CRMA Assessing Risk Appetite 3

Question 1

Which governance body bears ultimate responsibility for approving the organization's risk appetite?

Accepted Answer

The Board of Directors.

Answer

The Chief Risk Officer (CRO).

Answer

The Chief Audit Executive (CAE).

Answer

The external auditor.

Question 2

An internal auditor is reviewing a manufacturing company's risk appetite for workplace safety. Which finding would indicate the stated appetite is NOT effectively operationalized?

Accepted Answer

Incident rates are tracked monthly but never compared to appetite thresholds.

Answer

The safety risk appetite statement was approved by the CEO.

Answer

A safety officer reports to the VP of Operations.

Answer

Safety training is conducted annually for all employees.

Question 3

A financial institution states it has a 'low appetite for liquidity risk.' Which control environment would be MOST consistent with this appetite?

Accepted Answer

Daily liquidity coverage ratio monitoring with automatic escalation triggers.

Answer

Monthly liquidity stress tests with results shared quarterly with the board.

Answer

Annual review of liquid asset buffers by the CFO.

Answer

Liquidity risk managed at the discretion of individual business unit treasurers.

Question 4

When should an organization's risk appetite statement be formally reviewed?

Accepted Answer

At least annually and whenever there is a material change in strategy, environment, or key risks.

Answer

Only when a significant risk event occurs within the organization.

Answer

Every five years as part of the strategic planning cycle.

Answer

Whenever internal audit recommends a change.

Question 5

Which of the following BEST illustrates a qualitative risk appetite statement?

Accepted Answer

We will not pursue business opportunities that conflict with our ethical values.

Answer

We will not accept losses exceeding $5 million in any single quarter.

Answer

We maintain a maximum debt-to-equity ratio of 2:1.

Answer

We target a minimum credit rating of BBB from all rating agencies.

Question 6

A CAE wants to assess whether risk appetite is embedded in strategic decision-making. Which audit procedure is MOST direct?

Accepted Answer

Review minutes and documentation from major investment decisions to confirm risk appetite was explicitly considered.

Answer

Review the board's approved risk appetite statement for completeness.

Answer

Interview the board about their general risk philosophy.

Answer

Confirm that the risk function has an approved budget.

Question 7

Which scenario represents a 'risk appetite gap'?

Accepted Answer

Management takes significantly more risk than the board-approved appetite allows.

Answer

The board sets a moderate appetite, and business units take moderate risks.

Answer

The risk appetite statement is written at a high level of abstraction.

Answer

Two business units have slightly different interpretations of 'moderate' risk.