A minor data leak occurs in an organization. As the leak went unnoticed for weeks, sensitive customer information was gradually exposed, leading to reputational damage and regulatory penalties. What does this scenario illustrate?

• A. The need for continuous monitoring to detect and address emerging risks early
• B. The requirement to classify data risks based solely on initial impact assessments
• C. The importance of using risk analysis techniques that account for how consequences can become more severe over time
• D. The need to eliminate all residual risks

Which statement regarding the risk management policy is correct?

• A. A risk management policy cannot be aligned with other internal policies
• B. A risk management policy should be developed only after risks are identified
• C. A risk management policy should clearly define the organization's risk appetite
• D. A risk management policy should undergo a review only when the organization's internal context changes

Likelihood can be described in various ways, including using descriptive terms. What should risk managers do when using a descriptive term?

• A. Keep the descriptive terms short, a maximum of two words
• B. Define the meaning of descriptive terms
• C. Avoid using descriptive terms altogether
• D. Ensure that the term has a certain ambiguity to account for different interpretations

Scenario 2:
Bambino is a furniture manufacturer headquartered in Florence, Italy, specializing in daycare furniture, including tables, chairs, children's beds, shelves, mats, changing stations, and indoor playhouses. After experiencing a major supply chain disruption that caused delays and revealed vulnerabilities in its operations, Bambino decided to implement a risk management framework and process based on ISO 31000 guidelines to systematically identify, assess, and manage risks.
As the first step in this process, top management appointed Luca, the operations manager of Bambino, to facilitate the adoption and integration of the framework into the company's operations, ensuring that risk awareness, communication, and structured practices became part of everyday decision-making.
After Luca took on the responsibility, he reviewed how responsibilities and decision-making were distributed across the company's units, with each unit overseen by a director managing strategic, administrative, and operational matters. At the same time, in consultation with top management, he analyzed the broader environment of Bambino, namely mission, governance, culture, resources, information flows, and stakeholder relationships.
Building on this, Luca outlined concrete actions to strengthen risk management by engaging stakeholders, breaking the process into stages, and aligning objectives with the company's goals. Progress was tracked through existing systems, allowing timely adjustments. Additionally, clear objectives were linked to the mission and strategy, responsibilities were defined, leadership demonstrated commitment, and expectations for daily integration were clarified. Finally, resources for people, skills, and technology were allocated, supported by communication, reporting, and escalation mechanisms.
Additionally, Luca reviewed the requirements the company was bound by, including safety laws for children's products, local labor regulations, and permits needed for operations. He also considered voluntary commitments, such as sustainability labels and agreements with daycare institutions. Through this review, he identified the likelihood of occurrence and potential consequences of failing to meet these requirements, ranging from legal penalties to loss of customer trust, making this area a clear source of exposure. This included the possibility of fines for breaching product safety laws, sanctions for violating labor regulations, and reputational harm if sustainability or contractual commitments were not fulfilled.
Based on the scenario above, answer the following question:
As stated in Scenario 2, Luca identified the likelihood of Bambino's noncompliance with relevant laws and regulations and the potential consequences. What did he identify in this case?

• A. Compliance obligations
• B. Compliance controls
• C. Compliance performance
• D. Compliance risks

On what basis should an organization determine the acceptability of a residual risk?

• A. A risk is acceptable only when its residual level is higher than the target risk to allow flexibility in controls.
• B. The target risk must always be set at a low level to ensure that all residual risks are minimized.
• C. A residual risk is accepted when treatment costs exceed potential benefits.
• D. A residual risk is accepted when it is equal to or below the target risk.