CRMA Assessing Risk Appetite 4

Question 1

How does risk capacity differ from risk appetite in the context of CRMA assessments?

Accepted Answer

Risk capacity is the maximum risk an organization can absorb without threatening viability; risk appetite is the amount it chooses to accept.

Answer

Risk capacity is subjective, while risk appetite is objectively measurable.

Answer

Risk capacity refers to operational risks only, while risk appetite covers all risk categories.

Answer

Risk capacity is set by regulators, while risk appetite is set by management.

Question 2

An organization in a heavily regulated industry wants to set risk appetite for compliance risk. Which approach is MOST appropriate?

Accepted Answer

Set zero tolerance for material compliance breaches and define narrow tolerances for minor procedural deviations.

Answer

Set compliance risk appetite equal to the industry average for violations.

Answer

Allow business units to set their own compliance risk appetite independently.

Answer

Avoid quantifying compliance risk appetite since regulatory requirements already define limits.

Question 3

Which statement BEST describes the role of internal audit in relation to risk appetite — as opposed to the role of risk management?

Accepted Answer

Internal audit provides independent assurance that risk appetite is appropriate and adhered to; risk management owns the appetite and its implementation.

Answer

Internal audit sets the risk appetite; risk management enforces it.

Answer

Internal audit and risk management jointly own and set the risk appetite.

Answer

Internal audit recommends risk appetite levels to the board without input from risk management.

Question 4

Which of the following would BEST help internal audit determine whether risk appetite cascades effectively from the board to front-line employees?

Accepted Answer

Survey frontline employees on their awareness and understanding of the organization's risk limits.

Answer

Confirm the board has signed the risk appetite statement.

Answer

Review whether risk appetite is mentioned in the annual report.

Answer

Check that the CRO has communicated risk appetite to all direct reports.

Question 5

A retail bank's risk appetite states it accepts 'moderate credit risk.' A loan officer approves a portfolio of subprime loans representing 40% of the loan book. Internal audit should PRIMARILY evaluate whether:

Accepted Answer

The subprime concentration aligns with what the board intended by 'moderate credit risk.'

Answer

The loan officer had the proper authority to approve each loan.

Answer

The loans were documented in accordance with underwriting policy.

Answer

The subprime borrowers were notified of their loan terms.

Question 6

An organization uses a 'heat map' to display risks. How does risk appetite BEST integrate with a heat map?

Accepted Answer

The heat map is color-coded with zones showing which risk levels fall within, at the boundary of, or exceed risk appetite.

Answer

Risk appetite is plotted as a single point on the heat map.

Answer

Risks outside the heat map automatically violate risk appetite.

Answer

Heat maps are not appropriate tools for displaying risk appetite.

Question 7

Which condition would MOST suggest that an organization's risk appetite is aspirational rather than operational?

Accepted Answer

The risk appetite statement exists but there are no KRIs, limits, or escalation procedures linked to it.

Answer

The risk appetite statement uses both qualitative and quantitative language.

Answer

Risk appetite thresholds are referenced in performance scorecards and compensation metrics.

Answer

The board reviews and approves the risk appetite statement annually.