CRMA Knowledge 3 — Questions and Answers
Question 1: Key Risk Indicators (KRIs) are best described as:
- Metrics that measure losses after a risk event has occurred.
- Forward-looking metrics that signal increasing risk exposure before losses materialize. (Correct answer)
- Financial ratios used exclusively by the CFO to monitor liquidity risk.
- Audit findings documented in the internal audit report.
Correct answer: Forward-looking metrics that signal increasing risk exposure before losses materialize.
KRIs are leading indicators designed to provide early warning of rising risk levels, enabling proactive management before a risk event causes harm.
Question 2: A risk heat map primarily serves to:
- Calculate the exact monetary value of each identified risk.
- Visually prioritize risks by plotting likelihood against impact. (Correct answer)
- Document control deficiencies found during an audit.
- Assign risk ownership to specific members of management.
Correct answer: Visually prioritize risks by plotting likelihood against impact.
A heat map is a two-dimensional visualization that positions risks on axes of likelihood and impact, enabling stakeholders to quickly identify the most critical risks.
Question 3: Which risk assessment technique involves constructing narratives about how future conditions could unfold to stress-test the organization's strategy?
- Delphi technique
- Scenario analysis (Correct answer)
- Control self-assessment
- Risk register review
Correct answer: Scenario analysis
Scenario analysis explores plausible future states — including adverse ones — to evaluate how well current strategies and controls would hold up under different conditions.
Question 4: Monte Carlo simulation is used in risk management primarily to:
- Rank risks on a heat map based on management judgment.
- Model the probability distribution of outcomes by running thousands of random iterations. (Correct answer)
- Assess the adequacy of internal controls through structured interviews.
- Determine the organization's risk appetite statement.
Correct answer: Model the probability distribution of outcomes by running thousands of random iterations.
Monte Carlo simulation repeatedly samples from input distributions to generate a probability distribution of possible outcomes, quantifying uncertainty in complex risk scenarios.
Question 5: A bow-tie analysis in risk management visually connects:
- Risk appetite to residual risk exposure.
- Causes of a risk event on the left to consequences on the right, with controls at the center. (Correct answer)
- Strategic objectives to operational KPIs.
- The three lines of defense to specific risk categories.
Correct answer: Causes of a risk event on the left to consequences on the right, with controls at the center.
A bow-tie diagram places the risk event at the center, shows threat causes on the left with preventive controls, and consequences on the right with recovery controls.
Question 6: Which element is NOT typically included in a risk register entry?
- Risk owner
- Likelihood and impact ratings
- Audit committee minutes (Correct answer)
- Mitigating controls and residual risk rating
Correct answer: Audit committee minutes
A risk register captures risk description, owner, inherent rating, controls, residual rating, and response plans — governance meeting minutes are a separate artifact.
Question 7: Control Self-Assessment (CSA) is most accurately characterized as:
- An external audit procedure for evaluating compliance with regulations.
- A process where management and staff collaboratively evaluate the effectiveness of controls over risks. (Correct answer)
- A technique used exclusively by internal audit to test financial controls.
- A board-level review of the organization's risk appetite.
Correct answer: A process where management and staff collaboratively evaluate the effectiveness of controls over risks.
CSA engages operational management and staff in workshops or surveys to assess whether controls adequately address identified risks, embedding risk ownership in the first line.
CRMA Knowledge 3
Key Risk Indicators (KRIs) are best described as: