CRMA Assessing Risk Appetite 4

Question 1

How does risk capacity differ from risk appetite in the context of CRMA assessments?

Accepted Answer

Risk capacity is the maximum risk an organization can absorb without threatening viability; risk appetite is the amount it chooses to accept.

Answer

Risk capacity defines the absolute outer limit of risk an organization can survive, while risk appetite is the strategic choice of how much risk to actually take on within that limit.

Question 2

An organization in a heavily regulated industry wants to set risk appetite for compliance risk. Which approach is MOST appropriate?

Accepted Answer

Set zero tolerance for material compliance breaches and define narrow tolerances for minor procedural deviations.

Answer

Zero tolerance for material breaches paired with defined narrow tolerances for minor deviations provides a practical and defensible compliance risk appetite framework.

Question 3

Which statement BEST describes the role of internal audit in relation to risk appetite — as opposed to the role of risk management?

Accepted Answer

Internal audit provides independent assurance that risk appetite is appropriate and adhered to; risk management owns the appetite and its implementation.

Answer

Internal audit's role is to independently assess and report on the adequacy and adherence to risk appetite, while risk management owns the process of setting and implementing it.

Question 4

Which of the following would BEST help internal audit determine whether risk appetite cascades effectively from the board to front-line employees?

Accepted Answer

Survey frontline employees on their awareness and understanding of the organization's risk limits.

Answer

Surveying frontline employees tests whether risk appetite communication has actually penetrated through all organizational layers to those making daily risk decisions.

Question 5

A retail bank's risk appetite states it accepts 'moderate credit risk.' A loan officer approves a portfolio of subprime loans representing 40% of the loan book. Internal audit should PRIMARILY evaluate whether:

Accepted Answer

The subprime concentration aligns with what the board intended by 'moderate credit risk.'

Answer

The key audit question is whether the actual risk taken — a heavy subprime concentration — is consistent with what the board defined as 'moderate' credit risk appetite.

(CRMA) Certification in Risk Management Assurance Practice Test

(CRMA) Certification in Risk Management Assurance Practice Test

CRMA Assessing Risk Appetite 4