CRA Study Guide 2026

Risk acceptance is a deliberate decision by an organization to acknowledge a risk and tolerate its potential consequences without implementing specific mitigation actions to reduce its likelihood or impact. This strategy is typically chosen when the cost of mitigation outweighs the potential loss, or when the risk is deemed low. However, it often involves having contingency plans in place to manage the fallout if the risk materializes.

KRIs serve as early warning metrics that signal when risk levels are approaching unacceptable thresholds, enabling proactive risk management.

Continuous monitoring of risks is crucial because the business environment is dynamic, meaning new risks can emerge and existing ones can change in nature or severity. This ongoing process allows organizations to promptly identify these shifts and adjust their mitigation strategies accordingly. It ensures the risk management plan remains relevant and effective in protecting the organization.

A Risk Information System centralizes risk data to support consistent reporting, monitoring, and decision-making across the enterprise.

A central theme of the 2017 update to the COSO ERM framework was to more explicitly connect and integrate risk management with strategy and performance. The framework is designed to help organizations anticipate risks to their strategy and understand how risk and performance are intertwined in creating, preserving, and realizing value.

The Crisis Management Team coordinates the overall organizational response to a crisis, making strategic decisions to protect people, assets, and reputation.