CRA - Certified Risk Architect Enterprise Risk Management Frameworks Questions and Answers

Question 1

A global manufacturing firm is implementing an Enterprise Risk Management (ERM) framework. The board is particularly focused on ensuring that risk management is not treated as a separate, isolated function but is deeply embedded in all significant business activities and strategic decisions. Which principle of ISO 31000:2018 directly addresses this specific concern?

Accepted Answer

Risk management is an integral part of all organizational processes.

Answer

The ISO 31000:2018 standard emphasizes that for risk management to be effective, it must be integrated into the organization's governance, strategy, planning, and operations. This principle ensures that risk considerations are part of decision-making at all levels, rather than being an afterthought or a compliance exercise.

Question 2

In the COSO ERM Framework (2017), which component is primarily concerned with an organization's ethical values, desired behaviors, board oversight, and commitment to building human capital?

Accepted Answer

Governance & Culture

Answer

The 'Governance & Culture' component of the COSO ERM Framework sets the organization's tone and establishes oversight responsibilities. It encompasses the board's role in risk oversight, the definition of the desired organizational culture, a commitment to core values, and the ability to attract, develop, and retain capable individuals.

Question 3

A financial services company is deciding between adopting the ISO 31000 standard or the COSO ERM framework. The company operates in a highly regulated industry and requires a detailed, prescriptive approach that strongly links risk management with internal controls and strategic performance. Which framework would be more suitable for this organization?

Accepted Answer

COSO ERM, because it provides a more structured and detailed model with predefined components that integrate risk with strategy and performance.

Answer

While both frameworks are robust, COSO ERM is generally considered more prescriptive and detailed, with a strong emphasis on integrating risk management with strategy, performance, and internal controls. This makes it particularly suitable for organizations in highly regulated sectors like finance that require a comprehensive and structured approach. ISO 31000 is more of a high-level, flexible guideline adaptable to any organization.

Question 4

A risk architect is reviewing their company's ERM program, which is based on the COSO framework. They notice that while risks are identified and assessed, the process for evaluating how well the ERM components are functioning over time and making necessary adjustments is weak. Which COSO ERM component needs to be strengthened?

Accepted Answer

Review & Revision

Answer

The 'Review & Revision' component of the COSO ERM framework deals with assessing the performance of the ERM capabilities over time and pursuing continual improvement. If the process for evaluating the effectiveness of the ERM components and making adjustments is weak, this is the specific component that requires attention.

Question 5

Which of the following best describes a key objective of the COSO ERM - Integrating with Strategy and Performance (2017) framework?

Accepted Answer

To link enterprise risk management with an organization's strategy-setting process and performance.

Answer

A central theme of the 2017 update to the COSO ERM framework was to more explicitly connect and integrate risk management with strategy and performance. The framework is designed to help organizations anticipate risks to their strategy and understand how risk and performance are intertwined in creating, preserving, and realizing value.

(CRA) Certified Risk Architect Practice Test

(CRA) Certified Risk Architect Practice Test

CRA - Certified Risk Architect Enterprise Risk Management Frameworks Questions and Answers