Global Risk, Ethics, Governance, and Sustainability

Introduction

International business creates value by connecting markets, capital, technologies, people, and natural resources across national borders. The same interconnectedness also exposes firms to risks that may arise far from their headquarters. A currency shock can reduce the value of overseas earnings; a cyberattack can interrupt production in several countries; a change in export controls can make a previously profitable supply chain illegal; and a labour-rights violation at a supplier can damage a brand worldwide.

Global risk management is therefore more than insurance or crisis response. It is a strategic capability through which an organization identifies uncertainty, evaluates its potential effects, assigns responsibility, makes informed choices, and learns from outcomes. It must be integrated with corporate governance, ethical reasoning, sustainability, and stakeholder engagement. A firm that complies with minimum legal requirements but ignores human rights, environmental impacts, or corruption may remain formally compliant in one jurisdiction while creating severe strategic and social risks elsewhere.

This chapter examines the principal risks facing international firms and the systems used to manage them. It also explains stakeholder theory, corporate governance, ESG, human-rights due diligence, anti-corruption, and responsible investment. The central argument is that resilient global management depends on alignment between strategy, controls, values, and accountability.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish major categories of global business risk and assess their interdependence.
2. Apply risk-identification, evaluation, treatment, monitoring, and escalation processes.
3. Explain how corporate governance and stakeholder theory influence global decisions.
4. Evaluate ESG performance, human-rights due diligence, anti-corruption systems, and responsible investment.
5. Recommend practical responses to geopolitical, currency, climate, cyber, reputational, and supply-chain risks.
6. Critically assess the limitations of risk models, ESG ratings, compliance systems, and corporate commitments.

1. The Nature of Global Risk

Risk is the effect of uncertainty on objectives. It includes both threats and opportunities, although managerial practice often emphasizes negative consequences. Global risk is shaped by cross-border complexity, institutional differences, interdependence, rapid information flows, and the possibility that a local event will generate international consequences.

1.1 Main categories of global risk

These categories are not independent. For example, geopolitical conflict may cause sanctions, currency depreciation, cyberattacks, logistics disruption, and reputational pressure simultaneously. A risk register should therefore record relationships among risks rather than treating each item as isolated.

1.2 Risk appetite and risk tolerance

Risk appetite is the amount and type of risk an organization is willing to accept while pursuing its objectives. Risk tolerance is the acceptable variation around a particular objective or performance target. A bank may have low tolerance for sanctions violations but a higher appetite for currency exposure in a growth market. The board should approve broad risk appetite; management should translate it into measurable limits, decision rights, and escalation thresholds.

Risk appetite must be specific enough to guide action. Statements such as “we are risk conscious” are not operational. Better statements identify prohibited activities, maximum exposures, minimum liquidity, acceptable downtime, or required due-diligence coverage.

2. A Strategic Risk-Management Process

An effective process is continuous rather than a once-a-year compliance exercise.

1. Establish context: Define objectives, countries, stakeholders, legal obligations, time horizon, and critical dependencies.
2. Identify risks: Use scenario analysis, interviews, process mapping, incident data, external intelligence, and supplier information.
3. Assess risks: Estimate likelihood, impact, velocity, persistence, and interdependence. Assess both inherent risk before controls and residual risk after controls.
4. Treat risks: Avoid, reduce, transfer, share, accept, or exploit risk where appropriate.
5. Monitor and review: Track indicators, audit controls, test scenarios, and update assumptions.
6. Communicate and escalate: Provide timely information to managers, the board, investors, regulators, and affected stakeholders.

A qualitative matrix can rank likelihood and impact, but it should not substitute for judgment. A rare event with catastrophic consequences may deserve more attention than a frequent event with modest effects. Risk velocity—the speed with which an event affects the organization—is particularly important in cyber incidents and reputational crises.

2.1 Quantitative prioritization

For a simple, repeated risk, expected loss can be estimated as:

where EL is expected loss over a defined period, p is the probability of the event during that period, and L is the financial loss if it occurs. Both p and L must refer to the same time period and currency. The calculation assumes that the probability estimate is meaningful and that the loss estimate captures relevant direct and indirect effects. It is unsuitable as the sole basis for rare, interconnected, or non-financial harms.

Worked example. A firm estimates a 4% annual probability of a port closure that would create a loss of $3 million. Expected annual loss is 0.04 × $3,000,000 = $120,000. If a resilience project costs $80,000 annually and reduces the probability to 1%, the revised expected loss is $30,000. The expected saving is $90,000, so the estimated annual benefit exceeds the annual cost by $10,000, before considering implementation risk and non-financial effects. The decision should also consider whether the estimates are reliable and whether the project reduces other risks.

3. Geopolitical, Regulatory, and Country Risk

Geopolitical risk concerns the effects of relations among states, political institutions, social movements, and transnational actors. Relevant events include armed conflict, regime change, elections, sanctions, investment screening, tariffs, export controls, industrial policy, resource nationalism, and diplomatic disputes.

Country-risk analysis should examine at least four dimensions:

• Political and institutional: stability, rule of law, corruption, state capacity, and policy predictability.
• Economic and financial: growth, inflation, debt, capital controls, currency convertibility, and banking-system resilience.
• Legal and regulatory: ownership restrictions, licensing, tax enforcement, labour law, data rules, and dispute resolution.
• Social and environmental: inequality, conflict drivers, public attitudes, human-rights conditions, water stress, and climate exposure.

Managers should avoid treating a country as homogeneous. Regional differences, local authorities, industry regulation, and community relationships may be more important than national averages. Scenario planning is useful: for example, a firm may prepare for continued stability, gradual regulatory tightening, or sudden sanctions and forced divestment.

Practical controls include diversified market exposure, sanctions screening, contractual exit clauses, political-risk insurance, local legal advice, crisis communication plans, and clear rules for dealings with public officials. Compliance must be dynamic because sanctions and export-control lists can change quickly. A local custom is not a defence for conduct prohibited by applicable law or company policy.

4. Currency and Financial Risk

International firms face transaction exposure, translation exposure, and economic exposure. Transaction exposure arises when a contract denominated in a foreign currency changes value before settlement. Translation exposure arises when foreign subsidiaries’ accounts are converted into the reporting currency. Economic exposure concerns the longer-term effect of exchange rates on competitiveness, prices, costs, and investment decisions.

Common responses include natural hedging, currency clauses, matching revenues and costs in the same currency, forward contracts, options, swaps, and diversification. Financial instruments should be used for genuine exposures and governed by limits, authorization procedures, counterparty controls, and clear accounting treatment. Speculation disguised as hedging can increase risk.

A manager should distinguish accounting volatility from cash-flow risk. A translation loss may not immediately reduce cash, while a transaction loss can affect the amount actually paid or received. Currency analysis should also consider inflation, interest-rate differentials, capital controls, and the ability to repatriate funds.

5. Climate, Environmental, and Supply-Chain Risk

Climate risk has two broad dimensions. Physical risk results from hazards such as floods, storms, drought, wildfire, sea-level rise, and heat. Transition risk results from changes toward a lower-emission economy, including carbon pricing, technology substitution, disclosure rules, consumer preferences, and litigation. Environmental risk also includes pollution, water scarcity, biodiversity loss, waste, and resource depletion.

Supply-chain resilience is not identical to lowest cost. Important design choices include:

• mapping tier-one and critical lower-tier suppliers;
• identifying single points of failure and geographic concentration;
• evaluating financial health, labour practices, environmental performance, and cyber controls;
• qualifying alternative suppliers;
• holding strategically justified inventory;
• using modular product designs and flexible logistics;
• establishing crisis communication and recovery procedures.

Resilience has a cost. Multiple suppliers may reduce disruption risk but increase qualification, coordination, and purchasing costs. Just-in-time systems may improve efficiency but leave little buffer. The appropriate balance depends on product criticality, lead time, substitutability, regulatory requirements, and stakeholder consequences.

A responsible firm does not simply transfer risk to suppliers through demanding contracts. It provides realistic delivery requirements, pays fairly and on time, supports capability development, and investigates the root causes of non-compliance. Audits alone may fail when workers fear retaliation or when suppliers prepare selectively for inspections.

6. Cybersecurity and Data Governance

Cyber risk is a strategic and governance issue, not merely an information-technology problem. International operations create multiple systems, vendors, legal regimes, languages, and data transfers. Threats include ransomware, credential theft, supply-chain compromise, industrial espionage, insider misuse, and accidental disclosure.

A sound cyber program combines:

• asset and data inventories;
• identity and access management, including least privilege and multifactor authentication;
• network segmentation and secure configuration;
• encryption and tested backups;
• employee awareness and phishing-resistant processes;
• vendor and cloud-service due diligence;
• continuous monitoring and vulnerability management;
• an incident-response plan with legal, operational, communications, and regulatory roles;
• recovery exercises and post-incident learning.

Boards should understand critical systems, recovery objectives, material vulnerabilities, and management’s response capability. Artificial intelligence can improve anomaly detection, translation, scenario analysis, and monitoring, but it can also create risks through biased outputs, confidential-data leakage, fabricated information, automated attacks, and unclear accountability. Human oversight, access controls, model testing, documentation, and procurement standards are essential.

7. Corporate Governance and Accountability

Corporate governance is the system through which organizations are directed, controlled, and held accountable. It allocates authority among shareholders, boards, executives, employees, regulators, and other stakeholders. In a global corporation, governance must operate across headquarters, subsidiaries, joint ventures, agents, distributors, and suppliers.

Core governance principles include:

• board independence and relevant expertise;
• separation or appropriate balancing of oversight and executive power;
• clear fiduciary and statutory responsibilities;
• audit, risk, remuneration, and sustainability oversight;
• reliable internal controls and financial reporting;
• transparent related-party transactions;
• protected whistleblowing and non-retaliation;
• accountability for misconduct, including at senior levels;
• alignment of incentives with long-term performance and stakeholder impacts.

The board should not manage daily operations, but it must challenge assumptions, approve strategy and risk appetite, monitor culture, and ensure that material risks reach it in understandable form. The “three lines” idea is useful: operational management owns and manages risk; risk, compliance, and control functions provide expertise and challenge; internal audit provides independent assurance. External assurance and regulators provide additional, but not complete, safeguards.

A central governance challenge is the principal–agent problem. Managers may pursue personal rewards, short-term targets, or empire-building rather than durable organizational value. Incentive systems, disclosure, independent oversight, and shareholder rights help reduce this problem, but they cannot replace ethical judgment.

8. Stakeholder Theory and Business Ethics

Shareholder primacy emphasizes returns to owners within legal constraints. Stakeholder theory argues that firms depend on and affect multiple groups, including employees, customers, suppliers, communities, governments, investors, and future generations. Stakeholder analysis asks who has power, legitimacy, urgency, vulnerability, and exposure to the decision.

Ethical analysis should not be reduced to a single test. Useful perspectives include:

• Utilitarian reasoning: compare overall benefits and harms.
• Rights-based reasoning: respect rights that should not be sacrificed for aggregate gain.
• Justice and fairness: examine distribution, procedural fairness, and unequal burdens.
• Virtue ethics: ask what a responsible and trustworthy organization would do.
• Care ethics: consider relationships, dependency, vulnerability, and context.

A practical ethical decision process is to identify affected parties, clarify facts and uncertainties, test legal and policy requirements, identify rights and harms, consider alternatives, seek independent challenge, decide transparently, and review consequences. The legality of an action is a minimum condition, not proof that it is ethical.

Cross-cultural management requires sensitivity without accepting relativism as an excuse for abuse. Firms should distinguish legitimate local variation from practices involving coercion, discrimination, bribery, forced labour, or serious harm.

9. ESG and Sustainability

Environmental, social, and governance (ESG) factors describe issues that may affect organizational performance and stakeholder outcomes. Sustainability concerns the ability to create value without undermining the ecological and social systems on which future value depends.

Environmental topics include emissions, energy, water, waste, pollution, ecosystems, and climate adaptation. Social topics include health and safety, labour rights, diversity, privacy, community effects, and product responsibility. Governance topics include board accountability, corruption, tax conduct, political engagement, executive pay, controls, and shareholder rights.

ESG should be connected to materiality. Financial materiality asks how an issue may affect enterprise value, cash flows, risk, or access to capital. Impact materiality asks how the organization affects people and the environment. A double-materiality approach considers both directions. Materiality is dynamic: a local environmental issue may become financially significant after regulation, litigation, or community opposition changes.

Managers should use measurable indicators, consistent boundaries, credible baselines, and transparent assumptions. They should distinguish targets from outcomes and disclose uncertainty. Greenwashing occurs when communication exaggerates environmental or social performance, uses vague claims, or highlights minor achievements while concealing significant harm. Sustainability claims should be supported by evidence and reviewed through suitable internal and external assurance.

10. Human-Rights Due Diligence

Human-rights due diligence is an ongoing process to identify, prevent, mitigate, track, communicate, and remedy actual and potential adverse human-rights impacts. It applies not only to direct employees but also to contractors, migrant workers, communities, security providers, and supply-chain workers.

A robust process includes:

1. embedding a public policy commitment and board responsibility;
2. identifying actual and potential impacts through risk-based assessment and meaningful consultation;
3. integrating findings into purchasing, investment, product, and operational decisions;
4. preventing and mitigating harm, using leverage with business partners;
5. tracking whether actions are effective;
6. communicating appropriately and protecting sensitive information;
7. providing or cooperating in legitimate remediation where the firm caused or contributed to harm.

High-risk contexts require enhanced due diligence. Indicators may include recruitment fees, retention of identity documents, excessive working hours, unsafe conditions, discrimination, child labour, forced labour, land displacement, threats to human-rights defenders, and restrictions on worker voice. A company should not terminate a supplier automatically if disengagement would worsen harm; responsible disengagement may be necessary, but the decision should consider leverage, remediation, worker welfare, and safety.

11. Anti-Corruption and Compliance

Corruption includes bribery, extortion, kickbacks, embezzlement, fraud, and abuse of entrusted power. It can involve public officials or private-sector actors. International firms face heightened exposure through agents, customs brokers, consultants, joint ventures, donations, sponsorships, gifts, hospitality, and facilitation payments.

An effective anti-corruption program is risk-based and includes senior commitment, clear policies, training, third-party due diligence, books-and-records controls, approval thresholds, monitoring, confidential reporting, investigations, discipline, and continuous improvement. Third-party screening should examine ownership, government connections, qualifications, compensation, services actually performed, payment destinations, and red flags. A contract alone does not control a poorly supervised intermediary.

Compliance systems fail when targets reward results regardless of methods, employees fear reporting, investigations are selective, or senior personnel are exempt. Ethical culture is demonstrated by decisions under commercial pressure, not by policy documents alone.

12. Responsible Investment and Decision-Making

Responsible investment incorporates ESG risks, opportunities, stewardship, and long-term stakeholder effects into capital allocation. Techniques include negative screening, positive or best-in-class selection, thematic investment, ESG integration, active ownership, voting, engagement, and impact investment. These approaches have different objectives and should not be treated as interchangeable.

Investors should examine methodology, data quality, time horizon, additionality, and trade-offs. ESG ratings often disagree because providers use different definitions, weights, data, and treatment of controversies. A high score does not prove that a company has positive real-world impact. Investors should combine quantitative indicators with qualitative analysis, scenario testing, engagement, and verification.

13. Integrated Case: Meridian Foods’ Cocoa Supply Chain

This is an illustrative case. Meridian Foods, a fictional multinational confectionery company, sources cocoa through traders from three West African countries. The company advertises ethical sourcing and has a target that all cocoa will be traceable. A media investigation reports hazardous child labour on farms supplying one cooperative. At the same time, drought reduces cocoa yields, a port strike delays exports, and the local currency depreciates sharply.

Background and problem

Meridian initially treated supplier audits as its principal control. Its procurement team was rewarded for low unit cost and uninterrupted supply. The company could trace first-tier traders but not all farms. Contracts required compliance with a code of conduct, yet farmers received low and volatile prices, and remediation channels were weak. The investigation creates legal, reputational, human-rights, supply, and climate risks simultaneously.

Analysis

The board establishes a cross-functional response team involving procurement, sustainability, legal, finance, risk, communications, and regional experts. It maps the supply chain, identifies affected children and households, and distinguishes whether Meridian caused, contributed to, or was directly linked to the harm. It also tests the reliability of its public claims and reviews whether purchasing practices increased pressure on farmers.

Financial analysis estimates that immediate disengagement would reduce supply but might leave children without household income. Continuing without change would preserve supply while exposing the company to ongoing harm and loss of legitimacy. The company therefore assesses remediation, farmer income, school access, safe grievance channels, and alternative sourcing.

Approach and solution

Meridian suspends misleading marketing claims, publicly acknowledges uncertainty, and works with local organizations to remove children from hazardous work while supporting education and household income. It introduces traceability beyond traders, strengthens independent worker and community reporting, and requires corrective-action plans with deadlines. It changes procurement incentives from lowest price to risk-adjusted value, provides longer contracts where appropriate, and supports climate-resilient farming.

The company diversifies ports and suppliers, maintains a justified buffer inventory, and uses currency clauses that share rather than simply transfer volatility. The board receives quarterly indicators: verified farm coverage, remediation completion, grievance resolution, farmer income trends, climate exposure, supply concentration, and substantiated incidents. Independent assurance tests selected claims and controls.

Outcome and learning points

After two years, traceability and remediation coverage improve, supply becomes more diversified, and the company withdraws claims that cannot yet be verified. Costs rise, but disruption losses decline and stakeholder trust begins to recover. The case demonstrates that risk management must address root causes, not only visible incidents. It also shows why human-rights responsibility cannot be delegated entirely to suppliers, why sustainability claims require evidence, and why resilience may require changing commercial incentives.

Challenges and Limitations

Risk management contains unavoidable uncertainty. Probabilities may be based on limited data, models may omit cascading effects, and historical patterns may not predict climate or geopolitical change. Quantification can create false precision and may undervalue human dignity, cultural loss, or irreversible ecological damage.

Governance systems can also become symbolic. Boards may receive large volumes of information without understanding it; audits may measure documentation rather than lived conditions; ESG ratings may reward disclosure rather than performance; and compliance training may not influence incentives. Stakeholder consultation can be tokenistic if affected groups lack power or if decisions are already fixed.

Managers should therefore use multiple methods, disclose assumptions, invite challenge, protect dissent, test adverse scenarios, and combine quantitative measures with qualitative evidence. They should also recognize trade-offs openly rather than claiming that every responsible action produces immediate financial gains.

Contemporary Developments and Best Practices

Global risk practice is increasingly shaped by mandatory sustainability reporting, supply-chain due-diligence requirements, sanctions expansion, data-localization rules, climate litigation, artificial intelligence, and investor scrutiny. Requirements differ by jurisdiction, so firms must maintain a legal obligations register and avoid assuming that one global policy satisfies every local requirement.

Leading practice includes:

• board ownership of material risks and impacts;
• integrated financial, operational, ESG, and human-rights risk registers;
• country and supplier segmentation based on severity and likelihood;
• scenario analysis for climate, conflict, cyber, and regulatory change;
• reliable data governance and documented methodologies;
• independent challenge and assurance;
• worker, community, and investor engagement;
• incentives linked to safe, ethical, long-term performance;
• tested crisis plans and post-incident learning;
• transparent reporting of progress, limitations, and adverse events.

The strategic objective is not to eliminate all uncertainty. It is to make informed commitments, preserve the organization’s capacity to respond, protect affected people, and create durable value within ecological and institutional limits.

Chapter Summary

Global business risk includes geopolitical, currency, regulatory, climate, cyber, supply-chain, reputational, social, and strategic dimensions. These risks interact and should be managed through a continuous process of context-setting, identification, assessment, treatment, monitoring, communication, and escalation. Expected loss can support prioritization for suitable, reasonably estimable risks, but it cannot capture every ethical or systemic consequence.

Corporate governance assigns authority and accountability among boards, executives, control functions, investors, and stakeholders. Stakeholder theory broadens analysis beyond shareholders, while ethical frameworks help managers examine consequences, rights, fairness, character, and relationships. ESG connects environmental, social, and governance factors to organizational performance and impact, but credible assessment requires materiality, reliable data, and protection against greenwashing.

Human-rights due diligence is a continuous, risk-based process of identifying, preventing, mitigating, tracking, communicating, and remedying adverse impacts. Anti-corruption requires leadership, controls, third-party oversight, accurate records, reporting channels, and consequences. Responsible investment uses ESG integration, stewardship, screening, thematic approaches, or impact methods according to clearly stated objectives. Resilient international firms combine these practices with scenario planning, supply-chain visibility, cyber controls, transparent communication, and a culture in which responsible conduct remains expected during commercial pressure.

Key Terms

Global risk: The effect of uncertainty on objectives in an international operating context.

Risk appetite: The amount and type of risk an organization is willing to accept.

Risk tolerance: The acceptable variation around a specific objective or limit.

Residual risk: Risk remaining after controls and treatments are applied.

Geopolitical risk: Risk arising from political relations, conflict, state actions, or international power shifts.

Transaction exposure: Exchange-rate risk affecting a foreign-currency receivable or payable.

Physical climate risk: Damage or disruption caused by climate-related physical hazards.

Transition risk: Risk arising from movement toward a lower-emission and more sustainable economy.

Supply-chain resilience: The capacity of a supply network to prepare for, withstand, recover from, and adapt to disruption.

Cyber risk: Risk of loss or harm from failures, attacks, or misuse involving digital systems and data.

Corporate governance: The system by which an organization is directed, controlled, and held accountable.

Stakeholder theory: The view that firms have responsibilities to groups that affect or are affected by the firm.

ESG: Environmental, social, and governance factors relevant to organizational performance and impacts.

Double materiality: Assessment of both how issues affect the firm and how the firm affects society and the environment.

Greenwashing: Misleading communication that exaggerates or misrepresents environmental or sustainability performance.

Human-rights due diligence: An ongoing process to identify, prevent, mitigate, track, communicate, and remedy adverse impacts.

Anti-corruption compliance: Policies and controls designed to prevent, detect, investigate, and respond to corrupt conduct.

Responsible investment: Investment that incorporates sustainability risks, opportunities, stewardship, and long-term impacts.

Remediation: Action to correct or repair harm experienced by affected people or communities.

Risk velocity: The speed at which a risk event produces consequences.

Review Questions

5 Short Answer Questions

1. Distinguish risk appetite from risk tolerance.
2. What is the difference between physical and transition climate risk?
3. Identify three forms of currency exposure.
4. Why is human-rights due diligence broader than supplier auditing?
5. What is greenwashing?

5 Long Answer Questions

1. Explain the global risk-management process and discuss why risk categories should not be treated as independent.
2. Compare shareholder-oriented and stakeholder-oriented approaches to international business decisions.
3. Explain how corporate boards and the three lines of responsibility support effective governance.
4. Discuss the strengths and limitations of ESG measurement and disclosure.
5. Describe the elements of an effective international anti-corruption program.

3 Analytical / Application Questions

1. A multinational has one low-cost supplier in a region exposed to floods and political unrest. Develop a risk-treatment plan and justify the trade-offs between efficiency and resilience.
2. A company discovers forced-labour indicators at a supplier but has no immediate alternative source. Analyze its responsibilities and recommend a sequence of actions.
3. A board receives a high ESG rating for a company whose workers report unsafe conditions. Explain how the board should investigate the discrepancy and improve its decision process.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk that has been eliminated completely

B. Risk remaining after controls and treatments are applied

C. Risk accepted only by external investors

D. Risk that exists only in financial statements

Correct Answer: B. Risk remaining after controls and treatments are applied

Question 2

A 5% probability of a $2,000,000 loss produces an expected loss of:

A. $10,000

B. $40,000

C. $100,000

D. $400,000

Correct Answer: C. $100,000

Question 3

Which is an example of transition climate risk?

A. A cyclone damages a warehouse

B. Drought reduces water availability

C. A new carbon regulation makes a production process more expensive

D. Flooding interrupts road transport

Correct Answer: C. A new carbon regulation makes a production process more expensive

Question 4

What is the principal purpose of human-rights due diligence?

A. To transfer all responsibility to suppliers

B. To identify, prevent, mitigate, track, communicate, and remedy adverse impacts

C. To maximize short-term purchasing savings

D. To replace all forms of financial auditing

Correct Answer: B. To identify, prevent, mitigate, track, communicate, and remedy adverse impacts

Question 5

Which board responsibility is most consistent with effective corporate governance?

A. Approving every routine operational decision

B. Ignoring culture if financial results are strong

C. Approving risk appetite and challenging material strategic assumptions

D. Delegating all risk oversight to external auditors

Correct Answer: C. Approving risk appetite and challenging material strategic assumptions

Question 6

Which practice best reduces cyber risk?

A. Giving all employees administrator access

B. Using multifactor authentication and least-privilege access

C. Avoiding incident-response exercises

D. Storing only one untested backup

Correct Answer: B. Using multifactor authentication and least-privilege access

Question 7

Double materiality considers:

A. Only the effect of sustainability issues on share price

B. Only the firm’s environmental impact

C. Both how issues affect the firm and how the firm affects society and the environment

D. Only information required by tax authorities

Correct Answer: C. Both how issues affect the firm and how the firm affects society and the environment

Question 8

Which action is a natural currency hedge?

A. Borrowing in a currency unrelated to operations

B. Matching foreign-currency costs with foreign-currency revenues

C. Ignoring exchange-rate movements

D. Speculating in currencies without an underlying exposure

Correct Answer: B. Matching foreign-currency costs with foreign-currency revenues

Question 9

Why can supplier audits be insufficient for detecting labour abuse?

A. They always measure too many variables

B. Workers may fear retaliation and suppliers may prepare selectively

C. They eliminate the need for worker engagement

D. They are designed only for currency risk

Correct Answer: B. Workers may fear retaliation and suppliers may prepare selectively

Question 10

Which investment approach involves using ownership rights to influence company conduct?

A. Active stewardship or engagement

B. Currency translation

C. Operational hedging

D. Market withdrawal without analysis

Correct Answer: A. Active stewardship or engagement