CRO Cheat Sheet 2026

The 30 highest-yield CRO facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is credit risk? → Risk of borrower default
2. How can organizations evaluate their crisis readiness? → Conduct regular drills and scenario-based testing
3. Which liquidity risk metric measures the number of days a firm can meet its cash obligations using only its liquid asset buffer without accessing new funding? → Survival horizon
4. The 'insurable interest' doctrine in U.S. insurance law requires that: → The insured must stand to suffer a genuine financial loss if the covered event occurs
5. Which of the following is the most critical factor a CRO must evaluate when assessing the financial strength of a commercial insurer? → AM Best or S&P financial strength rating and surplus adequacy
6. Which behavior BEST demonstrates that middle management has internalized strong risk culture? → Proactively identifying and escalating risks before they become incidents
7. The concept of 'strategic risk tolerance' differs from 'risk appetite' primarily in that tolerance refers to: → The acceptable variance around risk appetite targets before corrective action is triggered
8. The concept of 'tone at the top' in risk management means: → Senior executives publicly model and reinforce desired risk behaviors and values
9. Which metric is MOST useful for assessing the effectiveness of risk culture communication initiatives? → Change in the rate of voluntary risk event reporting over time
10. A CRO is onboarding a newly acquired subsidiary with a weak risk culture. The recommended FIRST step is to: → Conduct a risk culture diagnostic assessment to identify specific gaps and starting points
11. What is the key difference between 'expected loss' (EL) and 'unexpected loss' (UL) in credit risk management? → EL is absorbed by loan pricing and reserves; UL requires economic capital as a buffer
12. A CRO wants to quantify the risk that two risks materialize simultaneously. Which technique is MOST appropriate? → Copula models to capture joint probability distributions and tail dependence
13. A correlation coefficient of +1.0 between two asset classes in a risk model implies: → The assets always move perfectly together in the same direction
14. In the context of CRO certification, what is the most important consideration when implementing third-party risk assessment? → Ensuring alignment with established standards, stakeholder needs, and best practices
15. A Chief Risk Officer seeking to strengthen risk culture should FIRST focus on: → Securing executive sponsorship and board-level commitment to risk culture
16. In the three lines of defense model, where does the Chief Risk Officer's function primarily reside? → Second line — risk oversight and policy setting
17. In strategic risk planning, what does 'risk appetite articulation' primarily help an organization accomplish? → Define the boundaries within which management may pursue strategic objectives
18. When structuring a risk transfer for cyber risk, which policy provision most directly addresses ransomware extortion payments? → Cyber extortion coverage (threat response)
19. A company's crisis management team is conducting a post-incident review after a supply chain disruption. What is the PRIMARY purpose of this review? → Identify lessons learned to improve future crisis response plans
20. Which of the following is a type of financial risk? → Market risk
21. Which tool is commonly used for assessing financial risk? → Value-at-Risk (VaR)
22. Which component of a crisis management framework specifically addresses how the organization will restore trust and reputation after a major crisis event? → Crisis Communication and Reputational Recovery Plan
23. A CRO is conducting a strategic risk workshop with the executive team. To avoid groupthink, which technique is most effective? → Assigning a designated devil's advocate or using pre-mortem analysis
24. Which of the following best describes 'risk tolerance'? → The acceptable deviation from risk appetite
25. A captive insurer owned by a single parent company is best described as a: → Pure captive
26. Which metric is used to evaluate a firm’s liquidity risk? → Current ratio
27. In a risk-aware culture, how should employees be encouraged to view risk? → As part of normal business activity requiring informed, balanced management
28. Which type of risk most directly threatens the validity of an organization's long-term strategic plan? → Strategic risk
29. What financial instruments can be used to hedge market risks? → Futures and options
30. When a quantitative risk model consistently underestimates losses during periods of market stress, this is MOST likely caused by: → Assuming linear correlations that break down during crises due to contagion effects