CRA Strategic Risk and Governance 3 — Questions and Answers
Question 1: A Certified Risk Architect is asked to embed risk culture into the organization. Which action has the GREATEST long-term impact?
- Distributing an annual risk awareness survey
- Ensuring senior leaders visibly model risk-aware decision-making and reward escalation (Correct answer)
- Publishing detailed risk policies on the intranet
- Conducting a one-time risk culture training for all employees
Correct answer: Ensuring senior leaders visibly model risk-aware decision-making and reward escalation
Culture is shaped primarily by leadership behavior and incentive systems rather than policies or one-time training events.
Question 2: Enterprise Risk Management (ERM) frameworks like COSO ERM 2017 emphasize integrating risk management with:
- IT governance frameworks only
- Strategy setting and performance management (Correct answer)
- Financial reporting controls exclusively
- Regulatory compliance programs as the primary driver
Correct answer: Strategy setting and performance management
COSO ERM 2017 explicitly links risk management to strategy setting and performance to enhance value creation and preservation.
Question 3: A board committee is reviewing the organization's risk taxonomy. The PRIMARY purpose of a risk taxonomy is to:
- Assign dollar values to every identified risk
- Provide a consistent language and classification system for risk across the enterprise (Correct answer)
- Replace the risk register with a simplified categorization chart
- Determine which risks require board versus management oversight
Correct answer: Provide a consistent language and classification system for risk across the enterprise
A risk taxonomy establishes a common vocabulary and category structure that enables consistent identification, aggregation, and reporting across the enterprise.
Question 4: Horizon scanning in strategic risk governance is used primarily to:
- Review past risk events and calculate historical loss frequencies
- Identify emerging threats and opportunities before they materialize into significant risks (Correct answer)
- Benchmark the organization's risk profile against industry peers
- Establish the annual budget allocation for risk mitigation activities
Correct answer: Identify emerging threats and opportunities before they materialize into significant risks
Horizon scanning is a forward-looking technique that identifies weak signals of emerging risks before they escalate.
Question 5: Under COSO ERM 2017, which of the following is classified as a component of 'Strategy and Objective-Setting'?
- Risk identification and assessment
- Business context analysis and risk appetite definition (Correct answer)
- Control activities and monitoring
- Governance and culture
Correct answer: Business context analysis and risk appetite definition
COSO ERM 2017 places business context analysis and risk appetite definition within the Strategy and Objective-Setting component.
Question 6: A risk architect is designing a risk reporting framework for the board. Reports should PRIMARILY be:
- Detailed transaction-level logs of all identified risks
- Concise, material, forward-looking, and tied to strategic objectives (Correct answer)
- Backward-looking summaries of all past losses in the quarter
- Technical analyses written for risk specialists rather than directors
Correct answer: Concise, material, forward-looking, and tied to strategic objectives
Board-level risk reports must be concise and strategic, focusing on material risks and forward-looking indicators relevant to decision-making.
Question 7: When integrating risk management into capital allocation decisions, which approach BEST reflects a risk-adjusted framework?
- Allocating capital equally across all business units regardless of risk profile
- Directing capital to projects with the highest absolute return without risk adjustment
- Using risk-adjusted return on capital (RAROC) to compare opportunities across different risk levels (Correct answer)
- Avoiding capital deployment in any business unit with identified strategic risks
Correct answer: Using risk-adjusted return on capital (RAROC) to compare opportunities across different risk levels
RAROC normalizes returns for risk, enabling fair comparison across opportunities with different risk profiles and supporting value-maximizing capital decisions.
CRA Strategic Risk and Governance 3
A Certified Risk Architect is asked to embed risk culture into the organization.
Which action has the GREATEST long-term impact?