CRMA Assessing Risk Appetite 2

Question 1

Which of the following best describes the relationship between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the broad statement of acceptable risk, while risk tolerance defines the allowable deviation around that appetite.

Answer

Risk appetite and risk tolerance are interchangeable terms with identical meanings.

Answer

Risk tolerance is set at the board level, while risk appetite is set by operational management.

Answer

Risk appetite applies only to strategic risks, while risk tolerance applies to operational risks.

Question 2

A company's risk appetite statement says it will 'accept moderate financial risk to pursue growth.' Which scenario would MOST likely exceed this appetite?

Accepted Answer

Entering an unproven emerging market with potential 80% downside and no exit strategy.

Answer

Launching a new product in an adjacent market with a 15% projected return.

Answer

Accepting a vendor contract with standard penalty clauses.

Answer

Investing in a technology upgrade with a three-year payback period.

Question 3

When a CAE is assessing whether the organization's risk appetite is effectively communicated, which evidence would be MOST persuasive?

Accepted Answer

Business unit managers can articulate how their decisions align with the appetite statement.

Answer

A risk appetite statement approved by the board three years ago.

Answer

The CFO confirmed the appetite was reviewed at the last audit committee meeting.

Answer

The risk appetite statement is posted on the company intranet.

Question 4

An organization has set a zero risk appetite for regulatory compliance violations. Internal audit discovers a minor, unintentional breach. What is the MOST appropriate internal audit response?

Accepted Answer

Report it consistent with the zero-tolerance stance, regardless of materiality or intent.

Answer

Treat it as immaterial since it was unintentional and no harm resulted.

Answer

Escalate only if the breach resulted in a regulatory fine.

Answer

Wait to see if regulators identify the breach before reporting.

Question 5

Which metric is MOST useful when quantitatively assessing whether an organization's actual risk-taking aligns with its stated risk appetite?

Accepted Answer

Key Risk Indicators (KRIs) tracked against defined thresholds.

Answer

Number of risk policies approved by the board.

Answer

The total number of risks identified in the risk register.

Answer

Number of internal audit findings closed on time.

Question 6

A board revises its risk appetite to be more conservative following a major industry loss event at a competitor. What should internal audit do FIRST?

Accepted Answer

Assess whether existing business activities and controls are still aligned with the revised appetite.

Answer

Immediately issue findings for any current activities that exceeded the old appetite.

Answer

Update the audit plan's risk ratings to reflect the competitor's loss event.

Answer

Wait until year-end to incorporate the revised appetite into the audit universe.

Question 7

In risk appetite assessment, what does the term 'residual risk appetite' refer to?

Accepted Answer

The level of risk acceptable after controls and mitigations have been applied.

Answer

The amount of risk remaining after insurance coverage is applied.

Answer

Risks that were not included in the original risk assessment.

Answer

The portion of inherent risk that management chooses to ignore.