakeholders may possess different levels of power, legitimacy and urgency, and their interests may conflict.

A useful managerial question is not simply, “What maximises short-term profit?” but rather:

• Who is affected by this decision?
• Who has a legitimate claim on the firm?
• Who bears the downside risk?
• Which impacts are reversible, and which are not?
• What duties arise from law, contracts, human rights and the firm's own commitments?

Stakeholder theory does not mean that every demand must be accepted. It requires systematic identification, transparent prioritisation and reasoned justification. A firm may reject an uneconomic demand, but it should not conceal material impacts or transfer avoidable risks to parties with little bargaining power.

1.2 Stakeholder salience

Stakeholder salience is often assessed through three attributes: power, legitimacy and urgency. A regulator may have power and legitimacy; a local community may have strong legitimacy but limited formal power; an affected worker may have an urgent claim even when unable to influence management directly.

The model is useful but imperfect. It can reproduce managerial bias if “power” is treated as more important than rights. Human-rights due diligence therefore requires attention to vulnerable groups even when they are not influential stakeholders. Salience should guide engagement, not determine whose dignity matters.

1.3 Ethical reasoning in international settings

Managers commonly use several ethical lenses:

• Consequentialism: assesses the likely benefits and harms of alternatives.
• Deontology: asks whether an action respects duties, rights and principles regardless of its outcome.
• Virtue ethics: considers the character and integrity demonstrated by the organisation.
• Justice and fairness: examines the distribution of benefits, risks and opportunities.
• Care ethics: focuses on relationships, dependency and responsibility toward vulnerable parties.

Cross-border operations make ethical judgement difficult because legal standards, social norms and enforcement capacities differ. Local custom cannot justify conduct that violates fundamental rights or the firm's non-negotiable principles. At the same time, headquarters should avoid imposing culturally insensitive policies without understanding local institutions and lived realities.

2. ESG, Sustainability and Governance

2.1 Distinguishing related concepts

Sustainability concerns the capacity to create value without undermining the ecological, social and institutional conditions on which future value depends. ESG is a framework for organising information about environmental, social and governance matters that may affect enterprise performance and stakeholder outcomes. Corporate responsibility describes the firm's duties and commitments toward society. Compliance means meeting applicable laws, regulations, contractual obligations and internal requirements.

These concepts overlap but are not identical. A firm can be legally compliant while causing serious social harm. It can also report ESG indicators while failing to change underlying practices. Effective management connects policy, decision rights, incentives, operational controls, data, assurance and remedy.

2.2 Materiality

Financial materiality asks whether an issue could affect enterprise value, cash flows, access to capital or reputation. Impact materiality asks whether the firm's activities significantly affect people or the environment. Some reporting regimes combine these perspectives, often called double materiality.

Materiality is not merely a numerical threshold. A low-probability event involving severe human-rights abuse may deserve priority because its impact is irreversible and morally significant. Managers should therefore combine quantitative exposure with severity, vulnerability, reversibility, legal duties and stakeholder expectations.

2.3 Governance as a control architecture

Corporate governance allocates authority and accountability among shareholders, the board, executives, control functions and stakeholders. Effective governance normally includes:

1. Board responsibility for purpose, strategy, risk appetite and culture.
2. Independent challenge through non-executive directors or equivalent structures.
3. Clear executive ownership of ESG and compliance risks.
4. Separation, where appropriate, between operational decision-making and assurance.
5. Reliable reporting, escalation and investigation channels.
6. Incentives that do not reward misconduct or concealment.
7. Protection for whistleblowers and access to remedy.

Governance codes differ across jurisdictions, but the basic principle is consistent: responsibility must be assigned before performance can be monitored. “Everyone is responsible” often means that no one is accountable.

3. Corruption and Anti-Bribery Controls

Corruption includes bribery, extortion, facilitation payments, fraud, embezzlement, nepotism and trading in influence. International firms face heightened risk when they depend on intermediaries, operate in sectors requiring licences or customs approvals, or enter markets with weak institutions.

3.1 The corruption risk cycle

A robust anti-corruption programme contains five connected elements:

• Risk assessment: identify countries, transactions, functions and third parties presenting elevated risk.
• Prevention: establish policies, training, segregation of duties, approval thresholds and due diligence.
• Detection: use audits, analytics, conflict-of-interest declarations, hotlines and transaction monitoring.
• Response: investigate promptly, preserve evidence, protect reporters and apply proportionate sanctions.
• Remediation: recover losses, improve controls, disclose when appropriate and address root causes.

A code of conduct alone is inadequate. If sales staff are rewarded exclusively for volume, distributors are paid unusually high commissions and managers ignore warning signs, the control environment contradicts the policy.

3.2 Third-party intermediaries

Agents, consultants, distributors, customs brokers and joint-venture partners can create indirect bribery exposure. Due diligence should consider ownership, beneficial owners, government connections, qualifications, compensation, services actually performed, litigation and adverse media. Contracts should include audit rights, compliance representations, training obligations, payment restrictions and termination rights. These provisions are useful only when monitored and enforced.

Red flags include requests for cash, vague invoices, offshore accounts unrelated to operations, unusually high commissions, pressure to bypass procurement, refusal to disclose ownership and demands for “success fees” linked to government decisions.

4. Human Rights and Responsible Sourcing

4.1 Human-rights due diligence

Human-rights due diligence is a continuing management process rather than a one-time supplier questionnaire. It normally involves:

1. Embedding commitments in policies and governance.
2. Identifying and assessing actual and potential adverse impacts.
3. Integrating findings into purchasing, design and operational decisions.
4. Tracking whether prevention and mitigation are effective.
5. Communicating how impacts are addressed.
6. Providing or cooperating in legitimate remediation.

The distinction between causing, contributing to and being directly linked to an impact matters. A company that directly causes unsafe conditions has a different responsibility from one whose purchasing practices contribute to excessive overtime, or one linked through a complex commodity chain. Distance does not automatically eliminate responsibility.

4.2 Responsible sourcing

Responsible sourcing extends beyond price, quality and delivery. Procurement should evaluate labour standards, environmental performance, traceability, corruption exposure, data integrity and supplier resilience. Contracting with the cheapest supplier while imposing unrealistic lead times may create the conditions for unauthorised subcontracting or forced overtime.

Audits are useful but limited. They may miss informal labour, falsified records, worker intimidation or conditions that change after the audit. Stronger systems combine worker interviews, grievance channels, unannounced assessments, purchasing-data analysis, supplier capability-building and credible remediation.

Important indicators may include injury rates, excessive overtime, wage payment records, recruitment fees, worker turnover, grievance resolution, subcontracting changes and origin documentation. Metrics should be disaggregated by gender, employment status, location and other relevant vulnerability factors.

4.3 Remedy and grievance mechanisms

A legitimate grievance mechanism should be accessible, predictable, understandable, confidential where possible, non-retaliatory and capable of producing remedy. Remedy may involve repayment of wages, medical support, reinstatement, compensation, corrective action or institutional change. A hotline that merely records complaints without investigation is not an effective remedy system.

5. Climate Risk and Environmental Responsibility

Climate change creates both physical and transition risks. Physical risks arise from acute events such as floods, fires and storms, and chronic changes such as heat, sea-level rise and water scarcity. Transition risks arise from policy, technology, market, legal and consumer changes associated with decarbonisation.

5.1 Climate-risk transmission

Climate events affect firms through operational channels: damaged facilities, interrupted transport, unavailable inputs, worker health impacts, insurance costs and reduced demand. They can also create financial effects through asset impairment, credit deterioration and higher cost of capital.

A simple expected-loss expression is:

Probability is dimensionless, while loss is measured in currency or another defined unit. The expression is useful for comparable, approximately independent exposures, but it is not a complete climate model. It may understate tail risks, correlation, uncertainty, adaptation costs and non-financial harm.

For multiple scenarios, a weighted expected value can be represented as:

where E(L) is expected loss, pᵢ is the probability assigned to scenario i, Lᵢ is the loss under scenario i, and ∑ᵢpᵢ = 1. Scenario analysis should not be confused with prediction: it explores plausible conditions and strategic sensitivity.

5.2 Transition planning

A credible transition plan links targets to capital expenditure, product design, procurement, executive incentives and operational milestones. It should identify assumptions, dependencies, interim targets, residual emissions and governance responsibility. Offsets should not be used to conceal continued avoidable emissions, and environmental claims should be supported by evidence.

Managers should test whether a proposed target is:

• measurable and based on a defined boundary;
• supported by reliable baseline data;
• consistent with available technology and investment;
• monitored through interim milestones; and
• transparent about uncertainty and limitations.

6. Tax Conduct and Compliance

Tax is both a legal obligation and a governance issue. International groups must manage transfer pricing, permanent-establishment risk, withholding taxes, customs duties, incentives, disclosure requirements and anti-avoidance rules. Legal tax planning is not automatically ethically unproblematic if it exploits gaps in law, shifts profits without substantive activity or deprives jurisdictions of expected public revenue.

A responsible tax policy normally addresses:

• compliance with the letter and purpose of applicable law;
• alignment between taxable profit and substantive economic activity;
• governance of tax risk at board or audit-committee level;
• accurate, timely records and documentation;
• transparent engagement with tax authorities; and
• restrictions on opaque structures lacking commercial substance.

Tax control failures often resemble other compliance failures: unclear ownership, fragmented data, weak review, excessive performance pressure and poor escalation. Tax should therefore be included in enterprise risk registers rather than treated only as a technical accounting matter.

7. Integrated Enterprise Risk Management

7.1 Risk categories and interdependence

Political risk includes expropriation, sanctions, civil unrest, regulatory change, trade restrictions and state interference. Operational risk includes process failure, supplier disruption, cyber incidents, accidents and inadequate capacity. Reputational risk concerns loss of trust among stakeholders. These categories interact. A bribery investigation may trigger regulatory sanctions, interrupt licences, damage brand value and increase financing costs.

A risk taxonomy provides common language, but managers must avoid artificial silos. The same root cause—such as pressure to meet unrealistic growth targets—may generate corruption, labour, safety, quality and reporting risks simultaneously.

7.2 Risk assessment

A practical assessment considers at least:

• likelihood or frequency;
• financial magnitude;
• legal and regulatory exposure;
• human and environmental severity;
• speed of onset;
• duration and reversibility;
• vulnerability of affected stakeholders;
• control effectiveness; and
• interdependence with other risks.

A qualitative heat map is useful for communication but can create false precision. A score such as “likelihood × impact” is a prioritisation aid, not an objective measurement of reality. Extreme events, rights violations and systemic risks should not be downgraded merely because their probability is difficult to estimate.

7.3 Risk appetite and controls

Risk appetite defines the type and amount of uncertainty the organisation is willing to accept in pursuing objectives. It should distinguish tolerable commercial volatility from prohibited conduct. For example, a firm may tolerate demand uncertainty but have zero tolerance for bribery, retaliation against whistleblowers or forced labour.

Controls may be:

• Preventive: approvals, segregation of duties, supplier screening and access restrictions.
• Detective: reconciliations, audits, analytics, inspections and complaints.
• Corrective: disciplinary action, remediation, recovery and process redesign.
• Directive: policies, training, leadership statements and incentive design.

The three-lines model is often useful: operational management owns and manages risk; risk, compliance and similar functions support and challenge; internal audit provides independent assurance. The board and relevant committees oversee the overall system.

7.4 Risk indicators and escalation

Key risk indicators should be linked to decisions. Examples include unexplained third-party payments, high-risk suppliers lacking current assessments, unresolved serious grievances, repeated safety incidents, concentration in climate-exposed facilities, unusual tax adjustments and regulatory inquiries.

Thresholds should specify the owner, required action, escalation route and response time. A dashboard without decision rules is a reporting product, not a control system.

8. An Integrated Management Process

The following process connects ethics, ESG and enterprise risk:

1. Set purpose and non-negotiable standards. Define prohibited conduct, rights commitments, environmental principles and tax expectations.
2. Map the value chain. Identify subsidiaries, joint ventures, intermediaries, suppliers, logistics routes, assets and affected communities.
3. Assess impacts and enterprise exposure. Combine stakeholder engagement, legal analysis, operational data and scenario analysis.
4. Prioritise. Consider severity, likelihood, vulnerability, reversibility, financial exposure and strategic importance.
5. Design controls and decisions. Allocate ownership, alter procurement or investment choices, and provide resources for mitigation.
6. Monitor and learn. Use indicators, audits, worker feedback, incident analysis and independent assurance.
7. Escalate and remedy. Investigate credible concerns, protect affected people and correct both immediate and systemic causes.
8. Report with integrity. Explain boundaries, methods, uncertainty, adverse outcomes and progress—not only favourable indicators.

This process should be embedded in investment approval, mergers and acquisitions, product development, market entry, sourcing, executive remuneration and crisis management.

9. Illustrative Case: Meridian Apparel's Responsible Sourcing Failure

Background

Meridian Apparel, a fictional international clothing company, sourced garments through a regional buying office. Its public reports emphasised worker welfare and responsible production. Procurement managers, however, received bonuses primarily for reducing unit cost and meeting delivery dates.

Problem

A civil-society investigation alleged excessive overtime, recruitment-fee debt and locked emergency exits at a subcontracted factory. Meridian had audited the first-tier supplier twice and found no critical breach. Subsequent review showed that the supplier had subcontracted peak-season orders without approval. Meridian's purchasing team had also reduced lead times after a marketing campaign.

The event created human-rights, operational, legal and reputational exposure. It also raised governance questions: who approved the compressed schedule, why was subcontracting not detected, and did the audit programme create false assurance?

Analysis

A stakeholder analysis identified workers and migrant labourers as highly vulnerable, even though they had little formal power. The firm's responsibility was greater than a narrow contractual analysis suggested because its purchasing decisions contributed to pressure on the supplier. The audit system focused on document compliance rather than worker experience and production-capacity realism.

The risk assessment identified several connected risks:

Approach and solution

Meridian suspended new orders at the facility while ensuring that suspension did not leave workers unpaid or abandoned. It commissioned an independent investigation, engaged worker representatives and required repayment of improper recruitment fees. It revised purchasing calendars, introduced capacity checks, required disclosure of subcontractors and established a grievance channel available in relevant languages.

The board changed procurement incentives to include verified labour outcomes, supplier transparency and remediation performance. Internal audit tested whether the new controls operated in practice. Meridian also disclosed the incident, its uncertainty and its corrective actions rather than presenting the next audit as proof that the problem had disappeared.

Outcome

Over the following year, unauthorised subcontracting declined, recruitment-fee repayment was documented and worker complaints increased initially because the grievance channel became more accessible. Management treated the increase in complaints as information about system use rather than automatic evidence of worsening conditions. Some suppliers exited because they could not meet the new standards, while others received capability-building support.

Learning points

1. A clean first-tier audit does not prove that a value chain is responsible.
2. Commercial decisions can contribute to human-rights impacts.
3. Incentives and purchasing practices are governance controls.
4. Remediation must protect affected people, not merely protect the brand.
5. Disclosure is credible when it includes failures, uncertainty and corrective evidence.

10. Technology, Data and AI in Risk Management

Technology can improve supply-chain mapping, transaction monitoring, satellite-based environmental observation, emissions accounting and scenario analysis. Machine-learning tools may identify unusual payments or supplier patterns, but they do not determine whether conduct is ethical or lawful.

Key risks include poor data quality, biased training data, opaque models, privacy violations, false positives and automation bias. A system that flags suppliers in particular countries without examining actual conduct may unfairly shift risk or encourage discriminatory de-risking. Human review, documented model governance, access controls, audit trails and appeal processes are essential.

AI-generated ESG information also creates assurance risks. Managers should verify source data, calculation boundaries, provenance and material assumptions. Technology should support accountability, not obscure it.

11. Challenges and Limitations

Measurement limitations

ESG indicators are not fully standardised across jurisdictions and providers may use different boundaries, weights and estimation methods. A high rating may reflect disclosure quality rather than real-world impact. Quantification can also privilege easily measured issues over dignity, cultural loss or long-term ecological damage.

Greenwashing and ethics-washing

Greenwashing occurs when communication exaggerates environmental performance. Ethics-washing similarly presents codes, donations or memberships as evidence of responsible conduct without changing harmful practices. Strong claims should be specific, evidence-based, time-bound and clear about exclusions.

Audit limitations

Audits may be announced, narrow in scope, manipulated by suppliers or disconnected from worker voice. Assurance improves reliability but does not transfer management responsibility to auditors.

Conflicting objectives

A company may face tension between rapid market entry and due diligence, low prices and living wages, tax efficiency and public legitimacy, or facility closure and worker welfare. Ethical management requires transparent trade-offs, not claims that all objectives can always be maximised simultaneously.

Institutional differences

Weak governance environments may make formal controls difficult to implement. Firms should adapt methods to local conditions without lowering fundamental standards. Collaboration with industry groups, unions, communities and public institutions may be necessary, but collaboration must not become an excuse for collective inaction.

12. Best-Practice Principles for Managers

• Make the board and senior executives accountable for culture and material ESG risks.
• Integrate human, environmental, political and financial risk assessments.
• Apply enhanced due diligence where vulnerability and potential severity are high.
• Align purchasing, sales and remuneration systems with stated values.
• Treat third parties, joint ventures and subsidiaries as part of the control environment.
• Use worker, community and customer voice alongside documentary evidence.
• Establish confidential reporting and credible non-retaliation protections.
• Separate management claims from independent assurance.
• Report adverse events and limitations candidly.
• Test controls through scenarios, investigations and lessons from near misses.
• Review risk appetite as geopolitical, technological and climate conditions change.

Chapter Summary

International business ethics and sustainability are strategic governance issues rather than peripheral public-relations activities. Stakeholder theory helps managers identify affected parties and assess competing claims, while ethical theories provide different ways to evaluate duties, consequences, fairness and organisational character. ESG organises environmental, social and governance concerns, but meaningful performance depends on decision rights, incentives, controls, data and remedy.

Corruption controls require risk assessment, third-party due diligence, prevention, detection, investigation and remediation. Human-rights due diligence must address actual and potential impacts throughout the value chain and must include accessible remedy. Responsible sourcing requires attention to purchasing practices, subcontracting, worker voice and supplier capability. Climate risk includes physical and transition channels and should be examined through scenarios rather than treated as a simple forecast. Tax conduct belongs within governance because legal form, economic substance, transparency and public legitimacy are connected.

Political, operational and reputational risks are interdependent. An integrated system maps the value chain, assesses severity and likelihood, assigns ownership, sets risk appetite, monitors indicators, escalates concerns and learns from incidents. Technology can strengthen monitoring but cannot replace human judgement, accountability or ethical reasoning. Finally, ESG ratings, audits and disclosures have limitations; credible management requires evidence, transparency and a willingness to address adverse outcomes.

Key Terms

Stakeholder theory: The view that firms have responsibilities to parties affected by and contributing to organisational activity.

Stakeholder salience: The relative importance of a stakeholder claim based on power, legitimacy and urgency.

ESG: Environmental, social and governance factors used to assess organisational impacts, risks and performance.

Sustainability: Creating value while preserving the ecological, social and institutional conditions needed for the future.

Corporate governance: The system by which organisations are directed, controlled and held accountable.

Materiality: The significance of an issue for enterprise decisions, stakeholder impacts or both.

Double materiality: Assessment of both effects on enterprise value and effects of the enterprise on people and the environment.

Corruption: Abuse of entrusted power for private or improper advantage.

Third-party due diligence: Investigation and ongoing monitoring of intermediaries, suppliers and other business partners.

Human-rights due diligence: A continuing process to identify, prevent, mitigate, track and communicate responses to human-rights impacts.

Responsible sourcing: Procurement that considers ethical, social, environmental, legal and resilience criteria as well as price and quality.

Remedy: Action taken to correct or compensate for an adverse impact.

Physical climate risk: Risk arising from acute or chronic climate-related physical changes.

Transition risk: Risk arising from changes associated with movement toward a lower-carbon economy.

Risk appetite: The level and type of uncertainty an organisation is willing to accept.

Key risk indicator: A measure that signals changing exposure or control effectiveness.

Three-lines model: An arrangement separating operational ownership, risk support and independent assurance.

Greenwashing: Misleading presentation of environmental performance or benefits.

Whistleblower: A person who reports suspected wrongdoing through an internal or external channel.

Review Questions

Short Answer Questions

1. What are the three principal attributes commonly used to assess stakeholder salience?
2. Distinguish compliance from sustainability.
3. Identify two limitations of supplier audits.
4. What is the difference between physical and transition climate risk?
5. Why should tax conduct be included in enterprise risk management?

Long Answer Questions

1. Explain how stakeholder theory can improve strategic decision-making in a multinational enterprise.
2. Discuss the design of an effective anti-corruption programme, including third-party controls.
3. Evaluate the role and limitations of human-rights due diligence in global supply chains.
4. Explain how governance, incentives and assurance interact in an ESG control system.
5. Analyse why political, operational and reputational risks should be managed as an interconnected system.

Analytical / Application Questions

1. A firm discovers that its supplier used unauthorised subcontractors after the firm imposed a shortened delivery schedule. Analyse the firm's responsibilities and recommend immediate and long-term actions.
2. Design a risk dashboard for a multinational entering a climate-exposed, corruption-prone market. Specify indicators, owners, thresholds and escalation actions.
3. A company reports excellent ESG ratings but faces worker allegations, opaque tax structures and unexplained agent commissions. Develop an investigation and governance response that tests whether its ESG performance is substantive or merely presentational.

Multiple Choice Questions with Answers

Question 1

Which feature most directly distinguishes stakeholder theory from a narrow shareholder-primacy approach?

A. It rejects the need for profitability.

B. It recognises legitimate interests of parties affected by the firm.

C. It requires managers to accept every stakeholder demand.

D. It applies only to nonprofit organisations.

Correct Answer: B. It recognises legitimate interests of parties affected by the firm.

Question 2

Which control is primarily preventive in an anti-corruption programme?

A. Post-incident disciplinary action

B. A newspaper investigation

C. Pre-approval and due diligence for high-risk intermediaries

D. A retrospective loss calculation

Correct Answer: C. Pre-approval and due diligence for high-risk intermediaries

Question 3

Why can a first-tier supplier audit fail to identify serious human-rights risks?

A. Audits always measure financial performance only.

B. Audits may miss subcontracting, falsified records and worker intimidation.

C. Supplier audits are prohibited under international law.

D. Audits cannot examine any documentary evidence.

Correct Answer: B. Audits may miss subcontracting, falsified records and worker intimidation.

Question 4

Which statement best describes double materiality?

A. It measures only the effect of regulation on profit.

B. It assesses both enterprise-value effects and the firm's impacts on people and the environment.

C. It gives environmental issues twice the numerical weight of governance issues.

D. It applies only to carbon emissions.

Correct Answer: B. It assesses both enterprise-value effects and the firm's impacts on people and the environment.

Question 5

A climate scenario has probability 0.20 and loss of $5 million. Using expected loss = probability × loss, what is the expected loss?

A. $0.2 million

B. $1 million

C. $5.2 million

D. $25 million

Correct Answer: B. $1 million

Question 6

Which is an example of transition risk?

A. A flood damaging a warehouse

B. Chronic heat reducing worker productivity

C. A new carbon regulation making an emissions-intensive process costly

D. A cyclone interrupting shipping

Correct Answer: C. A new carbon regulation making an emissions-intensive process costly

Question 7

What is the principal purpose of a risk appetite statement?

A. To eliminate all uncertainty from business decisions

B. To define the types and levels of risk the organisation is willing to accept

C. To replace internal controls

D. To guarantee a specific annual profit

Correct Answer: B. To define the types and levels of risk the organisation is willing to accept

Question 8

Which response best reflects credible remediation?

A. Deleting complaints from the reporting dashboard

B. Terminating every supplier immediately without considering workers

C. Correcting harm, engaging affected parties and addressing root causes

D. Publishing only favourable audit results

Correct Answer: C. Correcting harm, engaging affected parties and addressing root causes

Question 9

In the three-lines model, internal audit primarily provides:

A. Independent assurance

B. Daily ownership of operational risks

C. Sales incentives

D. Government licensing decisions

Correct Answer: A. Independent assurance

Question 10

Which practice creates the greatest risk of greenwashing?

A. Disclosing boundaries and data limitations

B. Reporting interim targets and verified progress

C. Making broad environmental claims without defining evidence or exclusions

D. Publishing adverse outcomes alongside improvements

Correct Answer: C. Making broad environmental claims without defining evidence or exclusions