Free CIMAPRO19-P03-1 Practice Test Questions and Answers (2026)

Monitoring and recording all failed access attempts is the most effective activity for increasing awareness of cybersecurity risk. A sudden spike in failed logins from a single IP address or against a specific user account is a primary indicator of a potential brute-force or credential stuffing attack. This provides immediate, actionable intelligence about an active threat, allowing security teams to respond proactively by blocking the source or locking the targeted account. This directly addresses a specific attack vector and is a fundamental practice in intrusion detection and security monitoring.

A. ABC should monitor and record every device type used for access.

This is more relevant for asset management or policy enforcement rather than being a direct, real-time indicator of a cyberattack.

B. ABC should monitor and record every out of hours access.

The business operates on a 24/7 basis, so the concept of "out of hours" is not a reliable or meaningful indicator of risk.

D. ABC should monitor and record every keystroke of every user.

This is extremely data-intensive, raises significant privacy concerns, and is inefficient for real-time threat detection compared to monitoring specific security events like failed logins.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Reference: Control AC-7, "Unsuccessful Logon Attempts."

Content: This control explicitly requires the system to enforce actions (e.g., locking an account/node) after a specified number of consecutive unsuccessful logon attempts. This underscores the principle that monitoring these attempts is a critical security control for identifying and responding to potential attacks.

2. CIMA Professional Qualification Syllabus, P3 – Risk Management (2019).

Reference: Section B: Enterprise Risk, 2. (c) "Discuss the sources, and impact of, information systems risks..."

Content: The syllabus requires candidates to understand risks related to information systems, including unauthorized access. A key control to manage this risk is monitoring access logs, with a particular focus on anomalies like repeated failed attempts, which is a direct symptom of a potential breach.

3. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall.

Reference: Chapter 4, "Authentication," Section 4.3 "Passwords."

Content: The text discusses password-guessing attacks and countermeasures. It highlights that "a simple countermeasure is to log all failed login attempts... A security administrator can review the log, looking for suspicious patterns." This confirms that monitoring failed attempts is a standard and effective security practice.

To prepare for a public listing, C Ltd must adopt corporate governance structures that meet the standards of a recognised stock exchange. This involves enhancing independence, accountability, and oversight. Appointing independent non-executive directors (NEDs) to constitute at least half the board (A) is a fundamental principle to ensure the board is not dominated by insiders. Appointing an independent NED as Chair (B) is crucial for effective board leadership and separation of powers from executive management. Establishing Audit, Remuneration, and Nomination committees (D), staffed by independent NEDs, is a mandatory requirement for listed companies to ensure critical functions are managed with objectivity and transparency, thereby protecting shareholder interests.

C. The venture capital director represents a significant shareholder; their removal is not a standard listing requirement and may violate investment agreements.

E. Ten-year contracts are contrary to good governance. Best practice recommends service contracts with notice periods of one year or less to avoid rewarding poor performance.

F. An executive-only agenda committee would concentrate power and undermine the role of the Chair and NEDs, contradicting principles of balanced and effective board oversight.

1. Financial Reporting Council (FRC). (2018). The UK Corporate Governance Code.

Provision 11: States, "At least half the board, excluding the chair, should be non-executive directors whom the board considers to be independent." This directly supports option A.

Provision 9: Recommends, "The chair should be independent on appointment when assessed against the circumstances set out in Provision 10." This supports option B.

Sections 3 & 4 (Provisions 17, 24, 32): Mandate that listed companies must establish Nomination, Audit, and Remuneration committees. The Code specifies that these committees should consist of a majority of independent non-executive directors. This supports option D.

Provision 39: States, "Notice or contract periods should be one year or less." This directly contradicts the 10-year contracts proposed in option E.

2. Mallin, C. A. (2018). Corporate Governance (6th ed.). Oxford University Press.

Chapter 4, 'Directors and Board Structure': This chapter details the typical requirements for listed companies, including the need for a balanced board with a strong independent element, the separation of the Chair and CEO roles with an independent Chair, and the mandatory establishment of audit, remuneration, and nomination committees. This body of work supports the rationale for answers A, B, and D.

3. Goergen, M. (2012). International Corporate Governance. Prentice Hall.

Chapter 5, 'The Board of Directors': Discusses the critical role of board committees (audit, remuneration, nomination) in monitoring management on behalf of shareholders. It emphasizes that for these committees to be effective, they must be dominated by independent outside directors, a key step for any company going public. This supports option D. The chapter also discusses the importance of an independent chair and a sufficient number of NEDs, supporting A and B.

The Net Present Value (NPV) is calculated by converting the expected future cash flows into the home currency (GB£) and subtracting the initial investment.

1. Expected Annual Cash Flow (US$):

(US$400,000 × 0.40) + (US$700,000 × 0.60) = US$580,000

2. Forecast Exchange Rates (using PPP): S1 = S0 × (1 + iforeign) / (1 + ihome)

Year 1: 1.30 × (1.04 / 1.02) = US$1.3255/GB£

Year 2: 1.3255 × (1.04 / 1.02) = US$1.3512/GB£

Year 3: 1.3512 × (1.04 / 1.02) = US$1.3772/GB£

3. Convert Cash Flows to GB£:

Year 1: US$580,000 / 1.3255 = GB£437,571

Year 2: US$580,000 / 1.3512 = GB£429,248

Year 3: US$580,000 / 1.3772 = GB£421,144

Total Inflows: GB£1,287,963

4. Calculate NPV:

The question's structure implies a 0% discount rate, as no cost of capital is provided.

NPV = Total GB£ Inflows - Initial Investment

NPV = GB£1,287,963 - GB£1,000,000 = GB£287,963. This is closest to option A.

B. GB£391,640: This result may arise from incorrectly applying the Purchasing Power Parity formula, for instance, by inverting the inflation rates, leading to an overstatement of the GB£ cash flows.

C. GB£(111,973): A negative NPV would likely result from using a high, unstated discount rate or a significant error in the exchange rate forecasting that undervalues the future dollar cash flows.

D. GB£554,047: This figure likely results from converting all future US$ cash flows at the current spot rate (US$1.30/GB£), ignoring the effect of inflation differentials as predicted by PPP.

1. Shapiro, A. C. (2019). Multinational Financial Management (11th ed.). John Wiley & Sons. Chapter 16, "International Capital Budgeting," details the methodology of using Purchasing Power Parity to forecast exchange rates for converting foreign cash flows in project appraisal. The home currency approach is explained in section 16.3.

2. Eiteman, D. K., Stonehill, A. I., & Moffett, M. H. (2016). Multinational Business Finance (14th ed.). Pearson. Chapter 18, "International Capital Budgeting," covers the two main methods for evaluating foreign projects: the home currency approach and the foreign currency approach. The use of parity conditions like PPP to derive forecast inputs is a central theme (pp. 510-514).

3. Damodaran, A. (n.d.). Country Risk and Company Exposure. NYU Stern School of Business, Course materials for Corporate Finance. In his discussion of international project appraisal, Damodaran explains the necessity of maintaining consistency: discount foreign cash flows at a foreign currency discount rate, or convert foreign cash flows to domestic currency (using expected exchange rates derived from PPP) and discount at a domestic rate. (See section on "Valuing Foreign Companies/Projects").

Residual Income (RI) measures performance by subtracting a capital charge (investment base × cost of capital) from controllable profit. This can lead to dysfunctional behaviours.

1. Short-termism (B): Since RI is a single-period measure, managers may reject profitable long-term projects (with positive NPV) if those projects reduce RI in the short term, for instance, due to high initial investment increasing the capital charge before significant profits are generated.

2. Transfer Pricing Disputes (C): The transfer price directly impacts the revenues of the selling subsidiary and the costs of the buying subsidiary. This affects the controllable profit of each, and consequently their RI. Managers may therefore engage in lengthy disputes to set a price that benefits their own division's RI, potentially at the expense of optimal decisions for the group.

3. Hedging Translation Risk (A): In a multinational company, a subsidiary's assets and profits are subject to translation risk when converted to the parent's currency. A manager may hedge this risk to protect their reported RI from adverse exchange rate movements, even if this is costly and not aligned with the group's overall risk management strategy.

D. Subsidiary boards may waste time and incur unnecessary fees in order to recognise gains on the revaluation of property.

This is incorrect because revaluing property upwards increases the investment base, which in turn increases the capital charge and reduces residual income.

E. Subsidiary boards may be motivated to spend heavily on capital expenditure in order to ensure that budget allocations are maintained and even increased.

This is incorrect because heavy capital expenditure increases the investment base, which lowers residual income. Managers evaluated on RI are incentivised to be prudent with capital investment.

---

1. Drury, C. (2018). Management and Cost Accounting (10th ed.). Cengage.

For B (Short-termism): On p. 528, it is noted that a major criticism of both ROI and RI is that "they encourage managers to take a short-term view and concentrate on short-term performance at the expense of long-term profitability."

For C (Transfer Pricing): Chapter 18, Section 18.2 (p. 546), explains how transfer prices directly impact the reported profits of the divisions involved in a transaction, which is the primary cause for disputes when divisional profit (a component of RI) is used for performance evaluation.

2. Kaplan, R. S., & Atkinson, A. A. (1998). Advanced Management Accounting (3rd ed.). Prentice Hall.

For D & E (Incorrect Logic): The formula for residual income is presented as RI = Income - (Cost of Capital × Capital Invested) (p. 579). This formulation demonstrates that an increase in the 'Capital Invested' base, either through asset revaluation (D) or new capital expenditure (E), will, all else being equal, decrease the calculated RI, thus acting as a disincentive for such actions.

3. Eiteman, D. K., Stonehill, A. I., & Moffett, M. H. (2016). Multinational Business Finance (14th ed.). Pearson Education.

For A (Hedging Translation Risk): Chapter 10, "Translation Exposure," discusses how subsidiary managers whose performance is evaluated in the parent's currency (which is necessary for calculating RI for the group) may be motivated to hedge translation exposure. This is done to reduce the volatility of their reported results and protect their performance metrics from currency fluctuations, which may not be in the best economic interest of the consolidated group.

The COSO Enterprise Risk Management (ERM) framework, particularly the 2017 "Integrating with Strategy and Performance" update, is built on several core concepts. It emphasizes that ERM must be integrated with strategy-setting to help the organization achieve its objectives. A foundational element is fostering a risk-aware culture throughout the entity, from the board down to all employees. The framework also mandates a comprehensive, holistic, and portfolio view of risk, considering how individual risks interrelate across the entire organization. These principles ensure that risk management is not a siloed function but a dynamic, integral part of decision-making and performance management.

C. Risk management is the responsibility of the risk committee.

This is incorrect. COSO ERM establishes that risk management is the responsibility of everyone in an organization, with the board providing oversight and management setting the tone.

E. Consideration of the main risk only which is financial risk.

This is incorrect. ERM by definition is an enterprise-wide approach that considers all types of risks, including strategic, operational, and compliance risks, not just financial ones.

1. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance: Executive Summary. Committee of Sponsoring Organizations of the Treadway Commission.

Page 4, "Governance and Culture": This component emphasizes the importance of board oversight, management's role, and defining the desired culture. Principle 4, "Demonstrates Commitment to Core Values," directly supports the creation of a risk-aware culture (Answer A).

Page 5, "Strategy and Objective-Setting": This component explicitly links ERM to the strategic-planning process, supporting the consideration of risk in the context of business strategy (Answer D).

Page 6, "Performance": Principle 12, "Selects, Develops, and Performs Review," and Principle 14, "Develops a Portfolio View," advocate for a comprehensive and holistic approach to risk (Answer B). The framework refutes the idea of focusing only on financial risk (Answer E).

Page 4, Principle 1, "Exercises Board Risk Oversight": This section clarifies that while the board has an oversight role, management has overall responsibility, and accountability rests at all levels, which contradicts the notion that responsibility lies solely with a committee (Answer C).

2. Beasley, M. S., & Frigo, M. L. (2018). What’s New in the COSO ERM Framework? Journal of Accountancy, 225(5), 28-32.

This article highlights the key shifts in the 2017 framework, stating, "The updated framework more clearly connects ERM with strategy-setting and the entity's operating performance." It also notes the "prominence of culture" as a key theme, reinforcing answers A and D. The article's discussion of taking a "portfolio view of risk" supports answer B.

An effective risk management culture is foundational to an organization's success and resilience. It begins with strong leadership and "tone at the top," requiring directors to take an active role in overseeing risk (F). This culture ensures that risk management is not a siloed compliance function but is fully integrated into strategic planning and decision-making, aligning risk appetite with business objectives (E). For this to be effective, a sense of shared responsibility must be fostered, where all staff are aware of the key risks affecting the organization and understand their role in managing them (D). This creates a proactive, risk-aware environment throughout the entity.

A. Penalising staff for being associated with negative events fosters a "blame culture," which discourages the open communication and reporting necessary for effective risk management.

B. The goal of risk management is to manage risks to an acceptable level (within the risk appetite), not to eliminate all risk, which is impossible and would stifle all business activity.

C. While a risk manager is important, responsibility for risk management must be embedded throughout the organization; it is the responsibility of everyone, with ultimate oversight by the board.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance.

For F: Principle 1, "Board Exercises Risk Oversight," states that the board of directors is responsible for overseeing the development and performance of the enterprise risk management framework (p. 29).

For E: The entire framework is built on the premise of integrating risk management with strategy setting and performance. Principle 7, "Defines Business Objectives," and Principle 8, "Analyzes Business Context," directly link risk assessment to strategic goals (pp. 61-72).

For D: Principle 5, "Enforces Accountability," and Principle 14, "Communicates Risk Information," emphasize that risk awareness and responsibility must be cascaded throughout the entity to all personnel (pp. 47, 105).

2. Financial Reporting Council (FRC). (2018). The UK Corporate Governance Code.

For F & E: Principle O states, "The board should establish procedures to manage risk, oversee the internal control framework, and determine the nature and extent of the principal risks the company is willing to take in achieving its strategic objectives." (p. 10). This directly links board responsibility with risk and strategy.

3. Fraser, J. R., & Simkins, B. J. (Eds.). (2010). Enterprise risk management: Today's leading research and best practices for tomorrow's executives. John Wiley & Sons.

For C (Incorrect): Chapter 1, "Enterprise Risk Management: An Introduction and Overview," explains that ERM is a process "effected by an entity’s board of directors, management and other personnel," refuting the idea of devolving it to a single manager (p. 6).

For A (Incorrect): Chapter 11, "A New Approach for Chief Risk Officers," discusses the need for a culture that encourages transparency and learning from failures, which is contrary to a punitive approach (p. 215).

Risk prioritization is a function of both impact (severity) and likelihood (probability). The highest priority is assigned to risks that pose the greatest potential threat to an organization's objectives. A risk with a high impact, even if it only arises occasionally, represents a significant threat that could have severe consequences on finance, operations, or reputation. Standard risk management frameworks, such as the one defined by COSO and taught in the CIMA syllabus, use a risk matrix (or heat map) to plot risks. Risks in the high-impact/high-likelihood quadrant are the top priority. Option D, with its high impact and non-negligible likelihood ("occasionally"), falls into this critical category and warrants more immediate attention than the other combinations presented.

A. While the high impact is a major concern, the low likelihood reduces its immediate priority compared to a high-impact risk that is more likely to occur.

B. Frequent risks with low impact are typically managed through routine operational controls and do not represent a strategic or catastrophic threat.

C. Risks with both low impact and low likelihood are considered the lowest priority and are often accepted by the organization without specific action.

1. CIMA P3 Official Study Text: The CIMA P3 syllabus covers risk assessment, which involves mapping risks based on their likelihood and impact. The principle is to prioritize those with the highest combined score. High-impact risks are always treated with high importance. (Reference: BPP Learning Media, CIMA P3 Risk Management Study Text, Chapter 4, Section 3.3 'Risk maps/heat maps').

2. COSO Framework: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, which heavily influences the CIMA syllabus, emphasizes assessing risk severity. "Severity of risk is considered at multiple levels... The organization assesses the severity of risk as a combination of impact and likelihood." High-severity risks are prioritized for response. (Reference: COSO, Enterprise Risk Management—Integrating with Strategy and Performance, June 2017, Principle 12, Page 69).

3. Academic Publication: Risk management literature confirms that risk prioritization is based on a combination of probability and consequence. Events with high consequences (impact) are prioritized for treatment, especially when their probability is not negligible. (Reference: Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1-13. Section 2.1 'The risk concept'. https://doi.org/10.1016/j.ejor.2015.12.023).

Return on Capital Employed (ROCE) is a financial ratio that measures profitability and the efficiency with which capital is used. Its formula is Operating Profit / Capital Employed. The measure is most appropriate and reliable when the 'Capital Employed' figure is consistently and accurately valued across the units being compared. This is best achieved in companies with extensive, tangible physical assets (e.g., plant, machinery) which are clearly recorded on the balance sheet. Furthermore, for divisional comparison to be meaningful, the divisions should be engaged in broadly similar activities, ensuring their capital structures and operating models are comparable.

A: Internally generated intangible assets like brands are often not recorded on the balance sheet, which understates the true capital employed and inflates ROCE, making it a misleading measure.

C: Comparing divisions with diverse activities is problematic as their capital intensity differs naturally. Acquisitions also introduce valuation inconsistencies (e.g., goodwill), making ROCE an unreliable comparative tool.

D: The primary objective of not-for-profit organisations is mission fulfillment, not generating profit or returns on capital. Therefore, ROCE is an inappropriate primary performance measure for this sector.

---

1. CIMA Official Study Text, P3 Risk Management (relevant to CIMAPRO19-P03-1 syllabus). Chapter 5, "Divisional performance and transfer pricing," discusses the limitations of using Return on Investment (ROI), a measure conceptually identical to ROCE for this purpose. The text highlights that ROI is most useful for comparing similar divisions and can be distorted by factors such as the valuation of assets, particularly the non-capitalisation of intangible assets. This supports the choice of B over A and C.

2. Drury, C. (2018). Management and Cost Accounting (10th ed.). Cengage Learning. In Chapter 19, "Divisional financial performance measures," Drury outlines the problems with using ROI (ROCE) for performance evaluation. He notes, "It can produce misleading results when comparisons are made between divisions with assets of different ages" and that it is less suitable for industries where intangible assets are significant. This directly supports the reasoning that companies with tangible, physical assets (Option B) are the most suitable candidates for ROCE analysis. (See Section 19.4, 'Disadvantages of using ROI').

3. Atrill, P., & McLaney, E. (2018). Management Accounting for Decision Makers (9th ed.). Pearson. Chapter 8, "Performance evaluation," explains that for ratios like ROCE to be used for comparison, "the divisions being compared should be alike in all major respects." It further clarifies that comparing divisions in fundamentally different businesses (as in Option C) or those with different asset structures (as in Option A) can lead to flawed conclusions. This reinforces that similarity in activities and asset base (Option B) is crucial for ROCE to be appropriate.

Effective internal controls for managing trade receivables aim to prevent bad debts by assessing risk upfront and taking prompt action when payments are overdue.

1. Credit checks (A) are a fundamental preventative control to evaluate a new customer's ability and willingness to pay before granting credit.

2. Regular review of an aged analysis (D) is a detective control that enables timely follow-up on overdue accounts, which is crucial for preventing them from becoming uncollectible.

3. Stopping further sales to overdue customers (E) is a direct preventative action that contains the company's financial exposure to a customer who has already demonstrated payment difficulties, preventing the potential bad debt from increasing.

B. Allowing sales staff to override credit limits creates a severe conflict of interest and undermines the control, as their primary incentive is sales volume, not credit risk.

C. Authorisation of new customers should be performed by a credit control function, independent of the sales team, to ensure an objective assessment of creditworthiness.

1. Drury, C. (2018). Management and Cost Accounting (10th ed.). Cengage Learning EMEA. In Chapter 22, which discusses the management of working capital, the text emphasizes the importance of a sound credit policy. This includes assessing the creditworthiness of new customers (supporting A), monitoring outstanding debts through aged analysis (supporting D), and having a clear procedure for overdue debts, which includes stopping further credit (supporting E). (See pp. 630-635).

2. CIMA. (2019). CIMA P3 Risk Management Study Text. Kaplan Publishing. Chapter 10, "Managing Working Capital," details the components of credit management. It specifies that credit assessment (credit checks) is a key step before granting credit. It also outlines that monitoring systems, such as aged receivables analysis, and robust collection policies, including stopping supply to delinquent accounts, are essential to minimize bad debt risk. The text also highlights the need for segregation of duties, making sales staff unsuitable for credit authorisation (invalidating B and C).

3. Bhimani, A., Horngren, C. T., Datar, S. M., & Rajan, M. V. (2015). Management and Cost Accounting (6th ed.). Pearson Education. Chapter 18, "Managing working capital," explains that an effective credit policy involves three key elements: credit analysis, setting credit limits, and establishing collection policy. The text explicitly warns against conflicts of interest where sales personnel can influence credit decisions (making B and C poor controls) and advocates for strict follow-up procedures based on aged analysis (supporting D and E). (See Section: 'Managing accounts receivable').

Improving strategic control and the control environment involves establishing high-level governance structures that set the "tone at the top" and oversee the organization's direction and risks.

An independent and expert Audit Committee (A) is a cornerstone of corporate governance. It provides oversight of financial reporting and internal controls, ensuring the integrity of information used for strategic decisions and enhancing the control environment.

A dedicated Risk Management Committee (C) directly implements strategic control by formally identifying, assessing, and monitoring strategic risks. This demonstrates a proactive approach to risk management, which is a critical component of a strong control environment and ensures the strategy's viability. Both are fundamental governance mechanisms, not day-to-day operational policies.

B. This is a specific, operational HR policy for cost control, not a high-level governance feature that shapes the overall strategic control or control environment.

D. This is a narrow operational directive that could create perverse incentives, leading to poor patient outcomes and reputational damage, thereby undermining strategic objectives.

E. This misuses the Head of Internal Audit in an operational approval role, which critically compromises their independence and weakens the overall governance structure.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary. Page 5, Principle 2 states, "The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control." Both an independent Audit Committee (A) and a Risk Management Committee (C) are primary ways the board exercises this oversight.

2. Financial Reporting Council (FRC). (2018). The UK Corporate Governance Code. Section 4, Provision 24, requires the board to establish an audit committee of independent non-executive directors. Provision 25 states the board is responsible for determining the nature and extent of the principal risks it is willing to take, supporting the function of a Risk Management Committee (C).

3. Beasley, M. S., Clune, R., & Hermanson, D. R. (2005). Enterprise risk management: An empirical analysis of factors associated with the extent of implementation. Journal of Accounting and Public Policy, 24(6), 521-531. This study highlights that board-level oversight and dedicated risk management functions are key drivers of effective Enterprise Risk Management (ERM), which is integral to strategic control. This directly supports the value of a Risk Management Committee (C). https://doi.org/10.1016/j.jaccpubpol.2005.10.001