Risk Management (P3)
150 questions mapped to the current AICPA & CIMA Strategic Level blueprint (2026/27). Covers enterprise risk, strategic risk, internal controls, and cyber risk. Switch to Exam Sim mode for a timed CIMA P3 mock exam: 60 questions, 90 minutes.
→ P3 Common Mistakes & Exam Technique: the errors that catch P3 students out, and how to avoid them.
The P3 exam format
| Format | Computer-based objective test. All questions are compulsory. |
|---|---|
| Length | 90 minutes, 60 questions. |
| Scoring | Reported as a scaled score from 0 to 150. Questions are weighted by difficulty, so the scaled score is not a straight percentage of questions answered correctly. |
| Pass mark | 100 out of 150. |
| Case Study | Separate from this exam. The Strategic Case Study is sat after the three strategic-level objective tests and has its own pass mark of 80 out of 150. |
Always check the current exam format on the AICPA & CIMA website before you sit.
Loading questions…
P3 Formula Sheet: all key formulas on one printable A4 page. Free to download, or see what's on it.
↓ Download PDFSample P3 questions
Three questions from this bank, each with its answer and worked explanation. The quiz above draws from all 150.
A board sets a risk tolerance limit stating that no single identified risk should be capable of causing a loss exceeding 3% of the organisation's net assets. The organisation's net assets are $200 million. What is the maximum loss, in $ million, that a single risk can threaten before it breaches this tolerance limit? Workings: Tolerance threshold = Net assets x tolerance percentage = $200m x 0.03.
- 3
- 6
- 60
- 200
Show answer and explanation
Answer: B. The tolerance threshold in monetary terms is calculated by applying the stated percentage to the relevant base figure (net assets): $200m x 0.03 = $6 million. Any risk with a potential loss above this threshold breaches the board's stated tolerance and requires specific escalation or mitigation. $3 million simply restates the tolerance percentage as if it were a dollar figure. $60 million would result from using 30% instead of the correct 3%, a misplaced decimal point. $200 million is simply the net assets figure itself, with no percentage applied at all.
An internal auditor tests a sample of 40 transactions drawn from a population of 2,000 similar transactions and finds 2 errors in the sample. Extrapolating this error rate to the full population, how many transactions would be projected to contain an error? Workings: Sample error rate = 2 / 40 = 5%. Projected population errors = 5% x 2,000.
- 2
- 40
- 100
- 10
Show answer and explanation
Answer: C. The sample error rate is 2 out of 40 tested, or 5%. Applying this rate to the full population of 2,000 transactions projects 5% x 2,000 = 100 transactions likely to contain an error, a figure the auditor would use to assess whether the projected error rate is material and whether further investigation or a larger sample is warranted. 2 simply restates the number of errors found in the sample itself, without extrapolating to the full population. 40 simply restates the sample size, not the projected population error count. 10 would result from using a 0.5% error rate instead of the correct 5%, a misplaced decimal point.
A company is considering entering a new overseas market. Management estimates a 60% probability of achieving a profit of £5 million if the entry succeeds, and a 40% probability of incurring a loss of £1 million if it does not. What is the expected value of this market entry decision, in £? Workings: EV = (0.60 x £5,000,000) + (0.40 x -£1,000,000) = £3,000,000 - £400,000.
- 3000000
- 2600000
- 3400000
- 4000000
Show answer and explanation
Answer: B. Expected value combines each possible outcome weighted by its probability: (0.60 x £5,000,000) + (0.40 x -£1,000,000) = £3,000,000 - £400,000 = £2,600,000. A positive expected value suggests the decision is worthwhile on average, though the board would also need to weigh the risk of the 40% downside scenario against its risk appetite, not rely on expected value alone. £3,000,000 only reflects the weighted upside scenario and omits the weighted downside loss entirely. £3,400,000 would result from adding rather than subtracting the weighted loss (£3,000,000 + £400,000). £4,000,000 simply adds the two raw outcome values together without weighting either by its probability.
About this question bank
150 questions across 4 syllabus sections, each mapped to a reference in the official CIMA syllabus for P3 and each with a worked explanation. 130 are multiple choice and 20 are numerical, where you work the answer out before choosing it.
- Written to CIMA's 2019 Professional Qualification syllabus.
- Spotted a mistake? Report it and it will be corrected.
| Syllabus section | Questions |
|---|---|
| A: Enterprise Risk | 38 |
| B: Strategic Risk | 37 |
| C: Internal Controls | 38 |
| D: Cyber Risk | 37 |