CRMA Cheat Sheet 2026

The 30 highest-yield CRMA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Risk-based audit planning requires internal audit to prioritize the audit universe based on: → The significance of risks and adequacy of controls in each auditable area.
2. The concept of 'tone at the top' in risk governance primarily refers to: → Senior leadership modeling risk-aware behavior and reinforcing accountability
3. Which stakeholder group typically provides the most valuable input during the risk identification phase of engagement planning? → Senior management and business process owners
4. Under the COSO ERM framework, 'risk capacity' represents: → The maximum risk an organization can absorb before threatening its viability.
5. A Chief Risk Officer (CRO) reporting directly to the CEO with no board access would be MOST problematic because: → It prevents independent risk escalation to the board, weakening governance
6. What is a key risk of insufficient coordination among assurance providers at an organization? → Significant risk areas left without assurance coverage, creating blind spots for the board
7. What does 'inherent risk' represent in a risk assessment? → The risk that exists before any mitigating controls are considered
8. When external auditors assess the extent to which they can rely on internal audit's work, which professional standards guide their evaluation? → PCAOB AS 2605 or equivalent standards addressing the use of the work of other auditors
9. The COSO ERM 2017 'Review & Revision' component is most analogous to which phase of a standard management cycle? → Check and Act
10. A risk governance failure most commonly occurs when: → Risk ownership is unclear and accountability is not assigned to specific roles
11. Which metric is MOST useful when quantitatively assessing whether an organization's actual risk-taking aligns with its stated risk appetite? → Key Risk Indicators (KRIs) tracked against defined thresholds.
12. A key limitation of relying solely on management's risk self-assessments during engagement planning is: → Management may understate risks to avoid scrutiny or negative attention
13. A 'black swan' event in risk management refers to: → A rare, unpredictable event with extreme consequences that is rationalized in hindsight
14. Which of the following must be communicated even if a consulting engagement scope does not include it? → Significant governance, risk, or control issues identified during the engagement
15. A significant gap in ERM coverage is identified by internal audit. Who should receive this finding FIRST? → Management, so they have an opportunity to remediate before board communication
16. Which of the following is an example of a 'leading' risk indicator? → Percentage of staff who have not completed mandatory compliance training
17. Operational risk is defined in ERM practice as the risk of loss resulting from: → Inadequate or failed internal processes, people, systems, or external events.
18. A 'risk universe' in ERM context refers to: → A comprehensive inventory of all risks that could affect the organization's objectives.
19. Under the Basel II/III operational risk framework, the Advanced Measurement Approach (AMA) required banks to use: → Their own internal models validated by regulators
20. When communicating ERM assurance results to the board, internal audit should PRIMARILY: → Provide an overall opinion on the adequacy and effectiveness of ERM processes
21. When coordinating with external auditors, internal audit's PRIMARY objective is to: → Minimize duplication of effort and maximize total assurance coverage
22. In risk appetite assessment, what does the term 'residual risk appetite' refer to? → The level of risk acceptable after controls and mitigations have been applied.
23. Which of the following is the PRIMARY benefit of standardizing risk communication templates across business units? → Enabling consistent comparison and aggregation of risk information across the enterprise
24. Within the COSO ERM framework, which component directly addresses how governance and culture shape an organization's risk management approach? → Governance and Culture
25. Who bears primary governance responsibility for approving the organization's Enterprise Risk Management policy? → The board of directors or its delegated committee
26. When evaluating risk culture, focus groups are preferred over surveys in situations where: → Rich contextual understanding of attitudes is needed and sample size is small
27. ISO 31000:2018 identifies which of the following as the first step in the risk management process? → Scope, context, and criteria establishment
28. Risk-based audit planning requires internal audit to PRIMARILY: → Allocate audit resources to areas with the greatest risk exposure relative to controls
29. A business unit manager believes a risk has been overstated in the enterprise risk report. What is the MOST appropriate first step? → Raise the concern with risk management through an established challenge process
30. Which principle should guide the CRMA professional when tailoring risk communication for different audiences? → Adapt content depth and terminology to the audience's role and expertise