← All papers
CIMA · Strategic

Risk Management (P3)

150 questions mapped to the current AICPA & CIMA Strategic Level blueprint (2026/27). Covers enterprise risk, strategic risk, internal controls, and cyber risk. Switch to Exam Sim mode for a timed CIMA P3 mock exam: 60 questions, 90 minutes.

→ P3 Common Mistakes & Exam Technique: the errors that catch P3 students out, and how to avoid them.

The P3 exam format

Format Computer-based objective test. All questions are compulsory.
Length 90 minutes, 60 questions.
Scoring Reported as a scaled score from 0 to 150. Questions are weighted by difficulty, so the scaled score is not a straight percentage of questions answered correctly.
Pass mark 100 out of 150.
Case Study Separate from this exam. The Strategic Case Study is sat after the three strategic-level objective tests and has its own pass mark of 80 out of 150.

Always check the current exam format on the AICPA & CIMA website before you sit.

Explanations shown after each answer. Skip freely. No time limit.
Section:
0
answered
0
correct
—
score
—
remaining
Question 1

Loading questions…

P3 Formula Sheet: all key formulas on one printable A4 page. Free to download, or see what's on it.

↓ Download PDF

Sample P3 questions

Three questions from this bank, each with its answer and worked explanation. The quiz above draws from all 150.

Sample 1 · Section A: Enterprise Risk · Syllabus ref A1c

A board sets a risk tolerance limit stating that no single identified risk should be capable of causing a loss exceeding 3% of the organisation's net assets. The organisation's net assets are $200 million. What is the maximum loss, in $ million, that a single risk can threaten before it breaches this tolerance limit? Workings: Tolerance threshold = Net assets x tolerance percentage = $200m x 0.03.

  1. 3
  2. 6
  3. 60
  4. 200
Show answer and explanation

Answer: B. The tolerance threshold in monetary terms is calculated by applying the stated percentage to the relevant base figure (net assets): $200m x 0.03 = $6 million. Any risk with a potential loss above this threshold breaches the board's stated tolerance and requires specific escalation or mitigation. $3 million simply restates the tolerance percentage as if it were a dollar figure. $60 million would result from using 30% instead of the correct 3%, a misplaced decimal point. $200 million is simply the net assets figure itself, with no percentage applied at all.

Sample 2 · Section C: Internal Controls · Syllabus ref C1b

An internal auditor tests a sample of 40 transactions drawn from a population of 2,000 similar transactions and finds 2 errors in the sample. Extrapolating this error rate to the full population, how many transactions would be projected to contain an error? Workings: Sample error rate = 2 / 40 = 5%. Projected population errors = 5% x 2,000.

  1. 2
  2. 40
  3. 100
  4. 10
Show answer and explanation

Answer: C. The sample error rate is 2 out of 40 tested, or 5%. Applying this rate to the full population of 2,000 transactions projects 5% x 2,000 = 100 transactions likely to contain an error, a figure the auditor would use to assess whether the projected error rate is material and whether further investigation or a larger sample is warranted. 2 simply restates the number of errors found in the sample itself, without extrapolating to the full population. 40 simply restates the sample size, not the projected population error count. 10 would result from using a 0.5% error rate instead of the correct 5%, a misplaced decimal point.

Sample 3 · Section B: Strategic Risk · Syllabus ref B1a

A company is considering entering a new overseas market. Management estimates a 60% probability of achieving a profit of £5 million if the entry succeeds, and a 40% probability of incurring a loss of £1 million if it does not. What is the expected value of this market entry decision, in £? Workings: EV = (0.60 x £5,000,000) + (0.40 x -£1,000,000) = £3,000,000 - £400,000.

  1. 3000000
  2. 2600000
  3. 3400000
  4. 4000000
Show answer and explanation

Answer: B. Expected value combines each possible outcome weighted by its probability: (0.60 x £5,000,000) + (0.40 x -£1,000,000) = £3,000,000 - £400,000 = £2,600,000. A positive expected value suggests the decision is worthwhile on average, though the board would also need to weigh the risk of the 40% downside scenario against its risk appetite, not rely on expected value alone. £3,000,000 only reflects the weighted upside scenario and omits the weighted downside loss entirely. £3,400,000 would result from adding rather than subtracting the weighted loss (£3,000,000 + £400,000). £4,000,000 simply adds the two raw outcome values together without weighting either by its probability.

About this question bank

150 questions across 4 syllabus sections, each mapped to a reference in the official CIMA syllabus for P3 and each with a worked explanation. 130 are multiple choice and 20 are numerical, where you work the answer out before choosing it.

Syllabus sectionQuestions
A: Enterprise Risk38
B: Strategic Risk37
C: Internal Controls38
D: Cyber Risk37
Advertisement