CRA Cheat Sheet 2026

The 30 highest-yield CRA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the context of credit risk, what does 'Loss Given Default' (LGD) measure? → The proportion of exposure that is lost when a default occurs
2. A CRA candidate is reviewing a Business Continuity Plan (BCP). Which element is MOST critical for ensuring the BCP is operationally effective? → Regular testing and exercises that simulate realistic disruption scenarios
3. A risk architect is designing a three lines of defense model. Which function represents the second line of defense? → Risk and compliance functions providing oversight and challenge
4. What is the primary role of senior management in a business continuity program? → To provide strategic direction, resources, and accountability for the BCP program
5. A project schedule risk analysis shows a P50 completion date of June 1 and a P90 date of August 15. What does this mean for the risk manager? → There is a 50% chance the project finishes before June 1 and a 90% chance before August 15
6. What is the primary financial risk implication of a company having a high proportion of fixed costs relative to variable costs? → Higher operating leverage, amplifying earnings volatility during revenue fluctuations
7. Why is it important to assess both internal and external risks? → It helps identify all possible risk sources
8. What is the recommended review frequency for high-risk vendor relationships according to leading TPRM practices? → At least annually, with more frequent reviews based on elevated risk or material changes
9. Which of the following is a limitation of using historical data alone for risk identification and assessment? → Past events may not capture novel or unprecedented risks that have never occurred before
10. What does supply chain resilience mean in an enterprise risk context? → The capacity to maintain operations when key supply chain disruptions occur
11. How does regulatory compliance impact risk management? → Regulatory compliance helps mitigate legal risks and align with industry standards
12. An organization's risk treatment plan includes both preventive and corrective actions for the same risk. This layered approach is known as: → Defense in depth
13. In a risk heat map, which scenario calls for the most urgent mitigation action? → High likelihood, high impact
14. Which regulatory body is primarily responsible for enforcing the Commodity Exchange Act and overseeing derivatives markets in the U.S.? → Commodity Futures Trading Commission (CFTC)
15. Which approach to credit risk modeling uses historical default data and transition matrices to estimate future credit migration? → CreditMetrics
16. Which of the following is the PRIMARY purpose of establishing Key Risk Indicators (KRIs) as part of a risk control system? → To provide an early warning that a risk is more likely to occur.
17. Which of the following best describes 'fourth-party risk' in vendor risk management? → Risk posed by the subcontractors or suppliers used by your direct vendors
18. Which metric best captures the potential loss in a portfolio during a market stress event beyond normal volatility? → Expected Shortfall (CVaR)
19. Which regulatory body oversees the enforcement of the Foreign Corrupt Practices Act (FCPA) for securities-related violations? → Securities and Exchange Commission (SEC)
20. What is the role of stakeholders in the risk management process? → Stakeholders provide insights and help prioritize risks
21. Which of the following is an example of 'boundary risk' in the context of operational risk classification? → Risk events that have characteristics of both operational and market/credit risk
22. In Extreme Value Theory (EVT), the Generalized Pareto Distribution (GPD) is used to model: → Losses that exceed a high threshold (tail events)
23. What is the importance of analyzing the likelihood and impact of risks? → It helps prioritize risk mitigation efforts
24. Under the Consumer Financial Protection Bureau's (CFPB) UDAAP standards, what does the second 'A' in UDAAP stand for? → Abusive
25. Under ISO 31000:2018, the term 'risk treatment' encompasses which of the following actions? → Modifying risk through avoidance, reduction, sharing, or retention
26. What is the main goal of enterprise risk management (ERM)? → To identify and manage risks to achieve business goals
27. In the Poisson process model for operational risk frequency, what does the parameter λ (lambda) represent? → The average number of loss events per unit time
28. Which type of risk response involves partnering with another organization to share both the potential gain and loss of a risky venture? → Risk sharing
29. What is the significance of aligning risk management with business strategy? → It ensures that risk management is integrated into business goals
30. Why is training employees on compliance important? → To ensure employees understand their roles and responsibilities