CRMI common mistakes
CRMI · Understand the traps and how to avoid them.
Treating risk as identical to uncertainty or to a hazard, and answering definitional items by picking the option that sounds most cautious rather than the one matching the standard risk vocabulary (uncertainty about objectives, effect of uncertainty on objectives).
Candidates carry colloquial usage into the exam and never anchor a precise definition, so they choose by gut feel on terminology items.
What to do instead
Before answering any definitional item, write the operative definition in one line (risk = effect of uncertainty on objectives; includes upside and downside) and eliminate options that conflate risk with the source of harm or with pure probability.
Describing a risk management framework as a linear checklist to be completed once, rather than a cyclical process of establishing context, identifying, analysing, evaluating, treating, and monitoring with feedback loops.
Studying from summaries that list steps in order encourages memorising sequence without the iterative and context-dependent nature of the process.
What to do instead
Practice sketching the process as a loop and explicitly naming where context-setting and communication/consultation sit; when a scenario asks what to do next, ask which loop stage the scenario is actually in rather than which step comes next in a list.
Confusing risk identification with risk analysis, and answering identification questions with likelihood or impact judgements (or vice versa).
The two stages are studied together and scenario stems often mention both, so candidates answer the question they expected rather than the one asked.
What to do instead
Underline the verb in the question stem (identify, assess, evaluate, treat, monitor). Identification produces a list of sources, events, and consequences; analysis attaches likelihood and impact; evaluation compares against criteria. Answer only the underlined verb.
Selecting a single identification technique (typically brainstorming or a checklist) for every scenario instead of matching technique to context, such as using structured techniques for complex or novel risks and checklists only for known, recurring risks.
Candidates memorise a list of techniques without their strengths and limitations, so the most familiar name looks safest.
What to do instead
Build a two-column table of techniques with 'best when' and 'blind spot' for each (e.g., checklists miss novel risks; scenario analysis suits low-frequency high-impact; HAZOP suits process deviations). Answer by matching the scenario's characteristics to the technique's fit.
Treating a high inherent risk rating as the basis for decisions, ignoring the effect of existing controls and the distinction between inherent, current (residual), and target risk.
Inherent ratings are visually striking and candidates report them as the 'real' risk, forgetting that control effectiveness must be assessed first.
What to do instead
For every rating question, state which of the three ratings is being asked for and whether controls have been assessed for design and operating effectiveness. Residual risk follows from credible control effectiveness, not from the raw inherent score.
Applying qualitative, semi-quantitative, and quantitative approaches interchangeably, for example treating a 5x5 heat map score as a cardinal measure that can be multiplied, averaged, or arithmetically compared across risks.
Heat maps look numerical, and candidates apply ordinary arithmetic to ordinal scales without recognising the loss of meaning.
What to do instead
Classify every scale as ordinal or cardinal before using it. Ordinal scores rank and band only; they cannot be summed, averaged, or used to compute expected loss. Reserve arithmetic for cardinal measures with defined units, and flag any option that performs arithmetic on a qualitative scale.
Choosing a treatment option (avoid, reduce, transfer, accept, share) by preference or habit rather than by reference to risk criteria and cost-benefit, and treating 'accept' as 'do nothing'.
Candidates associate good risk management with eliminating or transferring risk and overlook that acceptance is a legitimate, documented decision within appetite.
What to do instead
For each treatment question, first identify the risk criteria and appetite position, then test each option against cost versus benefit and residual position. Note that acceptance requires authority, documentation, and monitoring, and that transfer shifts financial consequence but not all accountability.
Conflating risk appetite, risk tolerance, and risk capacity, and answering governance items as if a statement of appetite were the same as a limit or as the maximum risk the organisation could bear.
The terms are used loosely in practice and overlap in everyday speech, so candidates map them onto whichever definition they saw first.
What to do instead
Fix the three definitions: appetite is the amount and type of risk willing to be pursued; tolerance is the acceptable variation around appetite expressed as limits; capacity is the maximum risk bearable given resources. Read the stem for 'willing', 'limit/breach', or 'able to bear' and answer accordingly.
Treating the three lines model as a hierarchy in which the second line owns the risks and the third line provides assurance on risk management, rather than the first line owning and managing risk, the second providing oversight and challenge, and the third providing independent assurance.
Org charts suggest seniority equals ownership, and candidates assign risk ownership to risk or audit functions.
What to do instead
Memorise ownership by function: business operations own and manage risk (first line); risk and compliance functions set frameworks and challenge (second line); internal audit gives independent assurance to the governing body (third line). Reject any option that gives audit management responsibility or the second line ownership of operational risk.
Confusing monitoring and reporting purposes, for example describing reporting as a control activity that reduces risk, or treating a key risk indicator as a key performance indicator, and ignoring escalation triggers and reporting thresholds.
Dashboards and KPIs are familiar from performance reporting, so candidates blur the performance and risk lenses and forget that reporting informs decisions rather than changing exposure.
What to do instead
Separate the purposes: monitoring detects change in risk and control effectiveness; reporting communicates position and escalates against defined thresholds. Distinguish leading KRIs (predictive, tied to risk drivers) from lagging KPIs, and check whether an option actually changes exposure or only informs it.
Answering ethics and compliance items by choosing the option that satisfies the letter of a rule or a supervisor's minimum expectation, ignoring conduct, conflicts of interest, and the spirit of the obligation.
Candidates equate compliance with risk management and default to the most rule-bound option, missing that ethical and conduct expectations can exceed legal minimums.
What to do instead
For ethics items, rank options by whether they address the underlying conduct and conflicts as well as the rule, and prefer documented escalation and disclosure over silence or bare minimum compliance. Remember that legal compliance is a floor, not the standard for conduct risk.