I85PREP
⌘ K
RMIA CPRM study materials
RMIA CPRM study resources

RMIA CPRM practice questions

One question at a time. Build your RMIA CPRM understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

In enterprise risk management, what does the concept of 'risk appetite' primarily describe?

  1. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  2. The schedule for conducting internal audits
  3. The list of risks identified during a brainstorming session
  4. The maximum financial loss an insurer will pay on a single policy

Explanation

Risk appetite expresses the level and nature of risk an organization is prepared to pursue or retain to achieve its goals. It is set by senior leadership and guides risk tolerance limits and decision-making across the entity.

Question 2Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which statement best captures the relationship between inherent risk and residual risk?

  1. Residual risk is assessed before any controls are applied
  2. Inherent risk applies only to financial risks
  3. Residual risk is the risk remaining after controls are applied to inherent risk Correct answer.
  4. Inherent risk equals residual risk when controls are perfectly effective

Explanation

Inherent risk is the exposure that exists before considering controls, while residual risk is what remains once controls are in place and operating. The gap between them reflects the effectiveness of mitigation.

Question 3Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk manager plots likelihood on one axis and impact on the other to rank exposures. What is this tool called?

  1. A risk matrix Correct answer.
  2. A business impact analysis
  3. A control self-assessment
  4. A key risk indicator dashboard

Explanation

A risk matrix combines likelihood and impact ratings to produce a relative risk score used for prioritization. It is a common qualitative or semi-quantitative tool in enterprise risk management.

Question 4Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which of the following is a leading indicator rather than a lagging indicator of risk?

  1. Customer complaints filed after a service outage
  2. Rising employee turnover in a critical department Correct answer.
  3. Number of incidents recorded last quarter
  4. Losses reported in the annual financial statements

Explanation

Leading indicators are forward-looking measures that can signal emerging risk before losses occur. Rising turnover in a critical department may foreshadow operational or knowledge-loss risk.

Question 5Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

What is the primary purpose of a risk register?

  1. To document the organization's insurance policies
  2. To record identified risks along with owners, ratings, and mitigation status Correct answer.
  3. To list employee training completions
  4. To track the annual audit calendar

Explanation

A risk register is a structured record of identified risks, typically capturing description, owner, likelihood and impact ratings, controls, and treatment status. It serves as the central tracking tool for the risk management program.

Question 6Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

In the standard risk treatment hierarchy, which response involves transferring risk to a third party?

  1. Transfer Correct answer.
  2. Avoidance
  3. Acceptance
  4. Mitigation

Explanation

Risk transfer shifts the financial consequence of a risk to another party, commonly through insurance or contractual arrangements. Avoidance eliminates the activity, mitigation reduces it, and acceptance retains it.

Question 7Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which element is essential for a risk to be considered formally 'owned' within an organization?

  1. A fully funded mitigation budget
  2. A named individual accountable for managing the risk Correct answer.
  3. A unanimous vote by the board
  4. An entry in the external audit report

Explanation

Risk ownership requires a clearly identified accountable person who monitors and manages the exposure. Ownership is about accountability, not necessarily budget, audit status, or board voting.

Question 8Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

What does a business impact analysis (BIA) primarily determine?

  1. The cost of purchasing cyber insurance
  2. The number of controls needed in a data center
  3. The criticality of business functions and the consequences of their disruption Correct answer.
  4. The likelihood that a threat will exploit a vulnerability

Explanation

A BIA identifies critical business functions and quantifies the operational and financial effects of their disruption over time. Its outputs, such as recovery time objectives, feed continuity planning.

Question 9Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An organization faces a risk with high impact but low likelihood that could threaten its solvency. Leadership decides to purchase insurance covering most of the potential loss. Which treatment strategy is this?

  1. Risk transfer Correct answer.
  2. Risk avoidance
  3. Risk acceptance
  4. Risk exploitation

Explanation

Purchasing insurance shifts the financial burden of a low-frequency, high-severity event to an insurer, which is risk transfer. The organization retains some exposure through deductibles and limits.

Question 10Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk score is calculated as likelihood (1-5) multiplied by impact (1-5). A risk with likelihood 4 and impact 2 scores 8, while another has likelihood 2 and impact 4. How should a manager interpret these two scores?

  1. The first risk is inherently more dangerous because likelihood drives severity
  2. The scores are equal, but the high-impact risk may warrant closer scrutiny given its greater potential severity Correct answer.
  3. Both risks require identical treatment plans because scores match
  4. The second risk should be ignored because it is unlikely

Explanation

Multiplication yields the same score, but the underlying profiles differ. A high-impact risk can produce severe consequences when it occurs, so judgment should supplement the numeric score.

Question 11Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A firm sets a risk tolerance stating that no single operational disruption may cause losses exceeding $2 million. A newly assessed risk could cause $5 million in losses. What does this indicate?

  1. The risk exceeds tolerance and requires treatment or escalation Correct answer.
  2. The risk automatically becomes a compliance violation
  3. The tolerance threshold should be ignored for operational risks
  4. The risk is within tolerance and can be accepted

Explanation

Risk tolerance defines the acceptable variation around risk appetite, and an exposure beyond the stated threshold falls outside it. Management must treat, reduce, or escalate the risk for a decision.

Question 12Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

During a risk workshop, participants rate a risk as 'high' but cannot agree on why. What is the most useful next step to improve the assessment's reliability?

  1. Escalate immediately to the regulator
  2. Remove the risk from the register to avoid conflict
  3. Average the ratings and move on
  4. Define clear rating criteria with calibrated descriptors for likelihood and impact Correct answer.

Explanation

Disagreement often stems from undefined or inconsistent rating scales. Calibrated descriptors give participants a shared reference, improving consistency and defensibility of ratings.

Question 13Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A company identifies a key risk indicator that has been trending upward for three consecutive quarters but remains below its threshold. What is the most appropriate response?

  1. Take no action until the threshold is breached
  2. Immediately close the associated risk
  3. Delete the indicator because it has not triggered
  4. Investigate the trend and consider proactive mitigation Correct answer.

Explanation

An upward trend, even below threshold, is an early warning signal that warrants investigation and possible preemptive action. Reacting only at breach forfeits the value of leading indicators.

Question 14Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which scenario best illustrates concentration risk?

  1. A firm purchases multiple insurance policies
  2. A firm relies on a single vendor for all its cloud infrastructure Correct answer.
  3. A firm diversifies suppliers across five countries
  4. A firm rotates its encryption keys quarterly

Explanation

Concentration risk arises when exposure is clustered in a single counterparty, asset, or dependency. Single-vendor reliance means one failure could disrupt the entire operation.

Question 15Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk manager is deciding whether to treat or accept a risk. Which factor is most relevant to that decision?

  1. The length of the last audit report
  2. The color scheme of the risk dashboard
  3. The cost of treatment compared with the expected loss reduction Correct answer.
  4. The number of employees in the risk department

Explanation

Treatment decisions should weigh the cost of mitigation against the reduction in expected loss it delivers. If treatment costs exceed the benefit, acceptance may be rational within tolerance.

Question 16Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An organization adopts a 'three lines model.' Which group constitutes the first line?

  1. Operational management that owns and manages risk day to day Correct answer.
  2. The board of directors
  3. External regulators
  4. Internal audit

Explanation

In the three lines model, operational management owns and manages risk in the first line. The second line provides oversight and support, and internal audit forms the independent third line.

Question 17Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk appears on the register with no assigned owner and no treatment plan six months after identification. What is the most significant governance concern?

  1. The risk rating is probably too low
  2. Accountability and follow-through are absent, so the risk may go unmanaged Correct answer.
  3. The organization has too many controls
  4. The risk register may contain too many entries

Explanation

Unassigned risks with no treatment plan lack accountability, a core governance failure. Without an owner and plan, monitoring and mitigation are unlikely to occur.

Question 18Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which practice best supports continuous risk monitoring rather than an annual point-in-time review?

  1. Reviewing the register only during the yearly audit
  2. Tracking key risk indicators and updating risk ratings on a defined cadence Correct answer.
  3. Relying solely on historical loss data
  4. Freezing risk ratings once approved by the board

Explanation

Continuous monitoring uses indicators and scheduled reassessment to keep risk information current as conditions change. Annual-only reviews and frozen ratings allow exposures to become stale.

Question 19Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A project team identifies a risk that, if realized, would prevent the project from meeting a regulatory deadline. The team cannot reduce likelihood or impact further. What treatment option remains most appropriate?

  1. Transfer of the regulatory obligation to a vendor
  2. Acceptance with documented rationale and contingency planning Correct answer.
  3. Ignoring the risk because controls are exhausted
  4. Avoidance of the regulatory requirement

Explanation

When mitigation options are exhausted and the risk cannot be avoided or transferred, documented acceptance with contingency planning is the appropriate path. The rationale and contingency should be recorded and approved.

Question 20Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An analyst computes expected loss as probability multiplied by financial impact. A threat has a 10% annual probability and a $500,000 impact. What is the annualized expected loss?

  1. $5,000,000
  2. $50,000 Correct answer.
  3. $5,000
  4. $500,000

Explanation

Expected loss equals probability times impact, so 0.10 multiplied by $500,000 yields $50,000 per year. This figure supports comparing the cost of controls against anticipated benefit.

Question 21Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk manager notes that two risks have identical scores, but one is well understood with stable historical data while the other relies on sparse expert judgment. How should this difference affect decision-making?

  1. The well-understood risk should always be deprioritized
  2. Uncertainty has no bearing on risk decisions
  3. Both should be treated identically because scores match
  4. The risk with greater estimation uncertainty may warrant more conservative treatment or further analysis Correct answer.

Explanation

Confidence in an estimate is a distinct dimension from the estimate itself. Greater uncertainty argues for additional analysis or more cautious treatment to avoid understating exposure.

Question 22Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An organization's risk appetite is conservative, but a business unit consistently accepts risks near the upper tolerance limit. What is the most likely governance weakness?

  1. The risk register has too few entries
  2. Key risk indicators are measured too frequently
  3. The risk appetite statement is too detailed
  4. There is insufficient alignment between stated appetite and operational decision-making Correct answer.

Explanation

A mismatch between stated appetite and actual behavior signals weak alignment between strategy and operations. Governance should translate appetite into limits and decision criteria that business units apply.

Question 23Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A firm uses a quantitative model to estimate operational losses. Backtesting shows the model underestimated tail losses in three of the last five years. What is the most appropriate conclusion?

  1. The model is adequate because it performs well on average
  2. Tail losses should be excluded from the model
  3. The model should be replaced by expert opinion alone
  4. The model's tail-risk assumptions may be too optimistic and require recalibration Correct answer.

Explanation

Systematic underestimation of tail losses indicates the model's severity or dependence assumptions are too optimistic. Recalibration, such as heavier-tailed distributions or stress testing, is warranted.

Question 24Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Two divisions share a data center. Each assesses its own downtime risk as low, but neither accounts for the correlated failure affecting both simultaneously. What risk concept is being overlooked?

  1. Residual risk
  2. Inherent risk
  3. Risk appetite
  4. Correlation and aggregation risk Correct answer.

Explanation

Individually low risks can aggregate into a much larger exposure when they are correlated. Shared dependencies create common-mode failures that division-level assessments miss.

Question 25Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A board wants assurance that the risk management framework is effective, not just that risks are listed. Which evidence most directly supports that conclusion?

  1. Documented testing showing controls operate as designed and risks remain within tolerance Correct answer.
  2. A large risk department headcount
  3. A lengthy risk register with many entries
  4. Frequent changes to the risk taxonomy

Explanation

Framework effectiveness is demonstrated by evidence that controls function and exposures stay within approved tolerances. Register size or staffing levels do not by themselves show effectiveness.

Question 26Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which statement best defines risk appetite in enterprise risk management?

  1. The maximum number of employees permitted to approve a new vendor relationship
  2. The amount and type of risk an organization is willing to pursue or retain to meet its objectives Correct answer.
  3. The total number of risks recorded in the corporate risk register at any point in time
  4. The process of buying insurance to cover every identified operational exposure

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives, and it is set by leadership as a guiding boundary. It is a forward-looking statement of willingness, not a count of register entries or a purchasing decision. Tolerance and limits then translate appetite into measurable thresholds.

Question 27Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

In risk assessment, what does inherent risk refer to?

  1. The portion of risk that has been formally transferred to an insurer
  2. The residual exposure remaining after all controls have been implemented
  3. The risk that remains unidentified after a full assessment cycle
  4. The exposure that exists before any controls or mitigations are applied Correct answer.

Explanation

Inherent risk is the level of exposure that would exist absent any controls, providing a baseline for evaluating whether controls add value. Residual risk is the level after controls are applied, which is a separate and complementary measure. Comparing the two shows the effectiveness of the control environment.

Question 28Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which document typically records each identified risk, its owner, its rating, and its planned response?

  1. The marketing plan
  2. The statement of cash flows
  3. The employee handbook
  4. The risk register Correct answer.

Explanation

The risk register is the central log that captures each risk along with attributes such as owner, rating, and response plan. It supports tracking, reporting, and accountability across the risk lifecycle. Financial statements and policy manuals serve different purposes and do not fulfill this tracking role.

Question 29Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which of the following is a key risk indicator (KRI)?

  1. The percentage of critical systems failing their monthly patch deadline Correct answer.
  2. The number of new products launched last quarter
  3. The company's total annual revenue growth rate
  4. The average tenure of the sales team

Explanation

A key risk indicator is a forward-looking metric that signals rising or falling exposure in a specific risk area. Missed patch deadlines on critical systems directly signal growing vulnerability to exploitation. Revenue growth, product launches, and tenure are performance or staffing measures rather than risk signals.

Question 30Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

What is the primary purpose of a risk heat map?

  1. To replace the risk register with a single graphical summary
  2. To calculate the exact financial loss expected from each individual risk
  3. To display risks visually by likelihood and impact so priorities can be compared Correct answer.
  4. To document the audit trail for every control test performed

Explanation

A heat map plots risks across dimensions such as likelihood and impact, giving decision makers a quick visual comparison of relative priority. It is a communication and prioritization tool rather than a precise loss calculator. It typically complements, rather than replaces, the underlying register.

Question 31Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

What distinguishes a risk from an issue in risk management practice?

  1. A risk is owned by the board, while an issue is owned by external auditors
  2. A risk is always financial, while an issue is always operational
  3. A risk is recorded only annually, while an issue is recorded continuously
  4. A risk is a potential future event, while an issue is a problem that has already occurred Correct answer.

Explanation

A risk describes a possible future event that may affect objectives, whereas an issue is a current problem requiring immediate management attention. The distinction matters because risks are managed prospectively while issues are resolved as they arise. Both can affect objectives but differ in whether the event has already materialized.

Question 32Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which statement describes residual risk?

  1. The exposure that has been fully eliminated through avoidance
  2. The exposure created solely by external regulatory change
  3. The exposure that would exist if every control were removed entirely
  4. The exposure that remains after existing controls and treatments have been applied Correct answer.

Explanation

Residual risk is what remains once current controls and treatments are in place, and it is the level management ultimately accepts or further reduces. It is compared against tolerance to decide whether additional action is needed. If a risk were fully eliminated, no residual exposure would remain.

Question 33Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which role typically holds ultimate accountability for the organization's enterprise risk management framework?

  1. The external insurance broker
  2. The front-line operations staff
  3. The board of directors Correct answer.
  4. The internal audit team

Explanation

The board carries ultimate accountability for overseeing risk management and ensuring the framework is effective. Executive management implements the framework, while assurance functions evaluate it. Front-line staff and external parties contribute but do not hold governing accountability.

Question 34Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk owner is asked to reduce exposure to a supplier dependency. The owner decides to qualify a second supplier while keeping the original. Which risk response does this illustrate?

  1. Avoidance of the activity
  2. Transfer to a third party
  3. Acceptance with no action
  4. Reduction through diversification Correct answer.

Explanation

Adding a second qualified supplier spreads dependence across sources, lowering the likelihood and impact of a single-supplier failure. This is a reduction response because the activity continues while exposure is lowered. Avoidance would mean exiting the dependent activity altogether.

Question 35Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A team scores a risk as likelihood 3 and impact 4 on a 1-5 scale. Using a simple multiplicative model, what score results?

  1. 12 Correct answer.
  2. 1.33
  3. 34
  4. 7

Explanation

A multiplicative scoring model multiplies the likelihood rating by the impact rating, so 3 times 4 yields a score of 12. The product is then compared against predefined thresholds to assign a priority band. Addition and other operations would produce different, non-comparable scales.

Question 36Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk owner reports that a control is documented in policy but staff in two branches routinely bypass it. What is the most appropriate conclusion?

  1. The control is fully effective because the policy has been formally approved
  2. The risk should be closed because a documented control is present
  3. The control exists on paper but its operating effectiveness is not established Correct answer.
  4. The bypasses indicate the risk register should be deleted

Explanation

Design and operating effectiveness are separate considerations: a control can be well designed yet fail in practice. Observed bypasses mean effectiveness is unproven and should be tested and remediated. Closing the risk on the basis of documentation alone would overstate assurance.

Question 37Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An organization sets a risk appetite stating it will accept no risk that could cause a regulatory breach. A proposed initiative carries a small but credible chance of non-compliance. What is the most consistent decision?

  1. Proceed because the probability of breach is low
  2. Decline or redesign the initiative so the regulatory exposure is removed Correct answer.
  3. Proceed and record the exposure as accepted within appetite
  4. Proceed and transfer the regulatory breach to a vendor by contract

Explanation

When appetite explicitly excludes any risk of regulatory breach, even a low-probability exposure falls outside the stated boundary. The consistent response is to redesign or decline so the exposure is eliminated. Low probability does not override a zero-tolerance boundary, and regulatory liability generally cannot be contracted away.

Question 38Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk manager wants to compare the relative priority of a cyber risk and a facilities risk scored on different scales. What is the most useful first step?

  1. Compare the two raw scores directly as if the scales were identical
  2. Average the two scores to produce a single combined priority
  3. Normalize the ratings to a common scale and criteria before comparing Correct answer.
  4. Prioritize the cyber risk because cyber threats are always more severe

Explanation

Scores from different scales or criteria are not directly comparable, so ratings must be normalized to a shared definition before ranking. Otherwise apparent differences may reflect scale artifacts rather than true severity. Averaging unrelated risks also obscures rather than clarifies priority.

Question 39Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

During a risk assessment, a facilitator asks participants to estimate likelihood using historical incident counts rather than intuition. What is the main benefit?

  1. It removes the need to consider impact in the assessment
  2. It guarantees the estimate will be exactly correct
  3. It eliminates the requirement for a risk owner
  4. It grounds estimates in observed data and reduces subjective bias Correct answer.

Explanation

Anchoring likelihood estimates in historical incident data reduces reliance on intuition and improves consistency across assessors. It does not guarantee accuracy, since the future may differ from the past. Impact assessment and ownership remain necessary regardless of the estimation method.

Question 40Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A firm discovers that a single cloud provider hosts its payroll, customer database, and disaster recovery environment. Which risk concept does this most directly raise?

  1. Concentration risk from correlated dependence on one provider Correct answer.
  2. Reputational risk from negative press coverage
  3. Compliance risk from late tax filings
  4. Liquidity risk from short-term cash shortfalls

Explanation

Placing multiple critical functions with one provider creates a single point of failure, so a provider outage would affect all three at once. This correlated dependence is the essence of concentration risk. Reputation, compliance, and liquidity risks may follow but are not the direct issue described.

Question 41Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk register entry lists a risk with an owner and rating but no treatment plan and no target date. What is the most significant weakness?

  1. The risk cannot be actively managed or tracked to closure without a response plan Correct answer.
  2. The owner should be replaced immediately
  3. The risk should be removed from the register
  4. The rating must be wrong because no plan exists

Explanation

Without a treatment plan and target date, there is no defined action or timeline against which progress can be monitored, so the entry becomes a passive record. Ownership and rating alone do not drive mitigation. The remedy is to define a response and due date, not to delete the risk.

Question 42Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Which practice most improves the quality of risk reporting to a board committee?

  1. Providing only the total count of risks on the register
  2. Sharing raw assessment worksheets without interpretation
  3. Reporting every risk at identical priority to avoid omissions
  4. Presenting trends against appetite thresholds with clear ownership and actions Correct answer.

Explanation

Effective board reporting connects exposures to appetite, shows movement over time, and identifies owners and planned actions so the committee can govern. Raw counts or undifferentiated lists provide little decision value. Interpretation and prioritization are what make reporting actionable.

Question 43Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk assessment team finds that a newly identified risk overlaps substantially with an existing register entry. What is the best action?

  1. Keep both entries to increase the apparent coverage of the register
  2. Delete the older entry without review
  3. Escalate both entries to the board for separate decisions
  4. Consolidate the entries and reconcile their ratings and owners Correct answer.

Explanation

Duplicate entries distort reporting and can split accountability, so overlapping risks should be consolidated with ratings and ownership reconciled. Keeping duplicates inflates counts and confuses prioritization. Deleting without review risks losing information that should be merged.

Question 44Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

An analyst estimates a threat occurs with 20% annual probability and would cost $500,000 if it occurs. What is the annualized expected loss?

  1. $2,500,000
  2. $100,000 Correct answer.
  3. $20,000
  4. $500,000

Explanation

Expected loss equals probability multiplied by financial impact, so 0.20 times $500,000 gives $100,000 per year. This figure supports comparison against the cost of controls. It represents a long-run average rather than a prediction for any single year.

Question 45Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A risk manager must decide whether to invest in a control costing $80,000 per year that reduces expected annual loss from $150,000 to $60,000. What is the net annual benefit?

  1. $70,000
  2. $90,000
  3. $10,000 Correct answer.
  4. $150,000

Explanation

The control reduces expected loss by $90,000 per year, and subtracting its $80,000 annual cost leaves a net benefit of $10,000. This comparison supports a cost-benefit justification. A positive but small margin may also prompt review of whether a cheaper control would perform better.

Question 46Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A regulator introduces a new reporting obligation with a fixed deadline. The compliance team has not yet assessed the operational changes required. What is the most appropriate immediate action?

  1. Delegate the obligation entirely to an external auditor
  2. Record the obligation as accepted because it is mandatory
  3. Wait until the deadline approaches to see whether the obligation changes
  4. Perform a focused assessment of the obligation and assign an owner with a timeline Correct answer.

Explanation

A new obligation with a fixed deadline warrants prompt assessment of required changes, clear ownership, and a timeline so that gaps can be closed in time. Deferring assessment compresses the window for remediation. Mandatory obligations still require active management rather than passive acceptance.

Question 47Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

Two risks receive the same composite score, but one has abundant historical data and the other rests on a single expert judgment. How should this difference affect decision making?

  1. The expert-judgment risk should be removed from the register
  2. The scores are equal, so the risks deserve identical treatment without further thought
  3. The data-rich risk should always be ranked lower regardless of score
  4. The less certain estimate warrants more caution or further analysis before reliance Correct answer.

Explanation

Equal point estimates can carry very different levels of confidence, and greater uncertainty argues for caution or additional analysis before committing resources. Ignoring confidence treats a rough guess as equivalent to a well-evidenced estimate. Removing the less certain risk would discard a legitimate exposure.

Question 48Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A quantitative model repeatedly underestimates severe tail losses when tested against historical data. What is the most appropriate response?

  1. Reduce the reported risk figures to align with the model output
  2. Recalibrate the model and apply conservatism or stress testing for tail events Correct answer.
  3. Stop measuring operational losses entirely
  4. Continue using the model unchanged because it performs well on average

Explanation

Systematic underestimation of tail losses signals model weakness that must be corrected through recalibration, more conservative assumptions, or stress testing. Average-case performance does not compensate for understating severe events. Adjusting reported figures to fit a flawed model would compound the error.

Question 49Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A business unit consistently operates at the upper edge of tolerance while claiming full compliance. What does this pattern most likely indicate?

  1. The risk appetite statement is no longer relevant to the organization
  2. The unit may be treating the tolerance limit as a target rather than a boundary Correct answer.
  3. The tolerance is being exceeded and must be reported as a breach
  4. The unit has no risks worth monitoring

Explanation

Operating persistently at the edge of tolerance suggests the limit is being used as an operating target, which inverts its purpose as a boundary that should normally be approached with margin. This warrants review of incentives and monitoring. A breach would mean exceeding the limit, which the scenario does not state.

Question 50Risk Management (CPRM certification body of knowledge; official domain breakdown not published in source)

A board wants evidence that the risk framework operates effectively rather than merely existing. Which evidence is most persuasive?

  1. A board-approved risk policy document
  2. A complete risk register with every field populated
  3. Tested controls, tracked remediation of gaps, and reporting that drives documented decisions Correct answer.
  4. An organization chart showing a risk function

Explanation

Effectiveness is demonstrated by evidence that controls work, gaps are remediated, and risk information influences actual decisions. A populated register, an approved policy, or an org chart shows that elements exist but not that they function. Assurance therefore depends on operational evidence rather than documentation alone.