@CPAneed:
It's frustrating because this question is more about form than substance.
The whole thing centers on the order of the ERM components. Setting Objectives, Risk Assessment, and Risk Response are the elements present in this scenario and exist in that order in the ERM framework.
The question is about objective-setting and how it would develop. Objectives are not developed from assessments of and responses to risk (objectives come first), so we know B & D are incorrect. Acquiring more buses would be a response to an assessed risk. It would not affect the objective.
Same with C. If you're following the ERM framework, you would not establish tolerable levels of variation and then set a “realistic objective” based on those tolerances. This is working backward (again, risk response does not affect the objective).
Option A presents the process in the proper order: the objective (complying with the bus schedule), the risk assessment (At what point is revenue at risk? They've assessed that 80% compliance is their ideal risk appetite because they start to lose significant revenue below this threshold but do not experience notable increases in revenue above this threshold.), and the risk response (set tolerable levels of compliance above the point at which revenue is placed at significant risk).
One of the key components of Risk Response is the consideration of cost-benefit. While the company's objective is to “fully comply” with the bus schedules, they know that achieving 100% compliance will not yield a significant increase in revenue from what they would earn at 80% So even if we take a common sense approach, rather than an academic one, to considering the answer choices, we know that they are not likely to invest in more buses if they are already achieving 83% compliance. The cost would outweigh the benefit.
.