CRMA Evaluating Risk Culture 3 — Questions and Answers
Question 1: Which cultural attribute, when present, is MOST predictive of effective risk escalation in an organization?
- Psychological safety to speak up without fear of retaliation (Correct answer)
- A formalized escalation policy in the employee handbook
- Mandatory ethics training completed annually
- Presence of a dedicated chief risk officer
Correct answer: Psychological safety to speak up without fear of retaliation
Psychological safety—the belief that one can raise concerns without punishment—is the primary behavioral enabler of timely risk escalation.
Question 2: The 'three lines of defense' model supports risk culture evaluation primarily because it:
- Clarifies accountability boundaries, reducing ambiguity about who owns risk oversight (Correct answer)
- Eliminates all residual risk within an organization
- Guarantees that no control failures will occur
- Replaces the need for a risk appetite statement
Correct answer: Clarifies accountability boundaries, reducing ambiguity about who owns risk oversight
Clear accountability boundaries created by the three-lines model reduce confusion and establish the cultural expectation that every line owns its risk responsibilities.
Question 3: An internal auditor reviewing risk culture should be MOST concerned by which finding?
- Employees report that raising risk concerns has resulted in career penalties in the past (Correct answer)
- The risk register is updated quarterly rather than monthly
- Risk training completion rates are at 85% rather than 100%
- Some departments use different risk scoring templates
Correct answer: Employees report that raising risk concerns has resulted in career penalties in the past
Career penalties for raising risk concerns directly suppress the reporting behavior that a healthy risk culture depends on, making it the most critical cultural deficiency.
Question 4: Middle management plays a unique role in risk culture because they:
- Translate executive risk directives into daily team behaviors and norms (Correct answer)
- Set the organization's formal risk appetite
- Conduct independent assurance over the first line
- Approve risk policy exceptions at the board level
Correct answer: Translate executive risk directives into daily team behaviors and norms
Middle managers are the critical translation layer who operationalize tone at the top into the actual behaviors employees experience day-to-day.
Question 5: Which scenario BEST demonstrates 'tone in the middle' as a risk culture concern?
- A branch manager dismisses staff concerns about control weaknesses as 'not worth escalating' (Correct answer)
- The board approves an overly aggressive risk appetite
- The chief audit executive fails to report to the audit committee
- A risk officer bypasses the CFO in reporting to the board
Correct answer: A branch manager dismisses staff concerns about control weaknesses as 'not worth escalating'
Tone in the middle refers to management behavior that either reinforces or undermines executive risk messaging; a manager suppressing escalations is a direct example.
Question 6: A company's risk culture assessment reveals high awareness of risk policies but low perceived personal accountability. The MOST likely root cause is:
- Consequences for risk ownership are unclear or inconsistently applied (Correct answer)
- Employees have not been given access to the risk policy documents
- The risk function is understaffed
- Risk appetite tolerances are set too conservatively
Correct answer: Consequences for risk ownership are unclear or inconsistently applied
When employees know the rules but don't feel personally accountable, the gap typically traces to unclear or inconsistently enforced consequences for risk behavior.
Question 7: Which approach is MOST effective for embedding risk-aware behavior into everyday employee decisions?
- Integrating risk considerations into existing performance management and recognition processes (Correct answer)
- Publishing a quarterly risk culture report to all employees
- Hiring more risk management professionals
- Increasing the frequency of mandatory compliance training
Correct answer: Integrating risk considerations into existing performance management and recognition processes
Embedding risk into how employees are evaluated and rewarded makes risk awareness a natural part of daily decision-making rather than a separate compliance activity.
CRMA Evaluating Risk Culture 3
Which cultural attribute, when present, is MOST predictive of effective risk escalation in an organization?