CRA Risk Dashboard & Heat Maps 3 — Questions and Answers
Question 1: What is the purpose of a risk velocity indicator on a risk dashboard?
- To measure how quickly a risk can be transferred to a third party
- To capture how fast a risk is moving toward or away from its impact threshold (Correct answer)
- To count the number of new risks identified per quarter
- To calculate the monetary speed of loss recovery
Correct answer: To capture how fast a risk is moving toward or away from its impact threshold
Risk velocity measures the speed at which a risk is developing or escalating, helping managers prioritize emerging threats before they materialize.
Question 2: In a 5x5 risk matrix, how many total cells exist and what is the maximum possible risk score if likelihood and impact are each scored 1–5?
- 20 cells; maximum score 10
- 25 cells; maximum score 25 (Correct answer)
- 25 cells; maximum score 10
- 16 cells; maximum score 25
Correct answer: 25 cells; maximum score 25
A 5x5 matrix has 25 cells, and multiplying the maximum scores of 5 (likelihood) × 5 (impact) yields a maximum risk score of 25.
Question 3: Which technique helps prevent 'heat map inflation,' where too many risks are rated as high?
- Requiring dual sign-off by risk owners and the CFO
- Applying forced ranking or calibration workshops across risk owners (Correct answer)
- Limiting the heat map to a maximum of 10 risks
- Using only quantitative data, eliminating all qualitative judgments
Correct answer: Applying forced ranking or calibration workshops across risk owners
Calibration workshops and forced ranking ensure that risk owners apply consistent scoring standards, reducing the bias toward over-rating all risks as high.
Question 4: A Key Risk Indicator (KRI) on a dashboard shows a value at 95% of its threshold. What action should this trigger?
- No action; the threshold has not been breached
- Amber alert status and escalation to risk management for review (Correct answer)
- Immediate activation of the business continuity plan
- Automatic transfer of the risk to insurance
Correct answer: Amber alert status and escalation to risk management for review
A reading near the threshold (often the amber zone) should trigger a management review before the red threshold is breached.
Question 5: What distinguishes an inherent risk rating from a residual risk rating on a heat map?
- Inherent risk excludes financial impacts; residual risk includes them
- Inherent risk is the exposure before controls; residual risk reflects exposure after controls are applied (Correct answer)
- Inherent risk is rated by auditors; residual risk is rated by management
- Inherent risk applies only to strategic risks; residual risk applies to operational risks
Correct answer: Inherent risk is the exposure before controls; residual risk reflects exposure after controls are applied
Inherent risk captures the raw exposure before any mitigating controls, while residual risk represents remaining exposure after controls are factored in.
Question 6: Which dashboard design principle reduces cognitive load for risk reviewers?
- Displaying all risks on a single page regardless of count
- Using consistent color codes, icons, and layouts across all panels (Correct answer)
- Rotating chart types each reporting period to maintain interest
- Including footnotes with full statistical methodology on the main view
Correct answer: Using consistent color codes, icons, and layouts across all panels
Consistency in visual language (colors, icons, layout) allows reviewers to interpret information faster without relearning conventions each time.
Question 7: When a risk heat map is used in an enterprise risk management (ERM) program, how should it be refreshed?
- Only when a major incident occurs
- On a schedule aligned with the risk assessment cycle, typically quarterly or annually (Correct answer)
- Whenever a new risk owner is appointed
- Daily, using automated market data feeds exclusively
Correct answer: On a schedule aligned with the risk assessment cycle, typically quarterly or annually
Heat maps should be updated in alignment with the organization's formal risk assessment cadence to remain relevant and actionable.
CRA Risk Dashboard & Heat Maps 3
What is the purpose of a risk velocity indicator on a risk dashboard?