KLO is a major quoted car rental company The company is considering publishing its first cyber risk management report AH rental bookings are made online Customers receive a booking reference number that they use to collect their cars from a convenient branch Customers enter their credit card details both so that KLO can take payment for their rental and also so that the customers can be charged automatically for late returns or damage to cars KLO's management believes that it has three key areas of cyber risk Cyber criminals may wish to make bookings using fictitious data in order to steal KLO's cars, they may wish to use customers details to identify addresses of people who are away from home so that they can burgle houses and they may wish to abuse customer credit card details KLO's Board is concerned that admitting to the nsk of stealing cars might encourage cnminals to exploit that vulnerability AJso. it is concerned that customers will be reluctant to rent cars if that would mean that their homes could be at risk of burglary while they are away The vulnerability of credit card details seems obvious and so the Board is not reluctant to admit to that.
Which TWO of the following are correct?

• A. The independent accountant's report on KLO's cyber risk management will refer only to those vulnerabilities that have been identified by KLO's Board
• B. The Board should be clear about all sensitive information that the company holds, but should also be clear about the robust controls in place to safeguard that information.
• C. Stakeholders will not care about the vulnerabilities faced by KLO provided the independent accountant can confirm that the company has sound systems in place
• D. The independent accountant who will express an opinion on the risks and controls will be unwilling to sign the report unless it contains a full account of all risks and controls
• E. If KLO's Board omits one of more areas of concern from the report then the independent accountant who will sign the report is unlikely to discover that omission

You have just been appointed Financial Controller of Y, a marketing consultancy.
You are in a meeting with the Chief Executive Officer (CEO) of Y, and have been discussing the need for a major upgrade of all the information systems throughout Y, as they are all very old.
Knowing that major change should be managed effectively, you have suggested that Y should have a 'systems steering committee'.
Advise the CEO which of the following should be included in the terms of reference of the steering committee.

• A. Plan for new systems
• B. Ensure the new system will meet the company's goals
• C. Develop new systems
• D. Manage the project
• E. Consider the competitive issues raised by the new system

TDC is a company which runs gas-fired power stations in western Europe. The Risk Committee has just received a report that a power station built to the same design and specification in a developing country has recently collapsed. The causes of the collapse are unclear but the consequences for TDC would be catastrophic if something similar were to happen in Europe Which of the following actions being considered by the Risk Committee are ethical?
Select ALL that apply

• A. Commission a reputable firm of structural engineers to carry out a review of all power stations owned by TDC
• B. Draw up contingency plans in case some of TDC's power stations need to be shut down
• C. Issue a press release confirming that all TDC's power stations are "entirely safe'.
• D. Attempt to increase the level of insurance cover against this type of eventuality
• E. Send experts employed by TDC to the site of the collapse so that they can gather information first hand on what happened
• F. Decide that the information available to date is too uncertain to take any action for now

K has several subsidiary companies. The directors of K's subsidiaries are paid an annual bonus based upon their particular subsidiary's reported profits.
The directors of one of K's subsidiaries are considering the choice between two models of a machine.
Which of the following is most likely to explain the decision to choose model X over model Y?

• A. Investing in model X will mean the subsidiary will show a higher profit.
• B. Model X is the less risky investment.
• C. Model X has a better combination of investment and running costs.
• D. Investing in model X will lead to a higher share price.