CRMA Risk Response and Treatment 2

Question 1

What is the key distinction between inherent risk and residual risk?

Accepted Answer

Inherent risk exists before controls; residual risk exists after controls are applied

Answer

Inherent risk is quantifiable; residual risk cannot be measured

Answer

Inherent risk relates to internal factors; residual risk relates to external factors

Answer

Inherent risk is strategic; residual risk is operational

Question 2

Insurance is primarily an example of which risk response strategy?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk reduction

Answer

Risk acceptance

Question 3

In the context of CRMA, what is a 'control' in risk response?

Accepted Answer

Any action, policy, or procedure that reduces the likelihood or impact of a risk

Answer

A policy that prevents employees from taking risks

Answer

A financial reserve set aside to cover potential losses

Answer

A regulatory requirement imposed by external authorities

Question 4

Which risk response approach is MOST appropriate for a low-likelihood, low-impact risk?

Accepted Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk reduction through multiple controls

Question 5

What is the primary role of internal audit in evaluating an organization's risk responses?

Accepted Answer

Providing independent assurance that risk responses are effective and aligned with risk appetite

Answer

Designing and implementing the risk responses on behalf of management

Answer

Approving management's risk response strategies before implementation

Answer

Eliminating residual risk through audit recommendations

Question 6

Risk response plans should include which of the following elements?

Accepted Answer

Assigned ownership, timeline, specific actions, and metrics to measure effectiveness

Answer

Only the risk rating and the strategy chosen (avoid/reduce/transfer/accept)

Answer

A list of all risks identified in the most recent risk assessment

Answer

The external auditor's review and sign-off on each planned action

Question 7

An organization decides to outsource its IT infrastructure management to reduce cybersecurity risk exposure. This is an example of:

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk reduction