CRMA Communicating Risk Information 2

Question 1

A risk heat map uses color coding to convey risk severity. Which combination correctly represents standard heat map conventions?

Accepted Answer

Red=high risk, Yellow=moderate risk, Green=low risk

Answer

Green=high risk, Red=low risk, Yellow=moderate risk

Answer

Blue=high risk, Orange=moderate risk, White=low risk

Answer

Purple=high risk, Green=moderate risk, Red=low risk

Question 2

When preparing a risk dashboard for the board of directors, which metric is MOST important to highlight prominently?

Accepted Answer

Risks that have breached or are approaching risk appetite thresholds

Answer

The total number of risks identified in the risk register

Answer

The average cost of individual risk mitigation controls

Answer

The number of risk assessments completed during the period

Question 3

Which risk reporting format is BEST suited for communicating trend information about key risk indicators over time?

Accepted Answer

Line graphs or trend charts showing KRI movement

Answer

Pie charts showing current risk distribution

Answer

Static heat maps showing point-in-time risk ratings

Answer

Bullet-point lists of top risks

Question 4

An internal auditor needs to communicate a newly identified risk to operational management. What should the communication include FIRST?

Accepted Answer

A clear description of the risk and its potential impact

Answer

A full list of recommended controls

Answer

The estimated cost of remediation

Answer

Benchmarking data from peer organizations

Question 5

Which of the following BEST describes the purpose of a risk narrative in a risk report?

Accepted Answer

To provide context that helps readers interpret risk ratings and data

Answer

To replace quantitative data with subjective opinion

Answer

To document the personal views of the chief risk officer

Answer

To comply with regulatory requirements for written disclosures

Question 6

A risk report contains highly sensitive information about control weaknesses. What is the MOST appropriate approach to distribution?

Accepted Answer

Restrict distribution to those with a legitimate need to know

Answer

Distribute widely to maximize awareness across all staff

Answer

Post the report on the company intranet for transparency

Answer

Share only with external auditors for independent review

Question 7

When risk information is communicated upward through the organization, which phenomenon represents a significant threat to accuracy?

Accepted Answer

Information filtering where bad news is softened at each management layer

Answer

Over-documentation of minor operational risks

Answer

Use of technical jargon in executive summaries

Answer

Delayed reporting due to data collection cycles