ARM (The Institutes Insurance Designations) common mistakes
ARM · Understand the traps and how to avoid them.
On scenario questions that ask what the risk manager should do first or next, the candidate picks a control measure or an insurance purchase instead of an identification or analysis step.
Most candidates work in insurance or safety roles, so their reflex is to jump straight to the solution they use on the job, and they read the scenario for what feels most useful rather than for the sequencing keyword.
What to do instead
Memorize the process order (establish objectives and context, identify, analyze, evaluate/prioritize, treat, monitor and review) and underline trigger words such as 'first,' 'next,' 'initial,' and 'before.' Drill 20 scenario items where you must name the step before reading the options.
Classifying a technique as risk control when it is risk financing, or vice versa, such as labeling retention, transfer, or insurance as control, or labeling separation and duplication as financing.
Several techniques overlap in practice (a safety program lowers premium; a deductible is both a retention and a behavior driver), so the categories blur under time pressure.
What to do instead
Build a two-column drill sheet and place every technique by asking one question: does it change the frequency or severity of the loss, or does it fund the loss after it happens? Retention, transfer, and insurance go in the funding column; avoidance, prevention, reduction, separation, and duplication go in the control column.
Treating risk appetite, risk tolerance, risk capacity, and risk attitude as interchangeable, and choosing an option that describes willingness when the stem describes ability to absorb loss.
The terms sound similar and are used loosely in everyday business language, so candidates answer from the general feel of the word rather than from the formal distinction.
What to do instead
Attach a one-line test to each: capacity is the maximum loss the organization can absorb financially; appetite is the amount of risk it chooses to pursue; tolerance is the acceptable variation around a specific objective or limit; attitude is the qualitative predisposition of decision makers. Practice by classifying one sentence per term and checking which noun the stem is really describing.
Confusing frequency with severity outcomes in quantitative items, and misusing expected loss, probable maximum loss, and maximum possible loss, including failing to multiply frequency by average severity.
These measures are frequently presented in the same scenario with realistic dollar figures, and candidates anchor on the largest number rather than the definition being tested.
What to do instead
Write expected loss as frequency times average severity and keep units visible. Before computing, label each figure in the stem as frequency, per-loss severity, or worst-case. Memorize that probable maximum loss is the largest loss reasonably expected from a single event under normal conditions, while maximum possible loss is the worst case with no controls assumed to function.
Treating emerging technology as a synonym for cyber risk, so on property, liability, or workers' compensation scenarios involving drones, sensors, automation, or telematics the candidate picks the data-breach option.
Headlines and study emphasis link new technology to hacking, and the cyber framing is the most familiar, so other exposure lines are never considered.
What to do instead
For each technology, run a four-quadrant pass before answering: people (injury, employment, skills), property (damage, obsolescence, business interruption), liability (third-party bodily injury, products, professional, privacy), and net income (revenue, cost, continuity). Answer only after naming which quadrant the stem describes.
Recommending a technology adoption without identifying the secondary and residual risks it creates, such as increased dependency on a single vendor, new single points of failure, or skills loss when automated processes replace experienced staff.
Candidates evaluate the technology against the risk it was adopted to fix, and once that risk is reduced the analysis feels complete.
What to do instead
Use a forced pairing: for every stated benefit, write one new exposure it introduces and one control that addresses it. Practice items that ask 'which new exposure is created' rather than 'which risk is reduced.'
Blurring the risk of using a technology with the technology as a risk management tool, and ignoring model and data quality risk when analytics, AI, or sensor data are used for forecasting and monitoring.
Both directions can appear in the same scenario, so the candidate answers the familiar direction without checking which one the stem names.
What to do instead
Before reading the options, state in one sentence whether the technology is the source of the exposure or the instrument being used to manage an unrelated exposure. When it is the instrument, check for data integrity, model validation, and human oversight as the likely correct theme.
Answering implementation questions at the strategy-selection stage, selecting the right technique but never addressing ownership, resourcing, timelines, and communication, so the option chosen is true but incomplete.
The analytical part of the exam rewards picking the correct technique, and candidates carry that habit into implementation items where the correct answer is the one that turns the decision into assigned action.
What to do instead
Use an implementation chain for every item: who owns it, what resources and authority they need, what the timeline and milestones are, how it is communicated, and how results are reported. When two options are both technically correct, choose the one that adds the missing implementation element.
Treating implementation as a purely technical exercise and ignoring organizational culture, incentives, and stakeholder buy-in, so a well-designed program is assumed to work without behavior change.
Study material on techniques is quantitative and frameworks feel neutral, so human and political factors look like soft extras rather than testable content.
What to do instead
For each scenario, ask who must behave differently for this to work and what will make them do it. Look for answers that pair the technique with training, incentives, tone from leadership, or consultation with affected units, and eliminate answers that assume compliance without alignment.
Skipping the monitoring and review stage, so when a stem asks what happens after implementation the candidate selects another control or an additional financing layer instead of measurement, key risk indicators, reporting, and program adjustment.
Monitoring is the least visible step in case studies and is easily mistaken for routine administration rather than a distinct part of the cycle.
What to do instead
Memorize that every cycle closes with measurement and feedback, and treat 'which metric or indicator would reveal this' and 'what should be reviewed and how often' as recurring question types. Practice by naming one key risk indicator for each treatment you recommend.