CRM55 common mistakes
CRM55 · Understand the traps and how to avoid them.
Describing a risk owner only as a job title, without stating decision rights, escalation triggers, or reporting duties.
Candidates memorize governance labels such as 'owner' and 'committee' but never practise describing how authority actually flows, so answers sound complete while leaving accountability undefined.
What to do instead
For each major risk, write a one-paragraph ownership statement covering who can approve treatment, what tolerance breach forces escalation, to which committee, and how often the owner reports.
Writing risk register entries as broad categories such as 'cyber risk' or 'supply chain disruption' rather than a cause-event-consequence chain.
Brainstorming produces topic labels that feel sufficient, but labels cannot be assessed, controlled, or monitored consistently.
What to do instead
Rewrite every entry in the form 'cause -> event -> consequence to objective/asset', naming the affected process or asset and the measurable impact.
Selecting controls because they are familiar or commonly listed, without testing feasibility, failure modes, or expected residual effect.
Candidates treat control selection as a matching exercise from a list instead of a design decision involving cost, operating constraints, and human behaviour.
What to do instead
Justify each control with its mechanism, implementation cost, likely failure mode, owner, and expected change in likelihood or impact; reject controls that cannot be operated reliably.
Treating an insurance policy limit as the amount recoverable, while ignoring exclusions, deductibles, sublimits, and conditions.
Candidates read the declarations page and stop, so they miss the clauses that determine whether a loss is covered at all.
What to do instead
Build a coverage map for each major peril listing trigger, key exclusions, limit, sublimit, deductible, and conditions precedent, then test a sample loss against it.
Presenting enterprise risk management as an annual register update disconnected from strategy, budgeting, and operations.
Frameworks are learned as compliance rituals, so candidates describe process steps without linking risk information to decisions.
What to do instead
Connect top risks to specific objectives and KPIs, show where scenario analysis feeds strategy or capital decisions, and name the decision gate that uses the risk output.
Reporting only current risk ratings, without trends, tolerance breaches, action status, or due dates.
Candidates copy the register into a report instead of designing information for a decision-maker who needs to see movement and accountability.
What to do instead
Use a dashboard that pairs each risk with its trend, tolerance threshold, breach status, owner, open action, due date, and next review date.
Using likelihood and impact scales whose level definitions change between assessments, so two raters assign different scores to the same exposure.
The scales look similar numerically, and candidates do not test whether the anchors are concrete enough to produce consistent judgments.
What to do instead
Define each scale level with observable anchors and examples, then calibrate by having several raters score the same cases and reconcile discrepancies.
Assessing risks one by one without considering common causes, correlations, or concentration across the portfolio.
Registers are organized by individual risk, so candidates overlook that several risks can be triggered by the same supplier, system, or scenario.
What to do instead
Group risks by shared driver and run scenario or common-cause analysis; state where diversification reduces aggregate exposure and where concentration increases it.
Using 'inherent', 'current', 'residual', and 'target' risk interchangeably in the same answer.
The terms appear in framework material, but candidates do not rehearse the calculation path from gross exposure through controls to remaining and desired exposure.
What to do instead
Define each term explicitly and show the sequence: gross rating, controls applied, residual rating with evidence, target rating, and gap requiring further treatment.
Documenting that monitoring occurred without retaining evidence of the check, the decision made, or the follow-up action.
Candidates focus on completing forms rather than creating an auditable trail, so program administration answers lack proof of operation.
What to do instead
Record date, reviewer, evidence examined, conclusion, decision, action owner, and next review for every monitoring activity, and maintain version control.