CRMA Risk Response and Treatment 3

Question 1

When the cost of treating a risk exceeds the potential impact of the risk event itself, the organization should:

Accepted Answer

Accept the risk and document the rationale with management approval

Answer

Always implement the treatment regardless of cost as a matter of due diligence

Answer

Escalate the risk to the board for mandatory mitigation

Answer

Require external auditors to determine the appropriate response

Question 2

A 'secondary risk' in the context of risk response refers to:

Accepted Answer

A new risk introduced as a direct result of implementing a risk response

Answer

A risk that is less severe than the primary risk

Answer

The residual risk remaining after primary controls are applied

Answer

A risk that has been transferred to a third party

Question 3

How does risk tolerance relate to the selection of a risk response strategy?

Accepted Answer

Risk tolerance defines the maximum acceptable level of residual risk, guiding which response strategy is sufficient

Answer

Risk tolerance determines the financial budget available for risk treatment activities

Answer

Risk tolerance is set by external regulators and overrides management's response preferences

Answer

Risk tolerance applies only to strategic risks, not operational or compliance risks

Question 4

The concept of 'risk aggregation' in response planning is BEST described as:

Accepted Answer

Assessing how multiple individual risks combine to affect overall organizational risk exposure

Answer

Combining individual risk responses into a single control framework

Answer

Averaging the impact scores of all identified risks to determine a response priority

Answer

Grouping risks by category so one response can address all risks in the group

Question 5

How should the emergence of new or rapidly evolving risks influence an organization's risk response strategies?

Accepted Answer

Risk responses should be dynamically reassessed and updated to address new exposures

Answer

Existing responses should remain unchanged to maintain control consistency

Answer

Emerging risks require immediate risk avoidance as the default response

Answer

Only the board, not management, should update responses to emerging risks

Question 6

Which of the following BEST describes a 'portfolio view' of risk responses?

Accepted Answer

Evaluating risk responses across the entire organization to understand their combined effect on risk exposure

Answer

Treating each risk in complete isolation with its own dedicated response

Answer

Transferring all organizational risks to a single third-party risk management firm

Answer

Prioritizing only the top five risks for response while ignoring others

Question 7

According to CRMA principles, who holds primary responsibility for selecting and implementing risk responses?

Accepted Answer

Management

Answer

The Chief Audit Executive (CAE)

Answer

The board of directors

Answer

The external auditor