CRA ERM & COSO Framework 3

Question 1

Which COSO ERM component includes the process of prioritizing risks based on their severity relative to risk appetite?

Accepted Answer

Performance

Answer

The Performance component covers risk identification, assessment, prioritization, and the selection of risk responses.

Question 2

A Chief Risk Officer presents a heat map showing 12 risks mapped by likelihood and impact. Which limitation of heat maps should the board be most aware of?

Accepted Answer

They may obscure the aggregate correlation between risks

Answer

Heat maps display individual risks but do not inherently capture how correlated risks can amplify each other when occurring together.

Question 3

In COSO's three-lines-of-defense model, which line is responsible for providing independent assurance to the board and senior management?

Accepted Answer

Third line — internal audit

Answer

Internal audit (third line) provides independent assurance on the effectiveness of governance, risk management, and internal controls.

Question 4

When applying the COSO ERM framework to a strategic merger decision, risk identification should occur:

Accepted Answer

During strategy formulation, before the final decision is made

Answer

COSO ERM emphasizes integrating risk identification into strategy-setting so that risk informs—rather than follows—major decisions.

Question 5

A company's risk register shows an inherent risk rated 'High' with a residual risk rated 'Low.' What does this indicate?

Accepted Answer

Existing controls are effectively reducing the risk to an acceptable level

Answer

The gap between inherent and residual risk reflects the effectiveness of controls in mitigating exposure.

(CRA) Certified Risk Analyst Practice Test

(CRA) Certified Risk Analyst Practice Test

CRA ERM & COSO Framework 3