CRMA Assessing Risk Appetite 5

Question 1

Which of the following BEST describes a 'risk appetite framework'?

Accepted Answer

The integrated structure of statements, metrics, limits, escalation protocols, and governance processes used to define and manage risk appetite.

Answer

A single-page document listing all risks the company will not accept.

Answer

The board's annual letter to shareholders describing the company's risk posture.

Answer

A spreadsheet of risk scores maintained by the risk management department.

Question 2

When assessing risk appetite for a new business venture, management should FIRST:

Accepted Answer

Determine whether the venture's risk profile falls within the board-approved risk appetite.

Answer

Conduct a detailed financial modeling exercise.

Answer

Hire external consultants to assess the market risk.

Answer

Seek regulatory pre-approval before evaluating risk appetite fit.

Question 3

Which of the following is a limitation of expressing risk appetite solely in qualitative terms?

Accepted Answer

They cannot be easily translated into actionable thresholds, making consistent application difficult.

Answer

Qualitative statements are too technical for board members to understand.

Answer

Qualitative statements cannot be applied to strategic risks.

Answer

They are not accepted by external regulators or rating agencies.

Question 4

An internal auditor notices that a business unit consistently operates at the upper boundary of its approved risk tolerance. What is the MOST important concern to raise?

Accepted Answer

Consistently operating near the boundary suggests the unit may breach tolerance during adverse conditions, warranting proactive management attention.

Answer

The business unit is technically within limits, so no action is needed.

Answer

The tolerance level should be raised to match the unit's actual behavior.

Answer

The risk appetite statement needs to be rewritten to be less restrictive.

Question 5

In the context of ERM and CRMA, which statement about risk appetite and organizational culture is MOST accurate?

Accepted Answer

Organizational culture can cause actual risk-taking to diverge from the formally stated appetite, making culture a key audit consideration.

Answer

A strong risk appetite statement automatically creates a risk-aware culture.

Answer

Culture is separate from risk management and should not be assessed by internal audit.

Answer

If the CEO supports the risk appetite statement, culture is aligned by definition.

Question 6

Which of the following MOST accurately describes the relationship between risk appetite and the strategic planning process?

Accepted Answer

Risk appetite should be established before or alongside strategic planning to ensure strategic objectives are set within acceptable risk boundaries.

Answer

Risk appetite is determined after the strategic plan is finalized.

Answer

Risk appetite is irrelevant to strategic planning since strategy focuses on opportunities.

Answer

Strategic plans automatically define risk appetite through their financial projections.

Question 7

When risk appetite is set too low relative to the industry, which unintended consequence is MOST likely?

Accepted Answer

The organization may forgo value-creating opportunities, resulting in competitive disadvantage.

Answer

The organization takes on excessive risk without board awareness.

Answer

Regulatory bodies will require the organization to increase its risk-taking.

Answer

Internal audit will have fewer findings to report.