I85PREP
⌘ K
CRMI study materials
CRMI study resources

CRMI practice questions

One question at a time. Build your CRMI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Fundamentals and Frameworks

Which term describes the possibility that an event will occur and adversely affect the achievement of objectives?

  1. Risk Correct answer.
  2. Control
  3. Compliance
  4. Assurance

Explanation

Risk is defined as the effect of uncertainty on objectives, encompassing both the likelihood of an event and its adverse impact. Controls, assurance, and compliance are responses to or components of managing risk, not the risk itself.

Question 2Risk Management Fundamentals and Frameworks

In the standard risk formula, inherent risk is best described as which of the following?

  1. Risk that has been accepted by management
  2. Risk transferred to a third party
  3. Risk before any controls are considered Correct answer.
  4. Risk remaining after controls are applied

Explanation

Inherent risk is the exposure that exists before any mitigating controls are applied. Residual risk is what remains after controls, so the two are distinguished by the presence of mitigation.

Question 3Risk Management Fundamentals and Frameworks

A firm decides to purchase insurance to cover potential losses from a specific event. Which risk treatment option does this represent?

  1. Transfer Correct answer.
  2. Reduction
  3. Avoidance
  4. Acceptance

Explanation

Transfer shifts the financial consequence of a risk to another party, and insurance is the classic example. Avoidance eliminates the activity, reduction lowers likelihood or impact, and acceptance retains the exposure.

Question 4Risk Management Fundamentals and Frameworks

Which component of the COSO Enterprise Risk Management framework emphasizes that risk management should inform strategy-setting rather than follow it?

  1. Information, communication, and reporting
  2. Review and revision
  3. Strategy and objective-setting Correct answer.
  4. Governance and culture

Explanation

The COSO ERM framework places strategy and objective-setting at its core, integrating risk into the formulation of strategy. Governance and culture, review and revision, and information and reporting are supporting components around that core.

Question 5Risk Management Fundamentals and Frameworks

The three lines model distinguishes among functions by their roles. Which group typically provides independent assurance to the governing body?

  1. Second line risk function
  2. External consultants
  3. Third line internal audit Correct answer.
  4. First line management

Explanation

The third line, internal audit, provides independent and objective assurance on the effectiveness of governance and controls. The first line owns and manages risk, and the second line provides oversight and challenge.

Question 6Risk Management Fundamentals and Frameworks

Which of the following best characterizes a key risk indicator (KRI)?

  1. A contractual indemnity clause
  2. A metric that signals changing exposure to a risk Correct answer.
  3. A financial statement line item
  4. A regulatory capital ratio

Explanation

A KRI is a forward-looking metric designed to signal shifts in the level of a risk so management can act early. It is a monitoring tool rather than a financial, capital, or contractual item.

Question 7Risk Management Fundamentals and Frameworks

A risk is assessed with a low likelihood of occurrence but a potentially catastrophic impact. Which approach is most appropriate for treating such a risk?

  1. Rely solely on historical loss data
  2. Ignore it because likelihood is low
  3. Focus on impact-reduction and contingency planning Correct answer.
  4. Treat it identically to high-frequency low-impact risks

Explanation

Low-likelihood, high-impact risks warrant attention to reducing severity and preparing contingency responses because their expected value approach can understate catastrophic consequences. Historical data is often sparse for such events and ignoring them is imprudent.

Question 8Risk Management Fundamentals and Frameworks

Which of the following is the primary purpose of a risk appetite statement?

  1. To document past losses for reporting
  2. To articulate the amount and type of risk the organization is willing to pursue Correct answer.
  3. To assign blame for control failures
  4. To list every identified risk in the register

Explanation

A risk appetite statement expresses the level and nature of risk the organization is willing to accept in pursuit of its objectives. It guides decision-making and sets boundaries rather than cataloging risks or assigning blame.

Question 9Risk Management Fundamentals and Frameworks

A control that prevents an error from occurring in the first place is best described as which type of control?

  1. Preventive Correct answer.
  2. Corrective
  3. Directive
  4. Detective

Explanation

Preventive controls stop an undesirable event before it happens, such as segregating duties or requiring approvals. Detective controls find errors after the fact, and corrective controls remediate them.

Question 10Risk Management Fundamentals and Frameworks

An organization compares its risk register against a recognized framework to identify gaps in coverage. This activity is best described as which of the following?

  1. Capital allocation
  2. Risk identification benchmarking Correct answer.
  3. Control testing
  4. Risk appetite calibration

Explanation

Benchmarking against a framework helps surface risks the organization may have overlooked, improving the completeness of risk identification. It is not a control test, appetite exercise, or capital decision.

Question 11Risk Management Fundamentals and Frameworks

Which of the following best describes residual risk?

  1. The risk that management chooses to ignore
  2. The total of all risks on the register
  3. The risk that remains after controls have been applied Correct answer.
  4. The risk inherent in a new product before launch

Explanation

Residual risk is the exposure that persists once existing controls are in place and operating. It is compared with risk tolerance to determine whether additional action is needed.

Question 12Risk Management Fundamentals and Frameworks

A risk manager rates a risk's likelihood as 4 and impact as 5 on a 5-point scale. Using a simple multiplicative scoring model, what is the risk score?

  1. 1.25
  2. 9
  3. 20 Correct answer.
  4. 45

Explanation

A multiplicative scoring model multiplies likelihood by impact, so 4 times 5 equals 20. The resulting score is then mapped to a risk rating band to prioritize action.

Question 13Risk Management Fundamentals and Frameworks

Which of the following is a limitation of relying solely on a qualitative risk assessment?

  1. It always overstates financial exposure
  2. It cannot be applied to operational risks
  3. It can introduce subjectivity and inconsistency between assessors Correct answer.
  4. It requires precise actuarial data

Explanation

Qualitative assessments rely on judgment and descriptive scales, which can produce inconsistent ratings across assessors. They are useful for prioritization but lack the precision of quantitative methods.

Question 14Risk Management Fundamentals and Frameworks

In the context of risk governance, which body typically has ultimate responsibility for the organization's risk management framework?

  1. The external auditor
  2. The first-line business units
  3. The board of directors Correct answer.
  4. The internal audit team

Explanation

The board holds ultimate oversight responsibility for the risk management framework and for setting risk appetite. Management executes the framework while internal audit provides independent assurance.

Question 15Risk Management Fundamentals and Frameworks

A firm's risk tolerance differs from its risk appetite in which of the following ways?

  1. Tolerance is set by internal audit
  2. Tolerance is the acceptable variation around appetite for a specific objective Correct answer.
  3. Tolerance is always larger than appetite
  4. Appetite applies only to financial risks

Explanation

Risk tolerance is the acceptable level of variation the organization can withstand around a specific objective while staying within overall appetite. Appetite is the broader, high-level willingness to take risk.

Question 16Risk Management Fundamentals and Frameworks

Which of the following best describes the purpose of a risk heat map?

  1. To display risks by likelihood and impact for prioritization Correct answer.
  2. To record employee performance ratings
  3. To list regulatory requirements only
  4. To calculate the exact financial loss from each risk

Explanation

A heat map plots risks across likelihood and impact dimensions, allowing visual prioritization of exposures. It is a qualitative or semi-quantitative tool rather than a precise loss calculator.

Question 17Risk Management Fundamentals and Frameworks

An organization identifies a risk, decides it falls within appetite, and takes no further action while monitoring it. Which treatment option has been applied?

  1. Transfer
  2. Avoidance
  3. Acceptance Correct answer.
  4. Reduction

Explanation

Acceptance means retaining a risk within tolerance and monitoring it rather than acting to change it. Avoidance, reduction, and transfer all involve changing the exposure in some way.

Question 18Risk Management Fundamentals and Frameworks

Which statement best captures the relationship between risk management and internal control?

  1. Risk management applies only to financial reporting
  2. Internal control eliminates all risk
  3. Internal control is one mechanism used to manage risk Correct answer.
  4. They are identical concepts with different names

Explanation

Internal control is a set of processes that helps manage risk, but risk management is broader and includes strategy, appetite, and treatment decisions. Controls reduce risk but cannot eliminate it entirely.

Question 19Risk Management Fundamentals and Frameworks

Which of the following is an example of a strategic risk?

  1. A key supplier failing to deliver components
  2. A competitor launching a disruptive product line Correct answer.
  3. A fire damaging a warehouse
  4. A data entry clerk transcribing a figure incorrectly

Explanation

Strategic risk arises from changes in the competitive or market environment that threaten the organization's business model. Supplier, clerical, and physical damage examples are operational risks.

Question 20Risk Management Fundamentals and Frameworks

A risk register entry documents a likelihood of 'high' and an impact of 'low' with a rating of 'medium'. Which concept does this entry illustrate?

  1. Risk scoring and prioritization Correct answer.
  2. Risk aggregation
  3. Capital adequacy
  4. Risk transfer

Explanation

Combining likelihood and impact into a rating is risk scoring, which supports prioritization of remediation effort. The rating reflects the assessed combination rather than aggregation, transfer, or capital.

Question 21Risk Management Fundamentals and Frameworks

Which of the following best describes the concept of risk culture within an organization?

  1. The documented set of risk policies
  2. The organizational chart of the risk function
  3. The shared values and behaviors that shape how risk is managed day to day Correct answer.
  4. The number of risk incidents recorded annually

Explanation

Risk culture refers to the shared attitudes, values, and behaviors that determine how people actually manage risk. Policies, incident counts, and reporting lines are artifacts that reflect but do not define culture.

Question 22Risk Management Fundamentals and Frameworks

An organization sets a tolerance threshold for a key risk indicator. When the indicator breaches the threshold, what is the most appropriate immediate response?

  1. Delete the indicator from the register
  2. Assume the breach is a data error and ignore it
  3. Increase the threshold to match the current value
  4. Escalate the breach for review and corrective action Correct answer.

Explanation

A threshold breach signals that exposure has moved outside tolerance and should be escalated for investigation and corrective action. Adjusting or deleting the indicator would undermine the control it provides.

Question 23Risk Management Fundamentals and Frameworks

Which of the following distinguishes a risk from an issue?

  1. A risk is recorded in the register, while an issue cannot be
  2. An issue is always larger than a risk
  3. A risk is a potential future event, while an issue is a current problem Correct answer.
  4. A risk always has a financial value, while an issue does not

Explanation

A risk is an uncertain future event that may affect objectives, whereas an issue is a problem that has already occurred and requires resolution. Both can be tracked, but their timing and certainty differ.

Question 24Risk Management Fundamentals and Frameworks

Which of the following is the best example of a detective control?

  1. Encrypting data at rest
  2. Requiring dual approval before a payment is made
  3. Reconciling bank statements after month-end Correct answer.
  4. Restricting physical access to a server room

Explanation

Reconciliation identifies discrepancies after transactions occur, making it detective. Dual approval, encryption, and access restriction act before or during an event to prevent it.

Question 25Risk Management Fundamentals and Frameworks

Which of the following best explains why risk management is described as an iterative process?

  1. Because risks and the environment change, requiring reassessment over time Correct answer.
  2. Because regulators require a single assessment
  3. Because risk registers cannot be updated
  4. Because it must be completed only once at year-end

Explanation

Risk management is iterative because internal and external conditions shift, altering exposures and the effectiveness of controls. Ongoing reassessment keeps the risk profile current and relevant.

Question 26Risk Management Fundamentals and Frameworks

Which term describes the amount of risk an organization is willing to accept in pursuit of its objectives?

  1. Risk appetite Correct answer.
  2. Risk tolerance
  3. Risk limit
  4. Risk capacity

Explanation

Risk appetite is the broad-based amount of risk a company is willing to accept in pursuit of its mission or vision. It is set by senior leadership and guides risk-taking decisions.

Question 27Risk Management Fundamentals and Frameworks

In the COSO Enterprise Risk Management framework, which component involves identifying and assessing risks that could affect the achievement of objectives?

  1. Review and revision
  2. Performance Correct answer.
  3. Governance and culture
  4. Strategy and objective-setting

Explanation

The Performance component of the COSO ERM framework encompasses the identification, assessment, and prioritization of risks, as well as the selection and implementation of risk responses. It focuses on how risks are managed in the context of the organization's strategy.

Question 28Risk Management Fundamentals and Frameworks

A company's risk appetite statement specifies that it has a low tolerance for compliance breaches. A new regulation is introduced that could affect the company's operations. Which action best aligns with the risk appetite?

  1. Conduct a compliance risk assessment and update controls to ensure adherence. Correct answer.
  2. Wait for the next annual risk review to address the regulation.
  3. Delegate the matter to the legal department without further oversight.
  4. Ignore the regulation until enforcement actions are observed in the industry.

Explanation

Given the low tolerance for compliance breaches, the company should proactively assess the impact of the new regulation and strengthen controls to prevent breaches. This aligns with the risk appetite by minimizing compliance risk.

Question 29Risk Management Fundamentals and Frameworks

Which statement best describes the concept of inherent risk?

  1. The risk that is acceptable to the organization without further treatment.
  2. The risk that arises from external factors beyond the organization's control.
  3. The risk that exists before any controls or mitigation efforts are applied. Correct answer.
  4. The risk that remains after management has taken action to mitigate it.

Explanation

Inherent risk is the level of risk that exists in the absence of any controls or mitigation measures. It is the starting point for risk assessment, against which the effectiveness of controls is measured.

Question 30Risk Management Fundamentals and Frameworks

An organization is implementing a risk management framework. Which of the following best explains why the framework should be integrated into the organization's overall governance and decision-making processes?

  1. To satisfy regulatory requirements and avoid penalties.
  2. To ensure that risk management is considered in strategic planning and operational decisions. Correct answer.
  3. To eliminate the need for separate internal audit functions.
  4. To centralize all risk management activities within a single department.

Explanation

Integrating risk management into governance and decision-making ensures that risk considerations are embedded in strategic planning and daily operations, leading to more informed and resilient decisions. This alignment helps the organization achieve its objectives while managing uncertainty.

Question 31Risk Identification and Assessment

In enterprise risk management, which statement best describes the purpose of risk identification?

  1. It guarantees that no material risk will ever be overlooked by the organization
  2. It assigns a monetary value to each control so that residual risk can be capitalized
  3. It produces a complete inventory of exposures that may affect objectives before they are analyzed or treated Correct answer.
  4. It determines the audit opinion that external auditors will issue on the control environment

Explanation

Risk identification is the discovery and documentation of sources of uncertainty that could affect objectives; it precedes analysis and treatment. It builds an inventory rather than a valuation or assurance conclusion.

Question 32Risk Identification and Assessment

A risk register entry records a risk as 'inherent' rather than 'residual'. What does the inherent rating represent?

  1. The exposure measured only in qualitative rather than quantitative terms
  2. The exposure that regulators have formally accepted for the firm
  3. The exposure assuming no controls are in place to mitigate it Correct answer.
  4. The exposure remaining after existing controls have been applied

Explanation

Inherent risk is the level of exposure before considering the effect of controls. Residual risk is what remains once controls are applied.

Question 33Risk Identification and Assessment

Which technique is specifically designed to surface risks by asking a group to generate ideas freely without criticism in a structured session?

  1. Backtesting
  2. Value at risk modeling
  3. Monte Carlo simulation
  4. Brainstorming Correct answer.

Explanation

Brainstorming is a facilitated group technique in which participants generate candidate risks without immediate evaluation. The other options are quantitative measurement tools applied after risks are identified.

Question 34Risk Identification and Assessment

A firm classifies risks by the source of uncertainty: strategic, operational, financial, and compliance. What is this classification approach called?

  1. Control self-assessment
  2. Risk taxonomy Correct answer.
  3. Risk appetite statement
  4. Risk treatment plan

Explanation

A risk taxonomy is a structured scheme that groups risks into categories to support consistent identification and reporting. Appetite statements, treatment plans, and self-assessments serve different purposes.

Question 35Risk Identification and Assessment

Which risk category is most directly associated with failures in people, processes, systems, or external events affecting day-to-day activities?

  1. Strategic risk
  2. Reputational risk
  3. Operational risk Correct answer.
  4. Liquidity risk

Explanation

Operational risk arises from inadequate or failed internal processes, people, systems, or external events. Strategic, reputational, and liquidity risks have distinct drivers.

Question 36Risk Identification and Assessment

What is the primary purpose of a risk heat map?

  1. To document the detailed wording of each control activity
  2. To calculate the exact probability of default for each counterparty
  3. To display risks by likelihood and impact so priorities are visible Correct answer.
  4. To record the dates on which internal audits were performed

Explanation

A heat map plots risks on a two-dimensional grid of likelihood and impact, giving a visual ranking of relative significance. It does not provide detailed control descriptions or precise default probabilities.

Question 37Risk Identification and Assessment

Which of the following best describes a key risk indicator (KRI)?

  1. A control that eliminates a risk once it has been identified
  2. A metric used to monitor changes in a firm's exposure to a specific risk over time Correct answer.
  3. A legal document that transfers risk to an insurer
  4. A financial statement line item that records risk-related losses

Explanation

A KRI is a forward-looking or current metric that signals the level or trend of a specific risk. It monitors exposure rather than eliminating risk, transferring risk, or recording losses.

Question 38Risk Identification and Assessment

In risk assessment, 'likelihood' refers to which concept?

  1. The number of controls currently mitigating a risk
  2. The speed at which a risk event would be detected by controls
  3. The financial amount a risk would cost if it occurred
  4. The chance that a given risk event will occur within a defined period Correct answer.

Explanation

Likelihood expresses the probability or frequency of a risk event occurring over a stated time horizon. Impact, detection speed, and control count are separate dimensions.

Question 39Risk Identification and Assessment

A bank builds a matrix that maps each business line against event types such as fraud, execution errors, and system failures to identify operational exposures. Which approach is this?

  1. Scenario analysis
  2. Business line and event-type matrix Correct answer.
  3. Root cause analysis
  4. Stress testing

Explanation

A business line and event-type matrix systematically cross-references organizational units with categories of loss events to reveal where exposures concentrate. Scenario analysis, stress testing, and root cause analysis are distinct techniques.

Question 40Risk Identification and Assessment

A risk manager wants to identify low-frequency, high-severity exposures that historical data may not capture. Which technique is most appropriate?

  1. Trend analysis of monthly incident counts
  2. Scenario analysis with expert judgment Correct answer.
  3. Regression of losses on macroeconomic variables
  4. Frequency-severity distribution fitting on internal loss data

Explanation

Scenario analysis uses expert judgment to construct plausible but rare events that may be absent from historical records. Data-driven methods depend on observed events and are weak for rare tail exposures.

Question 41Risk Identification and Assessment

During a workshop, participants repeatedly ask 'why did this happen?' after each stated risk until underlying drivers emerge. Which identification technique is being used?

  1. SWOT analysis
  2. Fault tree quantification
  3. Delphi method
  4. Root cause analysis Correct answer.

Explanation

Root cause analysis drills down through successive 'why' questions to reveal underlying drivers rather than symptoms. Delphi, SWOT, and fault tree quantification serve different purposes.

Question 42Risk Identification and Assessment

A firm wants to reduce groupthink and dominant-personality effects when identifying emerging risks among geographically dispersed experts. Which technique is best suited?

  1. Process mapping
  2. Facilitated brainstorming
  3. Delphi method Correct answer.
  4. Checklist review

Explanation

The Delphi method collects anonymous responses over several rounds with controlled feedback, limiting domination by individuals and group pressure. Brainstorming, checklists, and process mapping do not provide this anonymity.

Question 43Risk Identification and Assessment

Which statement correctly distinguishes qualitative from quantitative risk assessment?

  1. Qualitative assessment is always more accurate than quantitative assessment
  2. Quantitative assessment cannot incorporate expert judgment
  3. Qualitative assessment assigns numeric probabilities, while quantitative assessment uses descriptive scales
  4. Qualitative assessment uses descriptive scales such as high or low, while quantitative assessment uses numeric estimates Correct answer.

Explanation

Qualitative assessment ranks risks using descriptive categories, whereas quantitative assessment expresses risk in numbers such as probabilities and monetary amounts. The two differ in measurement form, not in inherent accuracy.

Question 44Risk Identification and Assessment

A risk assessment scales impact using a five-point scale where each point has a defined monetary range. What property does this scale have?

  1. It is a ratio scale with a true zero
  2. It is an interval scale with equal spacing guaranteed
  3. It is an ordinal scale with defined anchors Correct answer.
  4. It is a nominal scale with no ordering

Explanation

A five-point scale with defined monetary anchors orders outcomes and gives each level a defined meaning, making it an ordinal scale with anchors. It does not guarantee equal intervals or a true zero.

Question 45Risk Identification and Assessment

A firm rates a risk as high likelihood and high impact, but notes the risk is fully covered by insurance. How should the risk be recorded to reflect both facts?

  1. Record only the residual rating and omit the inherent rating
  2. Record the inherent rating as low because insurance exists
  3. Record the inherent rating as high and the residual rating as lower after risk transfer Correct answer.
  4. Record the risk as eliminated and remove it from the register

Explanation

Both inherent and residual ratings are recorded; insurance is a risk transfer treatment that reduces residual exposure while inherent exposure remains high. Removing the risk or misstating inherent exposure loses important information.

Question 46Risk Identification and Assessment

A firm conducts a workshop in which participants imagine a severe but plausible cyber incident and trace its operational and financial consequences. Which identification approach is this?

  1. Scenario analysis Correct answer.
  2. Incident logging
  3. Benchmarking
  4. Process mapping

Explanation

Scenario analysis constructs hypothetical events and traces their consequences to reveal exposures and interdependencies. Benchmarking, process mapping, and incident logging do not model hypothetical futures.

Question 47Risk Identification and Assessment

Which source of information is most useful for identifying risks that have materialized at other firms in the same industry?

  1. The firm's own budget variance report
  2. Internal control testing results
  3. Employee engagement survey results
  4. External loss event databases and industry publications Correct answer.

Explanation

External loss databases and industry publications capture events at peer institutions, supporting identification of risks the firm may not yet have experienced. Internal records reflect only the firm's own history.

Question 48Risk Identification and Assessment

A risk register lists a risk as 'medium' likelihood and 'medium' impact, but the firm has no agreed definitions for those labels. What is the primary weakness of this assessment?

  1. It uses too many risk categories in the taxonomy
  2. It records residual risk before inherent risk
  3. It lacks calibrated definitions, so ratings are inconsistent across assessors Correct answer.
  4. It relies on too many quantitative inputs

Explanation

Without calibrated definitions for rating levels, different assessors interpret 'medium' differently, undermining comparability. The problem is definitional, not about excessive quantification or taxonomy size.

Question 49Risk Identification and Assessment

Which of the following is a leading indicator of operational risk rather than a lagging one?

  1. Number of regulatory fines paid in the prior period
  2. Total losses recorded from processing errors last year
  3. Staff turnover rate among key operations personnel Correct answer.
  4. Number of settled customer complaints last quarter

Explanation

Leading indicators signal rising exposure before losses occur; elevated turnover among key personnel can foreshadow errors and control breakdowns. Complaints, recorded losses, and fines are lagging outcomes of past events.

Question 50Risk Identification and Assessment

A firm's risk taxonomy uses overlapping categories so that a single event is recorded under both 'technology' and 'external fraud'. What is the main consequence for risk reporting?

  1. Guaranteed compliance with regulatory capital rules
  2. Automatic improvement in control effectiveness
  3. Double counting and inconsistent aggregation of exposures Correct answer.
  4. Elimination of the need for a risk register

Explanation

Overlapping taxonomy categories cause the same event to be counted more than once, distorting aggregation and reporting. A well-defined taxonomy uses mutually exclusive categories where possible.