Strategic Risk and Governance Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Strategic Risk and Governance flashcards as text
A board's Risk Appetite Statement (RAS) sets a tolerance of 2% annual revenue loss from operational failures. When a cyber breach causes 1.8% loss, the BEST governance response is to:
Answer: Escalate to the board because proximity to the limit signals control weakness
Near-miss breaches signal that controls may be inadequate even when technically within appetite, requiring board-level review.
Which governance structure BEST supports an integrated risk architecture across business silos in a large financial institution?
Answer: A Risk Management Committee with cross-functional representation reporting to the board
A cross-functional Risk Management Committee with board-level reporting enables enterprise-wide visibility while preserving business ownership.
Under the Three Lines of Defense model, internal audit's PRIMARY role in strategic risk governance is to:
Answer: Provide independent assurance that governance and risk processes are effective
Internal audit (third line) provides independent assurance rather than owning or designing controls.
A company's strategic plan projects entry into an emerging market. The risk architecture process should FIRST:
Answer: Perform a risk identification and materiality assessment for the market-entry strategy
Risk identification and materiality assessment must precede strategic commitments so that risk-informed decisions can be made.
Concentration risk in a strategic context refers to:
Answer: Over-reliance on a single revenue source, customer, supplier, or geography
Concentration risk arises when excessive exposure to a single factor amplifies potential losses if that factor deteriorates.
When the board approves a new corporate strategy, the risk function's MOST important immediate action is to:
Answer: Update the risk register to reflect new and changed strategic risks
Updating the risk register ensures the risk architecture reflects the new strategic direction and activates monitoring for emergent exposures.
Which metric is MOST appropriate as a Key Risk Indicator (KRI) for strategic execution risk?
Answer: Percentage of strategic initiative milestones completed on schedule
Milestone completion rates provide forward-looking signals about whether strategy execution is on track, making them effective KRIs for execution risk.