You’re on a roll
Create a free account to save your ACCA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › ACCA › Strategic Business Leader
Free ACCA Strategic Business Leader Practice Questions & Answers
300 exam-style Strategic Business Leader questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
What is 'climate risk' in a corporate risk context?
Select an option first.
Correct answer: B — The financial risks arising from climate change — both physical risks (extreme weather, sea level rise) and transition risks (regulatory change, shifting market preferences as economies decarbonise)
Explanation: B is correct. Climate risk has two components: physical risks (direct impact of climate change on assets and operations) and transition risks (risks arising from the shift to a low-carbon economy — new regulations, changed customer behaviour, stranded assets). A, C and D are too narrow.
Question 122
What is a 'risk culture'?
Select an option first.
Correct answer: B — The shared values, attitudes, and behaviours related to risk awareness and risk management that are embedded throughout an organisation
Explanation: B is correct. Risk culture determines how staff at every level think about and respond to risk in their daily work. A strong risk culture enables effective ERM; a weak one undermines it regardless of formal frameworks. A, C and D describe tools or processes rather than culture.
Question 123
What is the difference between 'risk likelihood' and 'risk impact'?
Select an option first.
Correct answer: B — Likelihood is the probability or frequency of a risk event occurring; impact is the magnitude of consequences if it does occur
Explanation: B is correct. Risk assessment involves scoring both dimensions: likelihood (how probable?) and impact (how serious?). Together they determine priority. A risk with high likelihood but low impact may need less attention than a low-likelihood, high-impact event. A, C and D are incorrect distinctions.
Question 124
What is 'business continuity planning' (BCP)?
Select an option first.
Correct answer: B — A framework ensuring that critical business functions can continue or quickly recover during and after a disruptive event
Explanation: B is correct. BCP identifies critical processes and assets, establishes recovery procedures and alternative arrangements, and defines roles in a crisis. It minimises disruption from events like IT failures, natural disasters, or cyberattacks. A is asset insurance. C and D are unrelated.
Question 125
What is 'disaster recovery planning' (DRP)?
Select an option first.
Correct answer: B — A subset of BCP focused specifically on restoring IT systems and data after a major disruption
Explanation: B is correct. DRP is IT-focused — it covers data backup, system restoration, recovery time objectives, and recovery point objectives. It is a subset of the broader BCP, which covers all critical business functions. A, C and D are different types of planning.
Get the full ACCA question bank — free
Drop your email and we'll send you fresh ACCA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
What does 'recovery time objective' (RTO) mean?
Select an option first.
Correct answer: B — The maximum acceptable time for restoring a system or process after a disruption before the impact becomes unacceptable
Explanation: B is correct. RTO defines how quickly systems or processes must be restored. Together with recovery point objective (RPO — how much data loss is acceptable), it guides investments in resilience and backup infrastructure. A, C and D are unrelated.
Question 127
What is 'risk transfer'?
Select an option first.
Correct answer: B — Shifting the financial consequences of a risk to a third party — through insurance, outsourcing, or contractual arrangements — so that another party bears the cost if the risk materialises
Explanation: B is correct. Risk transfer does not eliminate the risk but shifts financial liability. Insurance is the classic example. Outsourcing can transfer operational risk to a supplier. D describes risk avoidance (termination). C is risk reporting. A describes reallocation within the organisation.
Question 128
What is a 'risk owner'?
Select an option first.
Correct answer: B — The individual or function assigned accountability for managing a specific risk, including implementing controls and monitoring outcomes
Explanation: B is correct. Each risk in the risk register should have a named owner — accountable for the day-to-day management of that risk, monitoring its status, and escalating if it exceeds tolerance. A and D are governance structures. C is a risk transfer arrangement.
Question 129
What is 'risk aggregation'?
Select an option first.
Correct answer: B — Combining individual risk exposures to understand their total combined impact on the organisation, recognising that correlated risks may materialise simultaneously
Explanation: B is correct. Risk aggregation recognises that individual risks do not always occur independently — multiple risks may be triggered by the same event (e.g., a cyberattack causes operational, reputational, and financial risk simultaneously). Understanding correlations is crucial for ERM. A, C and D describe different processes.
Question 130
What is an internal control system?
Select an option first.
Correct answer: B — A set of policies, procedures, and activities designed to ensure objectives are achieved, risks are managed, and resources are used efficiently and in compliance with regulations
Explanation: B is correct. An internal control system encompasses all the controls designed by management to safeguard assets, ensure accuracy of records, promote operational efficiency, and ensure compliance. A, C and D are other organisational systems.
Question 131
What are the five components of internal control in the COSO framework?
Select an option first.
Correct answer: B — Control environment, risk assessment, control activities, information and communication, and monitoring
Explanation: B is correct. COSO's internal control framework has five components: (1) Control environment (culture, tone at the top), (2) Risk assessment (identifying and analysing risks), (3) Control activities (policies and procedures), (4) Information and communication, (5) Monitoring (ongoing assessment of control effectiveness). A, C and D are different frameworks.
Question 132
What is a 'control environment'?
Select an option first.
Correct answer: B — The overall attitude, awareness, and actions of directors and management regarding the importance of internal control — setting the tone for the effectiveness of the entire control system
Explanation: B is correct. The control environment is the foundational element of internal control — it reflects the culture, values, and commitment to integrity from the top. Without a sound control environment, specific controls (D) will be undermined. A and C are technical security measures.
Question 133
What is a 'preventive control'?
Select an option first.
Correct answer: B — A control designed to prevent errors, fraud, or irregularities from occurring in the first place
Explanation: B is correct. Preventive controls act before events occur — e.g., segregation of duties, authorisation requirements, access controls. Detective controls (A) identify problems after the fact — e.g., reconciliations, audits. Corrective controls (C) fix identified problems.
Question 134
What is 'segregation of duties' (SoD) and why is it important?
Select an option first.
Correct answer: B — Ensuring that no single individual can initiate, authorise, record, and custody an asset in a single transaction — reducing the risk of undetected error or fraud
Explanation: B is correct. SoD prevents fraud by requiring two or more people to complete a transaction. For example, the person who approves a payment should not also process it. This limits opportunities for misappropriation and creates a natural check. A, C and D mischaracterise it.
Question 135
What is 'authorisation' as an internal control?
Select an option first.
Correct answer: B — A control requiring that transactions or activities are approved by an appropriately empowered person before they are executed
Explanation: B is correct. Authorisation controls ensure that only valid, approved transactions are processed. Approval levels are typically set by monetary thresholds or risk significance. A, C and D describe different authorisation processes.
Question 136
What is a 'reconciliation' as an internal control?
Select an option first.
Correct answer: B — The process of comparing two sets of records to ensure they agree, identifying and investigating differences
Explanation: B is correct. Reconciliations are detective controls — e.g., bank reconciliations comparing the cash book to bank statements, or debtor ledger reconciliations. Differences are investigated and corrected. A and D describe meeting processes. C describes a financial ratio.
Question 137
What is the purpose of internal audit?
Select an option first.
Correct answer: B — To provide independent, objective assurance and consulting services designed to add value and improve an organisation's operations, particularly in governance, risk, and control
Explanation: B is correct. Internal audit is an in-house function (or outsourced) that gives management and the audit committee assurance that internal controls are working effectively. It differs from external audit (C — statutory, independent, focused on financial statements). A and D are separate functions.
Question 138
What is the difference between internal audit and external audit?
Select an option first.
Correct answer: B — External audit provides independent statutory assurance on financial statements to shareholders; internal audit provides management with assurance on risk, control, and governance processes
Explanation: B is correct. External audit is a statutory requirement, conducted by independent registered auditors, resulting in an opinion on the truth and fairness of financial statements for shareholders. Internal audit is an internal assurance function, focused on controls, risk, and governance, reporting to management and the audit committee.
Question 139
What is 'control risk' in the context of internal audit?
Select an option first.
Correct answer: B — The risk that an organisation's internal controls will fail to prevent or detect a material misstatement or loss
Explanation: B is correct. Control risk reflects the possibility that controls are not effective — they may be poorly designed, circumvented, or simply not operating as intended. High control risk means auditors must do more substantive testing. A, C and D are different risk types.
Question 140
What is a 'whistleblowing' mechanism in corporate governance?
Select an option first.
Correct answer: B — A channel that allows employees to report concerns about wrongdoing — fraud, legal violations, or ethical breaches — safely and confidentially, without fear of retaliation
Explanation: B is correct. Effective whistleblowing channels (often anonymous hotlines or independent reporting systems) are a key internal control. They enable the organisation to detect misconduct before it escalates. A, C and D describe different processes.
Question 141
What is 'fraud risk'?
Select an option first.
Correct answer: B — The risk that individuals will act dishonestly to gain an advantage — through misappropriation, manipulation of records, or deceptive practices
Explanation: B is correct. Fraud risk includes asset misappropriation (theft), financial statement fraud (misrepresenting results), and corruption. Strong internal controls — especially segregation of duties, authorisation, and reconciliation — reduce fraud risk. A, C and D describe narrow or consequential aspects of fraud.
Question 142
What is the 'fraud triangle'?
Select an option first.
Correct answer: B — A model identifying three conditions that enable most fraud: opportunity (weak controls), motivation (financial pressure or incentive), and rationalisation (the perpetrator justifies their actions)
Explanation: B is correct. The fraud triangle (Cressey) identifies the combination of opportunity, pressure/motivation, and rationalisation as the key enablers of most fraud. Effective controls target opportunity — the only factor organisations can directly address. A, C and D are unrelated.
Question 143
What is 'big data' and why is it strategically significant?
Select an option first.
Correct answer: B — Extremely large, complex datasets characterised by volume, velocity, and variety that, when analysed, yield insights enabling better strategic and operational decisions
Explanation: B is correct. Big data's strategic significance lies in the insights it enables — pattern recognition, customer behaviour prediction, operational optimisation, and competitive intelligence. The three Vs (volume, velocity, variety) distinguish it from traditional data. A, C and D are technical rather than strategic.
Question 144
What is data analytics?
Select an option first.
Correct answer: B — The examination of raw data using statistical and computational techniques to discover patterns, draw conclusions, and support decision-making
Explanation: B is correct. Data analytics encompasses descriptive (what happened), diagnostic (why it happened), predictive (what will happen), and prescriptive (what should we do) analytics. It transforms raw data into actionable insight. A, C and D are data management activities.
Question 145
What is 'artificial intelligence' (AI) in a business context?
Select an option first.
Correct answer: B — Computer systems designed to perform tasks that typically require human intelligence — such as pattern recognition, natural language processing, and decision-making — using machine learning and other techniques
Explanation: B is correct. AI enables machines to learn from data, adapt to new inputs, and perform cognitive tasks. In business, it is applied to customer service (chatbots), fraud detection, process automation, and strategic analysis. A and C are narrow applications. D is a different technology.
Question 146
What is 'machine learning' (ML)?
Select an option first.
Correct answer: B — A type of AI where algorithms learn from data to improve their performance on a task over time without being explicitly programmed for each new situation
Explanation: B is correct. ML algorithms improve through experience — they are trained on datasets and adjust their parameters to optimise predictions or decisions. It underpins applications from recommendation engines to credit scoring. A, C and D are non-technical interpretations.
Question 147
What is 'robotic process automation' (RPA)?
Select an option first.
Correct answer: B — Software that mimics human actions in digital systems to automate repetitive, rule-based tasks — such as data entry, invoice processing, and report generation
Explanation: B is correct. RPA uses software bots to perform structured, repetitive tasks at speed and without error, freeing human staff for higher-value work. Unlike AI, RPA follows fixed rules and does not learn. A is physical automation. C is AI. D is cloud infrastructure.
Question 148
What is cloud computing?
Select an option first.
Correct answer: B — The delivery of computing services — servers, storage, databases, software, and analytics — over the internet, enabling scalable access without owning physical infrastructure
Explanation: B is correct. Cloud computing (IaaS, PaaS, SaaS) allows organisations to scale IT resources dynamically, reduce capital expenditure on hardware, and access services globally. A, C and D are different technologies or services.
Question 149
What is 'cybersecurity risk'?
Select an option first.
Correct answer: B — The risk of harm arising from cyberattacks, data breaches, malware, or unauthorised access to systems, which can disrupt operations, compromise sensitive data, and cause reputational and financial damage
Explanation: B is correct. Cybersecurity risk is one of the most significant modern enterprise risks — affecting data integrity, operational continuity, financial systems, and reputation. It is not limited to physical theft (A), behavioural issues (C), or obsolescence (D).
Question 150
What is a 'phishing' attack?
Select an option first.
Correct answer: B — A social engineering technique where attackers send deceptive messages purporting to be from legitimate sources to trick individuals into revealing credentials or installing malware
Explanation: B is correct. Phishing exploits human behaviour rather than technical vulnerabilities. Spear phishing targets specific individuals. C describes ransomware. D describes a Distributed Denial of Service (DDoS) attack.
More free ACCA topics
Management Accounting401
Financial Accounting400
Corporate and Business Law400
Performance Management400
Financial Reporting400
Financial Management400
Strategic Business Reporting400
Advanced Financial Management400
Advanced Performance Management400
Advanced Taxation400
Business and Technology300
Taxation300
Audit and Assurance300
Advanced Audit and Assurance296
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.