IIA CRMA Certification in Risk Management Assurance

Under the 2024 Global Internal Audit Standards, who has primary accountability for ensuring an organization has an effective risk management framework?

• AThe chief audit executive (CAE)
• BThe board of directors (or equivalent governing body)
• CThe chief risk officer
• DSenior operating management

The IIA's Three Lines Model (2020) replaced the Three Lines of Defense. Which statement best describes a key change introduced by the new model?

• AIt eliminates the second line and merges its activities into internal audit
• BIt emphasizes collaboration and value creation rather than rigid 'defense' against threats
• CIt places internal audit in the first line for operational efficiency
• DIt removes the governing body from the model entirely

How many components are in the COSO ERM 2017 'Enterprise Risk Management — Integrating with Strategy and Performance' framework?

• A5 components and 17 principles
• B5 components and 20 principles
• C8 components and 90 principles
• D4 components and 12 principles

ISO 31000:2018 defines risk as the:

• AProbability of a negative event occurring
• BEffect of uncertainty on objectives
• CLoss expected from operational failures
• DDifference between expected and actual outcomes

An audit committee is reviewing the company's risk appetite statement. Which characteristic is MOST important for the statement to be useful in governance?

• AIt is approved annually by external auditors
• BIt is expressed exclusively in quantitative dollar limits
• CIt is approved by the board and aligned with strategy and objectives
• DIt is identical to the risk appetite of industry peers

Which of the following BEST illustrates the 'tone at the top' driving risk culture?

• APosting the code of conduct on the corporate intranet
• BSenior leaders publicly correcting their own behavior when it violates risk policies
• CMandating annual ethics training for all employees
• DIncluding a risk management section in the annual report

Per the IIA Three Lines Model, which group is responsible for designing and overseeing the risk management framework, including policies and risk monitoring?

• AFirst line — operational management
• BSecond line — risk management, compliance, and similar functions
• CThird line — internal audit
• DExternal audit

An organization's board has set a risk tolerance of 'no more than $5M aggregate operational loss per quarter.' This is BEST described as:

• ARisk appetite
• BRisk tolerance (a quantitative limit operationalizing appetite)
• CRisk capacity
• DRisk velocity

A CAE is asked by the CFO to take direct responsibility for managing a newly identified compliance risk because 'audit knows it best.' What is the MOST appropriate response under the 2024 Global Internal Audit Standards?

• AAccept the role to support management
• BDecline the management role and document the impairment to objectivity if it had been acc…
• CAccept on a temporary basis with disclosure
• DEscalate to the external auditor for guidance

Which COSO ERM 2017 component most directly addresses how an entity identifies, assesses, and prioritizes risks that could affect achievement of strategy?

• AGovernance and Culture
• BStrategy and Objective-Setting
• CPerformance
• DReview and Revision

The 2024 Global Internal Audit Standards are organized into how many Domains and Principles?

• A4 Domains and 12 Principles
• B5 Domains and 15 Principles
• C6 Domains and 18 Principles
• D5 Domains and 20 Principles

Which of the following is an example of a risk that primarily affects achievement of STRATEGIC objectives (versus operational, reporting, or compliance objectives)?

• AA new entrant disrupts the market with a fundamentally different business model
• BA warehouse error leads to mis-shipment of inventory
• CA misclassification of expense in the general ledger
• DFailure to file a required tax return on time

Per the 2024 Global Internal Audit Standards, which of the following is a required communication FROM the CAE to the board (or equivalent)?

• ADetailed working papers for every engagement
• BPeriodic confirmation of organizational independence and any impairments
• CApproval of all engagement budgets in advance
• DExternal auditor management letters

An organization adopts ISO 31000:2018. Which of the following is one of the eight ISO 31000 risk management PRINCIPLES?

• AContinual improvement
• BThree lines of defense
• CMaximum profitability
• DEliminate all risks

The board's risk oversight responsibility is BEST satisfied when the board:

• AReceives only positive reports about risk management
• BApproves the risk management framework and challenges management on emerging and signific…
• CDelegates all risk decisions to management without review
• DRequires audit committee approval of every operational decision

An emerging risk differs from a known operational risk PRIMARILY in that it:

• AHas a lower probability of occurrence
• BHas limited historical loss data and high uncertainty in its drivers and impact
• CCannot be assessed with any methodology
• DAffects only IT systems

Which framework is MOST commonly used to design and assess INTERNAL CONTROL OVER FINANCIAL REPORTING (ICFR), particularly for SOX Section 404 compliance?

• AISO 31000:2018
• BCOSO Internal Control — Integrated Framework (2013)
• CNIST CSF 2.0
• DCOBIT 2019

A CAE notes that the CRO reports to the CFO and that the CFO is also the executive sponsor of the largest risk transformation project. Which independence concern is MOST relevant?

• AIndependence concerns apply only to internal audit, not the CRO
• BThe reporting line creates a potential conflict for the second line and may undermine obj…
• CThe CFO must always be the executive sponsor of risk transformation
• DThe arrangement guarantees independence of risk management

Which is the BEST source of the organization's stated risk appetite for use in audit planning?

• AThe CAE's professional judgment
• BThe board-approved risk appetite statement and supporting policies
• CExternal auditor's prior year letter
• DIndustry benchmarks

A board asks internal audit to opine on the effectiveness of the ENTIRE risk management framework. Per the 2024 Global Internal Audit Standards, the CAE should:

• ADecline because internal audit cannot opine on management's framework
• BAccept and base the opinion on a planned program of risk-based assurance work
• CAccept and rely solely on management's self-assessment
• DRefer the request to the external auditor

Which statement BEST distinguishes governance from management in the 2024 Global Internal Audit Standards' view?

• AGovernance and management are interchangeable terms
• BGovernance sets direction and oversees; management plans, executes, and controls within t…
• CGovernance executes day-to-day operations; management sets long-term strategy
• DOnly governance has fiduciary responsibility; management has none

A new risk culture survey reveals that employees fear reprisal when reporting near-misses. Which of the following is the MOST appropriate FIRST step for the audit committee?

• ADirect internal audit to discipline the managers involved
• BEngage management to investigate root causes and review whistleblower / speak-up program…
• CIgnore the survey because it is anecdotal
• DReplace the CAE

Which of the following BEST describes the relationship between strategy and risk under COSO ERM 2017?

• ARisk management is performed AFTER strategy is finalized
• BRisk management is integrated with strategy-setting and performance, including the possib…
• CStrategy is set independently of any risk consideration
• DRisk management replaces strategic planning

An internal audit charter is BEST described as a document that:

• ALists all audits to be performed in the year
• BEstablishes the purpose, authority, responsibility, and reporting lines of the internal a…
• CRecords detailed test procedures for engagements
• DSubstitutes for the audit plan

Which scenario reflects the STRONGEST organizational risk culture?

• AEmployees focus only on their own targets and avoid raising risk concerns
• BRisks are openly discussed across functions, and lessons learned from incidents are share…
• COnly the CRO speaks publicly about risk
• DRisk discussions are restricted to the audit committee

What is the FIRST step in the ISO 31000 risk management process after establishing the scope, context, and criteria?

• ARisk treatment
• BRisk identification
• CRisk monitoring
• DRisk reporting

Which technique is MOST appropriate for IDENTIFYING risks in a business process where loss data is sparse and the process is largely manual?

• AMonte Carlo simulation
• BStructured workshops and interviews with process owners
• CValue-at-Risk modeling
• DStatistical regression of historical losses

A risk heat map plots risks by:

• ACost and budget
• BLikelihood and impact (consequence)
• CVelocity and persistence only
• DStrategic importance and ownership

Inherent risk and residual risk differ in that:

• AInherent risk includes the effect of controls; residual does not
• BInherent risk is the level of risk before any controls or treatments are considered; resi…
• CThey are the same in modern frameworks
• DResidual risk is always higher than inherent

Risk velocity refers to:

• AHow quickly a risk event materializes and impacts the organization once triggered
• BThe historical loss rate per year
• CThe difference between inherent and residual risk
• DThe cost of risk treatment

Which is NOT one of the four common risk-treatment options used in COSO ERM and ISO 31000?

• AAvoid (do not engage in the activity)
• BReduce / mitigate (apply controls)
• CShare / transfer (insure or outsource)
• DEliminate completely (drive risk to zero)

An organization purchases cyber insurance to cover ransomware losses. This is an example of:

• ARisk avoidance
• BRisk reduction
• CRisk sharing / transfer
• DRisk acceptance

Key Risk Indicators (KRIs) are MOST useful when they:

• AAre derived from external benchmarks only
• BProvide leading or coincident signals tied to thresholds and clear escalation paths
• CReplicate Key Performance Indicators (KPIs)
• DAre reviewed only annually

Scenario analysis is BEST described as a technique that:

• AEliminates uncertainty in projections
• BExamines plausible future combinations of events to test resilience and inform decisions
• CReplaces the need for stress testing
• DProvides a precise probability for each event

A bow-tie analysis visually links:

• ALikelihood and impact only
• BCauses (left), the risk event (center), consequences (right), with preventive and reactiv…
• CStrategic objectives to KPIs
• DAudit findings to remediation deadlines

Which is the BEST example of a LEADING risk indicator for a cyber breach?

• ANumber of breaches in the last quarter
• BPhishing simulation click-through rate trend
• CTotal cyber insurance premium paid
• DCost of incident response after a breach

When risk RESPONSES are designed, which factor is MOST important to evaluate before selecting one?

• ACost of the response in isolation
• BCost-effectiveness of the response relative to residual-risk reduction and alignment with…
• CWhether the response was used at peer firms
• DWhether the CFO personally approves the response

Which of the following BEST exemplifies a 'preventive' control versus a 'detective' control?

• ASystem access reviews after-the-fact (preventive)
• BSegregation of duties at provisioning (preventive)
• CBank reconciliations (preventive)
• DException reports (preventive)

Risk aggregation is important because:

• AIt eliminates correlations between risks
• BIndividually small risks may aggregate to a material exposure when correlations or shared…
• CIt replaces individual risk assessments
• DAggregating is required only for financial risks

Per ISO 31000, communication and consultation should:

• AOccur only at the end of risk assessments
• BBe ongoing throughout the risk management process to surface diverse views and align stak…
• CBe limited to the risk function
• DBe replaced by formal reporting

A control self-assessment (CSA) workshop yields a high-confidence rating from process owners that controls are effective, while internal audit testing finds material exceptions. The MOST likely explanation is:

• ACSA is always wrong and should be discontinued
• BSelf-assessment optimism bias; CSA needs independent validation and clearer definitions o…
• CInternal audit was misinformed
• DExternal audit must be wrong

Stress testing is BEST characterized as:

• AApplying severe but plausible adverse conditions to test resilience and capital/liquidity…
• BPredicting the most likely outcome
• CValidating financial statements
• DAssessing customer satisfaction

Which is the BEST sequence in the risk assessment process within ISO 31000?

• AIdentification → Treatment → Analysis → Evaluation
• BIdentification → Analysis → Evaluation → Treatment
• CTreatment → Identification → Evaluation → Analysis
• DEvaluation → Identification → Analysis → Treatment

When evaluating a quantitative risk model, which weakness is MOST important to disclose to the audit committee?

• AThe model uses well-documented, peer-reviewed methodologies
• BMaterial limitations of input data, assumptions, and validation results, including model…
• CThe model produces precise outputs
• DThe model uses a commercial vendor

An organization's risk register lists 'cybersecurity' as a single line item with a residual rating. The MAIN limitation of this approach is:

• ACybersecurity should not be on a risk register
• BSingle-line aggregation hides distinct underlying risks (ransomware, insider, third-party…
• CRisk registers should not list more than ten items
• DCybersecurity can only be tracked by the IT department

A 'risk profile' presents:

• AA static, year-end list of all known risks
• BAn organized view of risks (often prioritized) facing an entity at a point in time, inclu…
• COnly audit findings
• DA regulatory filing