CRMI cheat sheet

Risk is the effect of uncertainty on objectives; it is expressed as a combination of likelihood and impact.

ISO 31000 risk process: establish context, identify, analyze, evaluate, treat, monitor/review, communicate/consult.

COSO ERM components: governance & culture, strategy & objective-setting, performance, review & revision, information/communication/ reporting.

Inherent risk is assessed before controls; residual risk is assessed after controls are applied.

Risk appetite is the amount and type of risk an organization is willing to accept; risk tolerance is the acceptable variation around that appetite.

Three lines model: first line owns and manages risk, second line provides oversight and challenge, third line provides independent assurance.

A risk framework must be proportionate, aligned with objectives, and integrated into decision-making, not a standalone exercise.

Risk criteria are the thresholds used to evaluate significance; they should be set before risks are assessed to avoid bias.

Control effectiveness is judged by design adequacy and operating effectiveness, not by the mere existence of a control.

Risk identification sources include process mapping, workshops, interviews, incident data, audits, and external threat intelligence.

A risk register records risk description, cause, event, consequence, owner, controls, ratings, and treatment status.

Cause-event-consequence structure prevents conflating a risk with its impact or its control failure.

Likelihood and impact scales must be defined with explicit descriptors and calibrated to the organization's risk criteria.

Risk assessment can be qualitative (descriptive scales), semi-quantitative (scored scales), or quantitative (modeled distributions).

Bow-tie analysis separates threats and preventive controls on the left from consequences and mitigative controls on the right.

SWOT and PESTLE are identification aids, not assessment methods; they surface sources of uncertainty rather than rate them.

Risk owners are accountable for a risk and its treatment; risk actions may be delegated but accountability is not.

Expected loss = probability of event × financial impact; it ignores tail severity unless the full distribution is modeled.

Value at Risk (VaR) states a loss threshold not exceeded with a given confidence over a defined horizon; it says nothing about losses beyond it.

Expected Shortfall (CVaR) is the average loss conditional on exceeding VaR and is more sensitive to tail risk.

Risk score = likelihood rating × impact rating when using a multiplicative matrix; additive scoring changes the implied trade-offs.

Monte Carlo simulation draws from input distributions to produce an output distribution of outcomes for scenario and capital analysis.

Sensitivity analysis varies one input at a time; scenario analysis evaluates coherent combinations of inputs.

Key risk indicators (KRIs) are forward-looking metrics with defined thresholds that signal rising risk exposure.

Correlation and diversification reduce portfolio risk; assuming independence when risks are correlated understates aggregate exposure.

Heat maps display likelihood-impact combinations but can obscure the underlying scale definitions and aggregation assumptions.

Treatment options: avoid, reduce (mitigate), transfer (share), and accept (retain); some frameworks add exploit for opportunities.

Control types: preventive (reduce likelihood), detective (identify occurrence), and corrective (reduce impact or restore).

Residual risk must be compared with risk tolerance; if it exceeds tolerance, further treatment or escalation is required.

Risk transfer (insurance, outsourcing, contracts) shifts financial consequence but not all reputational or legal accountability.

A cost-benefit test for a control compares the reduction in expected loss with the control's total cost of ownership.

Treatment plans require an owner, action, due date, and success measure; without these they are intentions, not controls.

Risk avoidance eliminates the activity and its upside as well as its downside; it is rarely costless.

Control testing should verify both design and operation; a well-designed control that is not performed provides no assurance.

Business continuity and incident response plans are mitigative controls that reduce impact after an event occurs.

The board sets risk appetite and provides oversight; management implements the framework and owns execution.

Risk appetite statements should specify risk types, quantitative or qualitative boundaries, and escalation triggers.

Tone at the top is reinforced by incentives; compensation structures that reward volume without risk adjustment undermine culture.

Three lines model: first line owns risk, second line sets frameworks and challenges, third line (internal audit) assures independently.

A risk committee charter defines membership, quorum, decision rights, and reporting lines to the board.

Speak-up mechanisms and non-retaliation policies are structural controls that support a healthy risk culture.

Risk culture is evidenced by behaviors under pressure, not by stated values; near-miss reporting rates are a useful indicator.

Segregation of duties prevents one person from initiating, approving, and recording a transaction.

Appetite must cascade into limits, thresholds, and delegated authorities so that front-line decisions reflect board intent.

Monitoring should be continuous or periodic, with frequency proportionate to the risk's velocity and severity.

KRIs require a baseline, a threshold, and an escalation path; a metric without thresholds is not a monitoring control.

Risk reporting should be timely, accurate, and decision-useful; dashboards should distinguish inherent from residual exposure.

Escalation criteria define what must be reported upward and within what timeframe; they should be tested.

Aggregation of risk data can hide concentration; reporting should show both entity-level and consolidated views.

Key control indicators (KCIs) measure control performance, while KRIs measure risk exposure.

Post-incident reviews and near-miss analysis feed back into identification and treatment, closing the loop.

Independent assurance (internal audit) provides objective evaluation of the risk framework's design and operation.

Communication with external stakeholders on risk should be consistent with internal reporting and regulatory obligations.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply.

Regulatory obligations should be mapped to controls and owners in a compliance register or obligations matrix.

Principles-based regulation requires judgment and evidence of intent; rules-based regulation specifies explicit requirements.

Know Your Customer (KYC) and anti-money-laundering (AML) controls are preventive and detective controls against financial crime.

Conflicts of interest must be identified, disclosed, and managed; disclosure alone does not eliminate the conflict.

Whistleblowing channels must be independent, confidential, and protected by non-retaliation policy.

Ethical risk is the risk that decisions violate stated values or societal expectations, even where no law is broken.

Regulatory change is a risk driver; horizon scanning and regulatory change management are monitoring controls.

Data protection obligations require lawful basis, minimization, retention limits, and breach notification procedures.