CRMA CRMA - Certification in Risk Management Assurance Risk Monitoring and Reporting Questions and Answers

Question 1

What is the primary purpose of a Key Risk Indicator (KRI) in an enterprise risk management program?

Accepted Answer

To provide early warning signals that risk levels may be approaching or exceeding acceptable thresholds

Answer

To document historical losses after a risk event has occurred

Answer

To assign accountability for risk ownership to specific departments

Answer

To replace qualitative risk assessments with quantitative data

Question 2

Which of the following BEST describes the difference between a risk report and a risk dashboard?

Accepted Answer

A risk report provides detailed narrative analysis while a dashboard offers a high-level visual summary of current risk status

Answer

A risk report is prepared only for the board while a dashboard is for management only

Answer

A risk dashboard is always more accurate than a formal risk report

Answer

A risk report focuses on operational risks while a dashboard covers strategic risks

Question 3

When designing a risk monitoring program, which characteristic is MOST important for KRIs to be effective?

Accepted Answer

They should be measurable, predictive, and aligned with the organization's risk appetite

Answer

They should be based solely on financial metrics to ensure objectivity

Answer

They should be reported only quarterly to avoid information overload

Answer

They should cover every possible risk regardless of materiality

Question 4

An internal auditor reviewing an ERM monitoring program notes that risk owners are self-reporting KRI data without independent verification. What risk does this create?

Accepted Answer

Data integrity risk, as self-reported metrics may be biased or inaccurate

Answer

Operational risk, as risk owners may not understand their own processes

Answer

Strategic risk, as self-reporting may slow down the reporting cycle

Answer

Compliance risk, as regulatory bodies require third-party validation of all KRIs

Question 5

Which reporting principle ensures that risk information provided to the board is sufficient without overwhelming directors with unnecessary detail?

Accepted Answer

Materiality — reporting should focus on risks that are significant enough to influence decisions

Answer

Completeness — all identified risks must be disclosed regardless of significance

Answer

Timeliness — risks should be reported as soon as they are identified regardless of magnitude

Answer

Accuracy — every reported figure must be audited before inclusion

Question 6

Which of the following scenarios BEST illustrates an effective escalation protocol in risk monitoring?

Accepted Answer

A KRI exceeds its tolerance threshold, triggering an automatic alert to the risk owner and senior management for immediate action

Answer

Management compiles all KRI breaches into a single annual report submitted to the audit committee

Answer

Risk owners independently resolve all KRI breaches without notifying the board

Answer

The internal audit team retests all KRIs before any escalation is permitted