CRMA Assessing Risk Appetite 3 — Questions and Answers
Question 1: Which governance body bears ultimate responsibility for approving the organization's risk appetite?
- The Chief Risk Officer (CRO).
- The Board of Directors. (Correct answer)
- The Chief Audit Executive (CAE).
- The external auditor.
Correct answer: The Board of Directors.
The board of directors holds ultimate accountability for governance and therefore is responsible for approving the organization's risk appetite.
Question 2: An internal auditor is reviewing a manufacturing company's risk appetite for workplace safety. Which finding would indicate the stated appetite is NOT effectively operationalized?
- The safety risk appetite statement was approved by the CEO.
- Incident rates are tracked monthly but never compared to appetite thresholds. (Correct answer)
- A safety officer reports to the VP of Operations.
- Safety training is conducted annually for all employees.
Correct answer: Incident rates are tracked monthly but never compared to appetite thresholds.
Tracking incident rates without comparing them to appetite thresholds means data exists but is not being used to manage risk within stated boundaries.
Question 3: A financial institution states it has a 'low appetite for liquidity risk.' Which control environment would be MOST consistent with this appetite?
- Monthly liquidity stress tests with results shared quarterly with the board.
- Daily liquidity coverage ratio monitoring with automatic escalation triggers. (Correct answer)
- Annual review of liquid asset buffers by the CFO.
- Liquidity risk managed at the discretion of individual business unit treasurers.
Correct answer: Daily liquidity coverage ratio monitoring with automatic escalation triggers.
Daily monitoring with automatic escalation reflects the high vigilance and tight controls consistent with a low appetite for liquidity risk.
Question 4: When should an organization's risk appetite statement be formally reviewed?
- Only when a significant risk event occurs within the organization.
- At least annually and whenever there is a material change in strategy, environment, or key risks. (Correct answer)
- Every five years as part of the strategic planning cycle.
- Whenever internal audit recommends a change.
Correct answer: At least annually and whenever there is a material change in strategy, environment, or key risks.
Risk appetite should be reviewed at least annually and triggered by material changes in strategy or risk environment to remain relevant and aligned.
Question 5: Which of the following BEST illustrates a qualitative risk appetite statement?
- We will not accept losses exceeding $5 million in any single quarter.
- We maintain a maximum debt-to-equity ratio of 2:1.
- We will not pursue business opportunities that conflict with our ethical values. (Correct answer)
- We target a minimum credit rating of BBB from all rating agencies.
Correct answer: We will not pursue business opportunities that conflict with our ethical values.
Qualitative statements describe risk appetite in non-numeric, principle-based terms, such as ethical standards, rather than specific measurable thresholds.
Question 6: A CAE wants to assess whether risk appetite is embedded in strategic decision-making. Which audit procedure is MOST direct?
- Review the board's approved risk appetite statement for completeness.
- Interview the board about their general risk philosophy.
- Review minutes and documentation from major investment decisions to confirm risk appetite was explicitly considered. (Correct answer)
- Confirm that the risk function has an approved budget.
Correct answer: Review minutes and documentation from major investment decisions to confirm risk appetite was explicitly considered.
Reviewing decision documentation for explicit risk appetite references directly tests whether appetite influences actual strategic choices rather than existing only on paper.
Question 7: Which scenario represents a 'risk appetite gap'?
- The board sets a moderate appetite, and business units take moderate risks.
- Management takes significantly more risk than the board-approved appetite allows. (Correct answer)
- The risk appetite statement is written at a high level of abstraction.
- Two business units have slightly different interpretations of 'moderate' risk.
Correct answer: Management takes significantly more risk than the board-approved appetite allows.
A risk appetite gap occurs when actual risk-taking behavior materially exceeds or falls short of the board-approved risk appetite.
CRMA Assessing Risk Appetite 3
Which governance body bears ultimate responsibility for approving the organization's risk appetite?