Free Practice Questions for IIA CRMA

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card

100+ Questions

100% Free

Loading practice questions...

Same family resources

Explore More IIA Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

More From This Family

Videos and articles for deeper review.

VideoCIA Part 1 Exam Guide 2026: Internal Audit Fundamentals ArticleCIA Part 1 Exam Guide 2026: Internal Audit Fundamentals28 min read ArticleCIA Part 1 GIAS Question Strategy: Ethics, Objectivity, and Governance (2026)14 min read

Exam Review

Key Facts: IIA CRMA Exam

120 Qs

Exam Questions

150-minute exam

600/750

Passing Score

IIA scaled scoring

55%

Largest Section

Risk Management Assurance

5 + 20

COSO ERM 2017

Components and principles

8 Principles

ISO 31000:2018

Risk management standard

3 Lines

IIA Model (2020)

Replaced 'Lines of Defense'

CRMA is a 120-question, 150-minute IIA exam for professionals who provide assurance over risk management; the CIA is no longer a prerequisite. The syllabus covers Internal Audit Roles and Responsibilities (20%), Risk Management Governance (25%), and Risk Management Assurance (55%), and The IIA says it is currently supported by the 2017 Standards. CRMA is delivered at Pearson VUE test centers and scored on the IIA's 250-750 scale, with 600 to pass.

Sample IIA CRMA Practice Questions

Try these sample questions to review concepts for the IIA CRMA exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Under the 2024 Global Internal Audit Standards, who has primary accountability for ensuring an organization has an effective risk management framework?

A.The chief audit executive (CAE)

B.The board of directors (or equivalent governing body)

C.The chief risk officer

D.Senior operating management

Explanation: Standard 6.1 (Board Interaction) and Domain II of the 2024 Global Internal Audit Standards reaffirm that the governing body retains ultimate accountability for governance, risk management, and control. Senior management designs and operates the framework day to day; internal audit provides independent assurance over its effectiveness.

2The IIA's Three Lines Model (2020) replaced the Three Lines of Defense. Which statement best describes a key change introduced by the new model?

A.It eliminates the second line and merges its activities into internal audit

B.It emphasizes collaboration and value creation rather than rigid 'defense' against threats

C.It places internal audit in the first line for operational efficiency

D.It removes the governing body from the model entirely

Explanation: The 2020 Three Lines Model deliberately drops the word 'defense' to emphasize that risk management creates and protects value, not just defends against threats. It also makes the governing body explicit, clarifies the accountability/reporting relationships, and stresses alignment and collaboration across roles.

3How many components are in the COSO ERM 2017 'Enterprise Risk Management — Integrating with Strategy and Performance' framework?

A.5 components and 17 principles

B.5 components and 20 principles

C.8 components and 90 principles

D.4 components and 12 principles

Explanation: COSO ERM 2017 has five interrelated components — Governance & Culture; Strategy & Objective-Setting; Performance; Review & Revision; and Information, Communication & Reporting — supported by 20 principles. Candidates often confuse this with COSO Internal Control 2013, which has 5 components and 17 principles.

4ISO 31000:2018 defines risk as the:

A.Probability of a negative event occurring

B.Effect of uncertainty on objectives

C.Loss expected from operational failures

D.Difference between expected and actual outcomes

Explanation: ISO 31000:2018 (and its associated ISO Guide 73 vocabulary) defines risk as the 'effect of uncertainty on objectives.' This wording is intentional: 'effect' can be positive or negative, and risk is always tied to specific objectives. Internal audit testing routinely cites this exact phrase.

5An audit committee is reviewing the company's risk appetite statement. Which characteristic is MOST important for the statement to be useful in governance?

A.It is approved annually by external auditors

B.It is expressed exclusively in quantitative dollar limits

C.It is approved by the board and aligned with strategy and objectives

D.It is identical to the risk appetite of industry peers

Explanation: Risk appetite is a strategic governance concept: the board approves the appetite statement and ensures it aligns with the organization's strategy and objectives. COSO ERM 2017 and ISO 31000 both treat appetite as an expression of how much risk the organization is willing to take in pursuit of value creation.

6Which of the following BEST illustrates the 'tone at the top' driving risk culture?

A.Posting the code of conduct on the corporate intranet

B.Senior leaders publicly correcting their own behavior when it violates risk policies

C.Mandating annual ethics training for all employees

D.Including a risk management section in the annual report

Explanation: Tone at the top is demonstrated through observable leadership behavior, especially when leaders hold themselves accountable. When executives visibly correct their own conduct, employees see that risk policies apply equally and culture is reinforced. Posters, training, and disclosures help but do not on their own create culture.

7Per the IIA Three Lines Model, which group is responsible for designing and overseeing the risk management framework, including policies and risk monitoring?

A.First line — operational management

B.Second line — risk management, compliance, and similar functions

C.Third line — internal audit

D.External audit

Explanation: Second-line roles (risk management, compliance, quality, ethics) provide expertise, support, monitoring, and challenge for risk-related matters. They design frameworks and policies and monitor adherence. The first line owns and manages risks operationally, and the third line (internal audit) provides independent assurance.

8An organization's board has set a risk tolerance of 'no more than $5M aggregate operational loss per quarter.' This is BEST described as:

A.Risk appetite

B.Risk tolerance (a quantitative limit operationalizing appetite)

C.Risk capacity

D.Risk velocity

Explanation: Risk tolerance is the boundary of acceptable variation, typically expressed quantitatively, that operationalizes the broader risk appetite. Capacity is the absolute maximum the organization could absorb. Appetite is the strategic willingness to take risk. Velocity describes the speed at which risk events develop.

9A CAE is asked by the CFO to take direct responsibility for managing a newly identified compliance risk because 'audit knows it best.' What is the MOST appropriate response under the 2024 Global Internal Audit Standards?

A.Accept the role to support management

B.Decline the management role and document the impairment to objectivity if it had been accepted, while offering advisory support

C.Accept on a temporary basis with disclosure

D.Escalate to the external auditor for guidance

Explanation: Standard 2 (Independence) and Standard 7 (Positioning of Internal Audit) require the CAE to avoid taking on management responsibilities, which would impair independence and objectivity. The CAE may provide advisory or facilitative input. If such a role is accepted, the impairment must be disclosed; the better course is to decline.

10Which COSO ERM 2017 component most directly addresses how an entity identifies, assesses, and prioritizes risks that could affect achievement of strategy?

A.Governance and Culture

B.Strategy and Objective-Setting

C.Performance

D.Review and Revision

Explanation: The Performance component covers identifying risks, assessing severity, prioritizing, implementing responses, and developing a portfolio view. Strategy & Objective-Setting establishes the context (appetite, business context, strategy). Review & Revision evaluates how well ERM is functioning over time.

About the IIA CRMA Exam

The IIA's Certification in Risk Management Assurance (CRMA) validates the ability to provide assurance over risk management to audit committees and executive management. The 120-question, 150-minute exam covers Internal Audit Roles and Responsibilities (20%), Risk Management Governance (25%), and Risk Management Assurance (55%). The CIA is no longer a prerequisite.

Exam sponsor: The Institute of Internal Auditors (IIA) / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Questions

120 questions

Time Limit

150 minutes

Passing Score

600/750 (scaled)

Exam / Certification Fees

$465 (IIA members) / $610 (non-members)

Exam sponsor website

Reported exam pass rate: Not publicly disclosed. IIA does not release CRMA-specific pass rates Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Official sources

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

20%

Internal Audit Roles and Responsibilities

Assurance and consulting services over risk management, required competencies, organizational independence and impairments, coordination and reliance on other assurance providers, risk assurance maps

25%

Risk Management Governance

Governance, risk, and control frameworks, risk governance and risk culture, tone at the top, management's commitment to risk management, integration with strategy and performance, emerging risks, integrated risk reporting

55%

Risk Management Assurance

Risk assessment approaches (control self-assessment, continuous monitoring, maturity models), data analytics, evaluating risk identification and assessment, risk-based audit planning, engagement management, risk management effectiveness, systems development, data privacy, cybersecurity and IT controls, risk monitoring, engagement communication, and communicating unacceptable risk acceptance to the board

Preparing for the IIA CRMA Exam

What You Need to Know

Passing score: 600/750 (scaled)
Exam length: 120 questions
Time limit: 150 minutes
Exam / certification fees: $465 (IIA members) / $610 (non-members) Official sources

Using Our Practice Resources

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

IIA CRMA: Suggested Study Strategy

1Know the 2017 Standards that currently support the CRMA syllabus and how they map to the 2024 Global Internal Audit Standards

2Distinguish COSO ERM 2017 (5 components, 20 principles) from COSO Internal Control 2013 (5 components, 17 principles)

3Know the IIA Three Lines Model (2020) — and why 'defense' was removed

4Practice ISO 31000:2018 process: scope/context/criteria → identify → analyze → evaluate → treat (with monitoring & consultation throughout)

5Be precise on inherent vs residual vs target risk; preventive vs detective vs corrective controls

6Memorize NIST CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, Recover

7Know COSO ERM's five risk response categories: accept, avoid, pursue, reduce, and share

8Know how to communicate to the board when management accepts a level of risk that may be unacceptable (GIAS Standard 11.5)

Frequently Asked Questions

How many questions are on the CRMA exam and how long is it?

The CRMA exam has 120 multiple-choice questions in 150 minutes and is delivered at Pearson VUE test centers. IIA exams are scored on a 250-750 scale, and 600 or higher is required to pass. You receive one official result within three weeks of your exam date.

What are the CRMA exam domains?

The CRMA syllabus has three sections: Internal Audit Roles and Responsibilities (20%), Risk Management Governance (25%), and Risk Management Assurance (55%).

What standards does the CRMA reference?

The IIA says the CRMA syllabus is currently supported by the 2017 Standards and that there are no current plans to update the exam; its two-way mappings help connect those Standards to the 2024 Global Internal Audit Standards (effective 9 January 2025). COSO ERM 2017 (5 components, 20 principles), ISO 31000:2018, and the IIA Three Lines Model (2020) are useful risk framework references.

Who is eligible to take the CRMA?

The CIA is no longer required. Candidates apply through the IIA's CCMS portal with proof of education (or an active IAP) and a government-issued photo ID, must pass the exam within two years of applying, and verify 1 year (master's), 2 years (bachelor's), or 5 years (IAP holders or no degree) of internal audit or related experience before certification.

How is the CRMA different from the CIA or CRISC?

CIA is the foundational internal audit credential (three parts). CRMA is a separate IIA certification focused on risk management assurance and consulting; it no longer requires the CIA. CRISC (ISACA) addresses risk and information systems control with a stronger IT focus. Many internal auditors hold CIA + CRMA, while CRISC is often pursued by IT-risk professionals.

How should I prepare for the CRMA?

Plan by section weight: Risk Management Assurance is 55% of the syllabus, Risk Management Governance 25%, and Internal Audit Roles and Responsibilities 20%. Study risk governance and culture, risk assessment approaches, risk-based audit planning, IT and cybersecurity risk, and how to communicate risk acceptance, and use practice questions to find weak sections.