Certified Management Accountant Risk Management 3 — Questions and Answers
Question 1: The COSO ERM framework identifies how many interrelated components?
- Five
- Six
- Eight (Correct answer)
- Ten
Correct answer: Eight
The original COSO ERM framework (2004) consists of eight interrelated components, later updated in 2017 to five components.
Question 2: A manufacturer decides to discontinue a product line because the liability risk is too high. This risk response is called:
- Risk mitigation
- Risk transfer
- Risk avoidance (Correct answer)
- Risk acceptance
Correct answer: Risk avoidance
Risk avoidance eliminates the risk entirely by deciding not to engage in the activity that creates the risk.
Question 3: Key Risk Indicators (KRIs) are best used to:
- Quantify residual risk after controls
- Provide early warning signals of increasing risk exposure (Correct answer)
- Assign accountability for individual risks
- Calculate the expected monetary value of a risk event
Correct answer: Provide early warning signals of increasing risk exposure
KRIs are forward-looking metrics that signal when risk levels are trending toward unacceptable thresholds.
Question 4: Which term describes the risk that remains after management has implemented controls?
- Inherent risk
- Residual risk (Correct answer)
- Secondary risk
- Control risk
Correct answer: Residual risk
Residual risk is the level of risk exposure remaining after controls and other risk responses have been applied.
Question 5: An organization's risk tolerance differs from risk appetite in that risk tolerance refers to:
- The strategic goals that drive risk-taking behavior
- The maximum acceptable variation around an objective before action is required (Correct answer)
- The process used to rank risks by priority
- The probability that a given risk event will occur
Correct answer: The maximum acceptable variation around an objective before action is required
Risk tolerance is the acceptable deviation from risk appetite — the operational boundary within which management must stay.
Question 6: Which of the following best describes a 'black swan' event in risk management?
- A highly predictable risk with known probability
- A risk that has been fully mitigated through insurance
- A rare, unpredictable event with severe consequences (Correct answer)
- A risk accepted within normal business tolerance
Correct answer: A rare, unpredictable event with severe consequences
Black swan events are extreme outlier occurrences that are nearly impossible to predict but have massive impact when they occur.
Question 7: Scenario analysis in risk management is primarily used to:
- Calculate the exact probability of a single risk event
- Evaluate how an organization would perform under different hypothetical conditions (Correct answer)
- Identify which employees are responsible for specific risks
- Determine the market value of assets at risk
Correct answer: Evaluate how an organization would perform under different hypothetical conditions
Scenario analysis tests organizational resilience by modeling responses to various plausible future states.
Certified Management Accountant Risk Management 3
The COSO ERM framework identifies how many interrelated components?