CRA Strategic Risk and Governance 2

Question 1

A board's Risk Appetite Statement (RAS) sets a tolerance of 2% annual revenue loss from operational failures. When a cyber breach causes 1.8% loss, the BEST governance response is to:

Accepted Answer

Escalate to the board because proximity to the limit signals control weakness

Answer

Treat the event as within tolerance and close the incident

Answer

Immediately revise the RAS upward to 3%

Answer

Transfer all residual risk to a third-party insurer

Question 2

Which governance structure BEST supports an integrated risk architecture across business silos in a large financial institution?

Accepted Answer

A Risk Management Committee with cross-functional representation reporting to the board

Answer

Decentralized risk ownership with no central oversight

Answer

A Chief Risk Officer with dotted-line authority to all business lines

Answer

Embedding risk staff exclusively within each business unit with no shared framework

Question 3

Under the Three Lines of Defense model, internal audit's PRIMARY role in strategic risk governance is to:

Accepted Answer

Provide independent assurance that governance and risk processes are effective

Answer

Own and manage identified strategic risks

Answer

Design and implement risk controls for the first line

Answer

Set the organization's risk appetite on behalf of the board

Question 4

A company's strategic plan projects entry into an emerging market. The risk architecture process should FIRST:

Accepted Answer

Perform a risk identification and materiality assessment for the market-entry strategy

Answer

Purchase political-risk insurance for the new market

Answer

Assign a risk owner after the strategy is fully implemented

Answer

Wait for the first annual risk review cycle to assess the new exposure

Question 5

Concentration risk in a strategic context refers to:

Accepted Answer

Over-reliance on a single revenue source, customer, supplier, or geography

Answer

The tendency of senior managers to focus attention on top-rated risks only

Answer

Capital concentration in liquid assets rather than operating investments

Answer

The cognitive bias of focusing on risks that have occurred before

Question 6

When the board approves a new corporate strategy, the risk function's MOST important immediate action is to:

Accepted Answer

Update the risk register to reflect new and changed strategic risks

Answer

Issue a press release describing the company's risk management capabilities

Answer

Pause all ongoing risk monitoring until the new strategy is fully rolled out

Answer

Replace existing key risk indicators with financial performance metrics only

Question 7

Which metric is MOST appropriate as a Key Risk Indicator (KRI) for strategic execution risk?

Accepted Answer

Percentage of strategic initiative milestones completed on schedule

Answer

Current ratio and quick ratio

Answer

Total number of employee training hours completed

Answer

Gross margin trend over the prior five years