CRO Cheat Sheet 2026

The 30 highest-yield CRO facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does 'inherent risk' represent in the context of third-party risk assessment? → The risk level before considering any controls or mitigating factors
2. The Volcker Rule under Dodd-Frank primarily restricts which activity for banking entities? → Proprietary trading and certain hedge fund/PE fund sponsorship
3. What is credit risk? → Risk of borrower default
4. Which regulation requires U.S. public companies to maintain adequate internal controls over financial reporting and have management assess them annually? → Sarbanes-Oxley Act Section 404
5. Under Sarbanes-Oxley (SOX) Section 404, the Chief Risk Officer's role most directly relates to: → Supporting management's assessment of internal controls over financial reporting
6. What does 'nth-party risk' refer to in third-party risk management? → Risk arising from a vendor's own subcontractors and their supply chain
7. Which metric BEST measures the effectiveness of a third-party risk program over time? → Percentage of vendors with completed risk assessments within the review cycle
8. How can organizations evaluate their crisis readiness? → Conduct regular drills and scenario-based testing
9. Which liquidity risk metric measures the number of days a firm can meet its cash obligations using only its liquid asset buffer without accessing new funding? → Survival horizon
10. Which credit risk model distinguishes between default risk and migration risk, treating rating transitions as a Markov chain? → CreditMetrics
11. Which of the following BEST describes 'contingent liquidity risk'? → Liquidity risk arising from contractually committed but undrawn credit lines
12. A CRO notices that risk reports consistently arrive two days after the reporting period closes. What is the primary risk this latency creates? → Stale data leading to delayed risk decisions
13. Which quantitative measure is most commonly used to set risk appetite thresholds for market and credit risk in financial institutions? → Value at Risk (VaR) or Expected Shortfall (ES)
14. Under the Bank Secrecy Act, a Suspicious Activity Report (SAR) must generally be filed within how many days of detecting a suspicious transaction? → 30 calendar days
15. Which principle of the ISO 31000 risk management standard emphasizes that risk management must be customized to the organization's context? → Tailored
16. A firm's operational risk dashboard shows a spike in 'near-miss' events. How should a CRO interpret this trend? → The reporting culture is improving, but underlying risk exposure may be rising
17. A CRO discovers a critical vendor has been acquired by a competitor. What is the FIRST risk management action to take? → Re-evaluate the vendor's risk profile and assess concentration risk
18. The 'insurable interest' doctrine in U.S. insurance law requires that: → The insured must stand to suffer a genuine financial loss if the covered event occurs
19. A vendor's SOC 2 Type II report has a qualified opinion. What does this mean for the risk assessment? → One or more controls did not operate effectively during the audit period
20. What role does board governance play in operational resilience planning? → Setting and approving impact tolerances and overseeing testing outcomes
21. What is the primary purpose of a credit valuation adjustment (CVA)? → To account for the risk that a counterparty will default on an OTC derivative
22. Which of the following is the most critical factor a CRO must evaluate when assessing the financial strength of a commercial insurer? → AM Best or S&P financial strength rating and surplus adequacy
23. Which behavior BEST demonstrates that middle management has internalized strong risk culture? → Proactively identifying and escalating risks before they become incidents
24. The concept of 'strategic risk tolerance' differs from 'risk appetite' primarily in that tolerance refers to: → The acceptable variance around risk appetite targets before corrective action is triggered
25. In the context of market risk, 'gap risk' in a stop-loss hedged position refers to: → The risk that prices jump discontinuously, bypassing the stop-loss trigger
26. The concept of 'tone at the top' in risk management means: → Senior executives publicly model and reinforce desired risk behaviors and values
27. Which metric is MOST useful for assessing the effectiveness of risk culture communication initiatives? → Change in the rate of voluntary risk event reporting over time
28. A CRO is onboarding a newly acquired subsidiary with a weak risk culture. The recommended FIRST step is to: → Conduct a risk culture diagnostic assessment to identify specific gaps and starting points
29. Which regulatory framework explicitly requires 'risk data aggregation capabilities' and governance over risk reporting for systemically important banks? → BCBS 239
30. Under the IRB approach to credit risk, the correlation parameter (R) in the Basel formula for corporate exposures is inversely related to PD because: → High-PD borrowers tend to be smaller firms driven more by idiosyncratic factors