CRMA Assessing Risk Appetite 2 — Questions and Answers
Question 1: Which of the following best describes the relationship between risk appetite and risk tolerance?
- Risk appetite and risk tolerance are interchangeable terms with identical meanings.
- Risk appetite is the broad statement of acceptable risk, while risk tolerance defines the allowable deviation around that appetite. (Correct answer)
- Risk tolerance is set at the board level, while risk appetite is set by operational management.
- Risk appetite applies only to strategic risks, while risk tolerance applies to operational risks.
Correct answer: Risk appetite is the broad statement of acceptable risk, while risk tolerance defines the allowable deviation around that appetite.
Risk appetite is the overall level of risk an organization is willing to accept, while risk tolerance specifies the acceptable variation around that appetite for specific objectives.
Question 2: A company's risk appetite statement says it will 'accept moderate financial risk to pursue growth.' Which scenario would MOST likely exceed this appetite?
- Launching a new product in an adjacent market with a 15% projected return.
- Entering an unproven emerging market with potential 80% downside and no exit strategy. (Correct answer)
- Accepting a vendor contract with standard penalty clauses.
- Investing in a technology upgrade with a three-year payback period.
Correct answer: Entering an unproven emerging market with potential 80% downside and no exit strategy.
An 80% downside with no exit strategy clearly exceeds a 'moderate' financial risk appetite, indicating misalignment between the activity and stated appetite.
Question 3: When a CAE is assessing whether the organization's risk appetite is effectively communicated, which evidence would be MOST persuasive?
- A risk appetite statement approved by the board three years ago.
- Business unit managers can articulate how their decisions align with the appetite statement. (Correct answer)
- The CFO confirmed the appetite was reviewed at the last audit committee meeting.
- The risk appetite statement is posted on the company intranet.
Correct answer: Business unit managers can articulate how their decisions align with the appetite statement.
Effective communication is demonstrated when operational managers actively apply and can explain the appetite in their decision-making, not merely that a document exists.
Question 4: An organization has set a zero risk appetite for regulatory compliance violations. Internal audit discovers a minor, unintentional breach. What is the MOST appropriate internal audit response?
- Treat it as immaterial since it was unintentional and no harm resulted.
- Report it consistent with the zero-tolerance stance, regardless of materiality or intent. (Correct answer)
- Escalate only if the breach resulted in a regulatory fine.
- Wait to see if regulators identify the breach before reporting.
Correct answer: Report it consistent with the zero-tolerance stance, regardless of materiality or intent.
A zero risk appetite means any deviation must be reported, as the organization has determined no level of violation is acceptable regardless of circumstance.
Question 5: Which metric is MOST useful when quantitatively assessing whether an organization's actual risk-taking aligns with its stated risk appetite?
- Number of risk policies approved by the board.
- Key Risk Indicators (KRIs) tracked against defined thresholds. (Correct answer)
- The total number of risks identified in the risk register.
- Number of internal audit findings closed on time.
Correct answer: Key Risk Indicators (KRIs) tracked against defined thresholds.
KRIs with defined thresholds provide measurable, ongoing signals that indicate whether actual risk levels are within the appetite boundaries.
Question 6: A board revises its risk appetite to be more conservative following a major industry loss event at a competitor. What should internal audit do FIRST?
- Immediately issue findings for any current activities that exceeded the old appetite.
- Assess whether existing business activities and controls are still aligned with the revised appetite. (Correct answer)
- Update the audit plan's risk ratings to reflect the competitor's loss event.
- Wait until year-end to incorporate the revised appetite into the audit universe.
Correct answer: Assess whether existing business activities and controls are still aligned with the revised appetite.
When risk appetite changes, internal audit should promptly evaluate whether current operations and controls remain aligned with the updated boundaries.
Question 7: In risk appetite assessment, what does the term 'residual risk appetite' refer to?
- The amount of risk remaining after insurance coverage is applied.
- The level of risk acceptable after controls and mitigations have been applied. (Correct answer)
- Risks that were not included in the original risk assessment.
- The portion of inherent risk that management chooses to ignore.
Correct answer: The level of risk acceptable after controls and mitigations have been applied.
Residual risk appetite is the amount of risk an organization is willing to retain after controls and mitigations reduce the inherent risk level.
CRMA Assessing Risk Appetite 2
Which of the following best describes the relationship between risk appetite and risk tolerance?