CRMA Communicating Risk Information 2 — Questions and Answers
Question 1: A risk heat map uses color coding to convey risk severity. Which combination correctly represents standard heat map conventions?
- Green=high risk, Red=low risk, Yellow=moderate risk
- Red=high risk, Yellow=moderate risk, Green=low risk (Correct answer)
- Blue=high risk, Orange=moderate risk, White=low risk
- Purple=high risk, Green=moderate risk, Red=low risk
Correct answer: Red=high risk, Yellow=moderate risk, Green=low risk
Standard risk heat maps use red for high risk, yellow/amber for moderate risk, and green for low risk to enable quick visual assessment.
Question 2: When preparing a risk dashboard for the board of directors, which metric is MOST important to highlight prominently?
- The total number of risks identified in the risk register
- Risks that have breached or are approaching risk appetite thresholds (Correct answer)
- The average cost of individual risk mitigation controls
- The number of risk assessments completed during the period
Correct answer: Risks that have breached or are approaching risk appetite thresholds
Risks breaching or approaching appetite thresholds require board attention because they signal that management action or risk acceptance decisions are needed.
Question 3: Which risk reporting format is BEST suited for communicating trend information about key risk indicators over time?
- Pie charts showing current risk distribution
- Line graphs or trend charts showing KRI movement (Correct answer)
- Static heat maps showing point-in-time risk ratings
- Bullet-point lists of top risks
Correct answer: Line graphs or trend charts showing KRI movement
Line graphs and trend charts allow stakeholders to see whether key risk indicators are improving, deteriorating, or stable over time.
Question 4: An internal auditor needs to communicate a newly identified risk to operational management. What should the communication include FIRST?
- A full list of recommended controls
- A clear description of the risk and its potential impact (Correct answer)
- The estimated cost of remediation
- Benchmarking data from peer organizations
Correct answer: A clear description of the risk and its potential impact
Effective risk communication starts with a clear description of the risk and its potential impact so recipients understand what they are being asked to address.
Question 5: Which of the following BEST describes the purpose of a risk narrative in a risk report?
- To replace quantitative data with subjective opinion
- To provide context that helps readers interpret risk ratings and data (Correct answer)
- To document the personal views of the chief risk officer
- To comply with regulatory requirements for written disclosures
Correct answer: To provide context that helps readers interpret risk ratings and data
Risk narratives provide qualitative context that helps audiences understand why risks are rated as they are and what factors drive the ratings.
Question 6: A risk report contains highly sensitive information about control weaknesses. What is the MOST appropriate approach to distribution?
- Distribute widely to maximize awareness across all staff
- Restrict distribution to those with a legitimate need to know (Correct answer)
- Post the report on the company intranet for transparency
- Share only with external auditors for independent review
Correct answer: Restrict distribution to those with a legitimate need to know
Sensitive risk information should be distributed on a need-to-know basis to prevent misuse and protect the organization from potential exploitation of disclosed weaknesses.
Question 7: When risk information is communicated upward through the organization, which phenomenon represents a significant threat to accuracy?
- Over-documentation of minor operational risks
- Information filtering where bad news is softened at each management layer (Correct answer)
- Use of technical jargon in executive summaries
- Delayed reporting due to data collection cycles
Correct answer: Information filtering where bad news is softened at each management layer
Upward communication filtering occurs when managers suppress or soften negative information, causing senior leaders to receive an inaccurate, overly optimistic picture of risk.
CRMA Communicating Risk Information 2
A risk heat map uses color coding to convey risk severity.
Which combination correctly represents standard heat map conventions?