Strategic Risk and Governance Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Strategic Risk and Governance flashcards as text
A multinational firm adopts an ISO 31000:2018-aligned risk architecture. ISO 31000 defines risk as:
Answer: The effect of uncertainty on objectives
ISO 31000:2018 defines risk as 'the effect of uncertainty on objectives,' encompassing both upside and downside outcomes.
A Chief Risk Officer presents the board with a 'risk heat map.' What does the positioning of a risk in the top-right quadrant typically indicate?
Answer: High likelihood and high impact — priority for treatment
Top-right on a heat map represents the intersection of high likelihood and high impact, signaling the highest priority for risk treatment.
Risk appetite and risk tolerance differ in that:
Answer: Risk appetite is the broad level of risk the organization is willing to accept, while risk tolerance defines acceptable variation around that level
Risk appetite states the desired level of risk, and risk tolerance defines the acceptable bandwidth of deviation from that level in practice.
A strategic risk review reveals that the organization's risk profile has shifted significantly due to a merger. The MOST appropriate governance response is to:
Answer: Immediately update the risk appetite statement, risk register, and board reporting to reflect the combined entity's profile
Material changes to organizational structure require immediate updates to the risk architecture to ensure governance remains aligned with the actual risk profile.
Which of the following BEST describes 'risk interconnectedness' in a strategic context?
Answer: The way a risk event in one area can trigger or amplify risks in other areas of the enterprise
Risk interconnectedness describes causal or correlated linkages between risks, where one risk event can cascade into or amplify other risks.
In strategic risk governance, a 'second opinion' or 'challenge function' is MOST important when:
Answer: High-stakes strategic decisions are being made with limited time for deliberation
Challenge functions prevent groupthink and cognitive bias precisely when the stakes are highest and time pressure may suppress dissenting views.
A risk architect is evaluating whether to recommend risk avoidance, reduction, sharing, or acceptance for a new product line. This decision framework is BEST known as:
Answer: Risk treatment selection
Choosing among avoid, reduce, share, and accept options is the core of the risk treatment selection process in ERM frameworks.