I85PREP
⌘ K
CRM55 study materials
CRM55 study resources

CRM55 practice questions

One question at a time. Build your CRM55 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Fundamentals and Governance

Which statement best defines residual risk?

  1. The risk that is transferred to a third party under a contract
  2. The risk that exists before any controls are applied
  3. The risk that remains after controls and treatments have been applied Correct answer.
  4. The risk that a control fails to operate as it was designed

Explanation

Residual risk is the exposure that remains once existing controls and any additional risk treatments have been applied. Inherent risk measures the exposure before controls, so comparing the two shows how much protection the current control environment actually delivers.

Question 2Risk Management Fundamentals and Governance

Which statement best describes risk appetite?

  1. The amount and type of risk an organization is willing to accept Correct answer.
  2. The documented set of limits applied to each individual business unit
  3. The process of identifying events that could affect the achievement of objectives
  4. The maximum loss the firm could absorb before becoming insolvent

Explanation

Risk appetite expresses how much and what type of risk the organization is willing to take on to pursue its objectives. It is set at the top by the board and then translated into tolerances and limits for individual units and activities.

Question 3Risk Management Fundamentals and Governance

In the three lines model, which group provides independent assurance to the board on how effectively risk is managed?

  1. The board's risk committee
  2. Internal audit Correct answer.
  3. The risk management and compliance function
  4. Operational management that owns and manages risk day to day

Explanation

Under the three lines model, internal audit forms the third line and gives the board independent, objective assurance on the effectiveness of risk management. Operational management owns and manages risk in the first line, while risk and compliance functions provide oversight in the second line.

Question 4Risk Management Fundamentals and Governance

A company purchases a product liability insurance policy that pays claims up to a stated limit. Which risk treatment does this represent?

  1. Risk avoidance
  2. Risk reduction (mitigation)
  3. Risk acceptance
  4. Risk transfer (sharing) Correct answer.

Explanation

Buying insurance shifts a defined portion of the financial consequence of a risk to a third party in exchange for a premium, which is the classic form of risk transfer or sharing. The underlying liability event can still occur; only part of the financial burden is moved.

Question 5Risk Management Fundamentals and Governance

On a 5x5 likelihood-impact matrix, a risk is rated likelihood 4 and impact 5 before controls. A control reduces impact to 2 while likelihood stays at 4. What is the residual score?

  1. 10
  2. 20
  3. 3
  4. 8 Correct answer.

Explanation

Residual scores are calculated using the likelihood and impact that remain after controls, so 4 x 2 = 8. The score of 20 is the inherent rating and is no longer used once the effect of the control has been estimated.

Question 6Risk Management Fundamentals and Governance

Which characteristic is most typical of a well-designed key risk indicator?

  1. It tracks progress against the annual revenue plan
  2. It confirms the size of losses already incurred during the period
  3. It is updated only when the external audit is completed
  4. It provides early warning that risk exposure is approaching a defined threshold Correct answer.

Explanation

Key risk indicators are monitoring metrics chosen because they move ahead of, or alongside, a risk, giving management warning before losses materialize. Each indicator is normally paired with a threshold and an escalation route so that breaches trigger action.

Question 7Risk Management Fundamentals and Governance

What is the primary purpose of a risk register?

  1. To document identified risks together with owners, ratings, and controls Correct answer.
  2. To summarize the external auditor's opinion on internal controls
  3. To publish the organization's quarterly earnings guidance
  4. To record every financial transaction above a set approval threshold

Explanation

A risk register is the central record of identified risks, capturing for each one the description, owner, inherent and residual ratings, related controls, and open actions. It supports monitoring, reporting, and escalation of the organization's overall risk profile.

Question 8Risk Management Fundamentals and Governance

Which activity is a primary responsibility of the board of directors in risk governance?

  1. Conducting independent audits of the risk management framework
  2. Setting risk appetite and overseeing that risk is managed within it Correct answer.
  3. Designing and operating the day-to-day control activities
  4. Preparing the detailed risk register for each business unit

Explanation

The board sets the risk appetite, approves the risk framework, and oversees whether management keeps exposures within the agreed boundaries. It relies on committee reporting and independent assurance but retains ultimate accountability for risk governance.

Question 9Risk Management Fundamentals and Governance

Each business unit reports residual risk within its own appetite, yet the aggregate exposure across the firm exceeds the board's tolerance. What is the most likely explanation?

  1. Risks are assessed in silos without accounting for correlated or cumulative exposures Correct answer.
  2. Internal audit has not yet completed testing of the controls
  3. Each unit applied an inconsistent scoring scale that overstated its own risk
  4. The board's tolerance has simply been set too low for the industry

Explanation

Risks assessed one unit at a time can each sit inside their local tolerance while sharing common drivers, so the combined exposure is larger than the board expects. Aggregating and stress-testing correlated exposures across the portfolio is needed to compare total risk against board tolerance.

Question 10Risk Management Fundamentals and Governance

An auditor finds a control is properly designed to prevent the error, but evidence shows it was not performed during the last quarter. What is the correct conclusion?

  1. The control is not designed effectively but operating effectively
  2. The control is designed effectively but not operating effectively Correct answer.
  3. The control is designed effectively and operating effectively
  4. The control is not designed effectively and not operating effectively

Explanation

Design effectiveness asks whether the control, as specified, would address the risk; operating effectiveness asks whether it actually ran as intended throughout the period. A well-designed control that was not performed is therefore designed effectively but not operating effectively.

Question 11Risk Management Fundamentals and Governance

Which statement best describes inherent risk?

  1. The exposure that exists before any controls or mitigations are applied. Correct answer.
  2. The portion of a risk that has been transferred to a third party under contract.
  3. The risk that remains after management has applied controls and mitigations.
  4. The maximum loss an organization could absorb without breaching its capital plan.

Explanation

Inherent risk, often called gross risk, is measured before any mitigation so that the contribution of controls can be isolated. Comparing it with residual risk shows how much exposure management has actually removed. Transfer and capacity describe different concepts entirely.

Question 12Risk Management Fundamentals and Governance

Which statement best describes risk capacity?

  1. The documented limit assigned to a single business unit for one risk type.
  2. The structured process of identifying, assessing and prioritizing enterprise risks.
  3. The maximum risk an organization can bear before threatening its solvency. Correct answer.
  4. The level of risk an organization is willing to accept in pursuit of its objectives.

Explanation

Risk capacity is the outer boundary of risk an organization can bear and still meet its obligations and strategic goals; it is a constraint rather than a preference. Appetite sits inside that boundary, and limits then allocate appetite to individual units.

Question 13Risk Management Fundamentals and Governance

A retailer discontinues an online payment product because fraud losses cannot be held within tolerance. Which risk treatment has been applied?

  1. Risk acceptance supported by documented monitoring.
  2. Risk avoidance by exiting the payment activity. Correct answer.
  3. Risk transfer through a cyber insurance policy.
  4. Risk reduction through additional fraud screening.

Explanation

Avoidance removes the exposure entirely by not undertaking the activity, which is what withdrawing the product achieves. Reduction, transfer and acceptance all leave some exposure in place and are chosen when management decides to continue the activity with modified risk.

Question 14Risk Management Fundamentals and Governance

What is the primary accountability of a designated risk owner?

  1. To approve the internal audit plan covering the assigned risk area.
  2. To ensure the assigned risk is assessed, treated and monitored within limits. Correct answer.
  3. To independently audit the design and operation of controls mitigating the risk.
  4. To set the organization-wide risk appetite for the risk category involved.

Explanation

A risk owner is accountable for understanding, treating and monitoring a specific risk within the limits set by the board and senior management. Ownership is a management duty, so it does not extend to independent assurance, appetite setting or audit approvals.

Question 15Risk Management Fundamentals and Governance

A monthly reconciliation compares bank statements with the general ledger and flags differences for follow-up. Which control type does this represent?

  1. Preventive control, because it stops errors from entering the ledger.
  2. Detective control, because it finds errors after they occur. Correct answer.
  3. Directive control, because it instructs staff on the correct procedure.
  4. Corrective control, because it restores data after a loss event.

Explanation

Detective controls identify errors or irregularities after they have occurred so that they can be investigated and corrected; a reconciliation is a standard example. Preventive controls stop problems at the point of entry, and corrective controls restore the position once a loss has happened.

Question 16Risk Management Fundamentals and Governance

Which reporting arrangement best supports the independence of a chief risk officer?

  1. Reporting jointly to the chief financial officer and the corporate controller.
  2. Reporting to the internal audit director on a dotted-line basis.
  3. Reporting to the head of the largest revenue-generating business unit.
  4. Reporting administratively to the CEO, with board committee access. Correct answer.

Explanation

Independence is protected when the risk function is not subordinated to a revenue-producing unit and can escalate concerns directly to the board. Administrative reporting to the CEO, combined with unimpeded access to the board risk committee, preserves that line of challenge.

Question 17Risk Management Fundamentals and Governance

A risk team collects judgments from dispersed experts through anonymous questionnaires, shares summarized results and repeats rounds until views converge. Which technique is this?

  1. Control self-assessment with process owners.
  2. Bow-tie analysis linking causes and consequences.
  3. The Delphi technique. Correct answer.
  4. Fault tree analysis of a specific failure.

Explanation

The Delphi technique gathers anonymous expert judgments over successive rounds and feeds back summarized results so individuals can revise their views without group pressure. Fault tree and bow-tie methods are analytic tools, while control self-assessment reviews controls already in place.

Question 18Risk Management Fundamentals and Governance

Which element most makes a risk response plan executable rather than aspirational?

  1. An owner, a due date and a measurable success measure. Correct answer.
  2. A restatement of the organization's overall risk appetite statement.
  3. A list of every control currently applied to the activity.
  4. A narrative description of the risk scenario and its root causes.

Explanation

A response plan becomes actionable when responsibility, timing and a measure of achievement are specified, allowing progress to be tracked to completion. Narrative context and control inventories support the plan but do not by themselves make anyone accountable for delivery.

Question 19Risk Management Fundamentals and Governance

A board approves a market risk appetite that, under stressed conditions, could consume more capital than the firm is able to raise. What is the most important governance conclusion?

  1. The appetite exceeds risk capacity and must be reset lower. Correct answer.
  2. The appetite is properly set because board approval establishes its legitimacy.
  3. The gap should be closed by transferring the excess exposure to an insurer.
  4. The shortfall is acceptable provided the risk is tracked by a key risk indicator.

Explanation

Capacity is the loss-bearing boundary, so an appetite that can breach it under plausible conditions is not a valid preference. The board should reset appetite and its limits so that stressed exposure stays within raiseable capital, then monitor performance against that level.

Question 20Risk Management Fundamentals and Governance

Which pattern of behavior most strongly signals a weak risk culture?

  1. Business units escalate limit breaches promptly and without penalty.
  2. The board reviews a quarterly enterprise risk report with trend analysis.
  3. Limits are frequently breached and exceptions approved retroactively. Correct answer.
  4. Incentive plans include a component tied to risk-adjusted returns.

Explanation

Culture is revealed by what happens when limits bind. Routine breaches tolerated through retrospective approval show that limits, and the appetite behind them, carry no real weight, whatever the reporting calendar or incentive design looks like on paper.

Question 21Risk Management Fundamentals and Governance

Which statement best describes a risk tolerance?

  1. A specific limit within an approved appetite for one risk type Correct answer.
  2. A broad qualitative preference for taking or avoiding risk
  3. The maximum loss the firm could survive without failing
  4. The total capital the board chooses to allocate to new projects

Explanation

Risk tolerance translates the board's broader risk appetite into a concrete boundary for a specific risk category. It gives management a measurable limit for monitoring and escalation.

Question 22Risk Management Fundamentals and Governance

In the three lines model, which activity belongs to the first line?

  1. Internal audit testing the design of financial controls
  2. A risk committee approving the enterprise risk framework
  3. A business unit managing risks in its daily operations Correct answer.
  4. An independent function providing assurance to the board

Explanation

The first line owns and manages risk as part of everyday operations. The second line provides oversight and frameworks, while the third line gives independent assurance.

Question 23Risk Management Fundamentals and Governance

A hotel installs automatic sprinklers and fire-resistant doors to lower the chance and severity of fire damage. Which risk treatment is this?

  1. Risk reduction Correct answer.
  2. Risk avoidance
  3. Risk acceptance
  4. Risk sharing

Explanation

Risk reduction uses controls to lower the likelihood or impact of a loss. Sprinklers and fire doors reduce fire damage rather than exiting the activity or transferring the loss.

Question 24Risk Management Fundamentals and Governance

What is the main governance value of a risk heat map presented to senior management?

  1. It proves that all controls are operating effectively
  2. It ranks risks by relative likelihood and impact to guide prioritization Correct answer.
  3. It replaces the need for qualitative judgment in risk assessment
  4. It documents the precise residual risk value for every risk in the register

Explanation

A heat map plots risks by relative likelihood and impact so management can see clusters and prioritize attention. It supports judgment and discussion; it does not provide precise values or prove control effectiveness.

Question 25Risk Management Fundamentals and Governance

A key risk indicator moves from green to amber. What is the most appropriate immediate response?

  1. Close the indicator because amber is still within appetite
  2. Notify the risk owner and investigate the cause and trend Correct answer.
  3. Wait for the next quarterly board meeting before taking action
  4. Recalculate the indicator using a more favorable formula

Explanation

An amber KRI signals that risk is moving outside the preferred range and needs prompt attention. The risk owner should investigate drivers and escalate according to the approved threshold policy.

Question 26Risk Management Fundamentals and Governance

Which practice most improves the usefulness of a risk register for governance?

  1. Updating the register only when external auditors request it
  2. Recording clear risk owners, causes, controls, and review dates Correct answer.
  3. Limiting entries to risks that have already caused losses
  4. Keeping the register confidential from business unit managers

Explanation

A register is useful for governance when each risk has a clear owner, cause, control linkage, and scheduled review. These fields make accountability and monitoring possible.

Question 27Risk Management Fundamentals and Governance

Which arrangement best supports independent board oversight of risk?

  1. An independent director chairs it and has direct access to the CRO Correct answer.
  2. The risk committee meets once a year with management presenting only favorable results
  3. The internal audit head reports administratively to the chief financial officer
  4. The chief executive chairs the risk committee and sets its agenda alone

Explanation

Independent oversight is strengthened when the committee is chaired by an independent director and can obtain unfiltered information from the CRO. Regular private access helps the board challenge management.

Question 28Risk Management Fundamentals and Governance

When aggregating identical risks across independent business units, assuming perfect positive correlation rather than independence will generally:

  1. Produce a lower aggregate risk estimate
  2. Eliminate the need for diversification analysis
  3. Have no effect on the aggregate estimate
  4. Produce a higher aggregate risk estimate Correct answer.

Explanation

Perfect positive correlation assumes risks move together, so losses are not offset and the aggregate estimate is higher. Independence allows some diversification, producing a lower aggregate estimate.

Question 29Risk Management Fundamentals and Governance

Business units complete a structured self-assessment of their key controls, and internal audit later validates a sample. What is the main benefit of this arrangement?

  1. It transfers control ownership to internal audit
  2. It guarantees that no control failures remain
  3. It removes the need for management assertions
  4. It strengthens business ownership while adding independent validation Correct answer.

Explanation

Self-assessment places control ownership with the business, encouraging timely identification of gaps. Independent validation by audit adds assurance without removing management's responsibility.

Question 30Risk Management Fundamentals and Governance

A board sets an enterprise risk appetite, and each division receives a risk limit. What characteristic makes the cascade coherent?

  1. Each division sets limits independently without reference to the enterprise appetite
  2. Division limits are always set equal to the enterprise appetite
  3. Division limits are based only on prior-year losses
  4. Combined division limits stay within the board's enterprise appetite Correct answer.

Explanation

A coherent cascade allocates the enterprise appetite into divisional limits whose combined exposure does not exceed the board's stated appetite. This links strategy, limits, and monitoring across levels.

Question 31Risk Management Fundamentals and Governance

Which statement best describes residual risk?

  1. The risk that remains after risk responses and controls have been applied. Correct answer.
  2. The amount of risk an organization can bear before insolvency.
  3. The maximum loss an organization is willing to accept without escalation.
  4. The risk that exists before any controls or responses are considered.

Explanation

Residual risk is the exposure left after treatment actions and controls have taken effect. It differs from inherent risk, which is assessed before controls. Governance requires monitoring residual risk against the approved appetite.

Question 32Risk Management Fundamentals and Governance

In the three lines model, which activity is typically performed by the second line?

  1. Approving the organization's overall risk appetite on behalf of owners.
  2. Providing independent assurance on the effectiveness of controls.
  3. Setting risk frameworks and monitoring adherence. Correct answer.
  4. Owning and managing risks within day-to-day operations.

Explanation

The second line provides risk oversight, frameworks, and challenge to the first line. The first line owns and manages operational risks, while the third line gives independent assurance. The board or owners approve the overall risk appetite.

Question 33Risk Management Fundamentals and Governance

A company buys commercial property insurance to cover potential fire losses. Which risk treatment option does this represent?

  1. Avoidance
  2. Acceptance
  3. Transfer Correct answer.
  4. Reduction

Explanation

Insurance transfers the financial consequence of a risk to an insurer, although the underlying risk still exists. Avoidance would eliminate the activity, reduction would lower likelihood or impact, and acceptance would retain the exposure.

Question 34Risk Management Fundamentals and Governance

Which characteristic most strengthens a board risk committee's ability to challenge management?

  1. A majority of independent directors with risk expertise. Correct answer.
  2. The committee delegates all risk decisions to the chief risk officer.
  3. The committee is chaired by the finance director and reports to the audit partner.
  4. The committee includes the chief executive and meets once a year.

Explanation

Independent directors with relevant expertise can question management objectively and test risk information. A committee dominated by executives, meeting infrequently, or delegating decisions to management weakens challenge. Independence and expertise together support effective board oversight.

Question 35Risk Management Fundamentals and Governance

Which feature makes an enterprise risk appetite statement most useful for decision-making?

  1. It is linked to specific metrics, limits, and escalation triggers. Correct answer.
  2. It is revised annually by the chief executive without board involvement.
  3. It is kept confidential to avoid constraining business units.
  4. It uses broad aspirational language that applies to every situation.

Explanation

An actionable appetite translates into measurable boundaries, limits, and triggers that guide decisions. Broad aspirational language cannot be applied consistently, and confidentiality prevents use. Board involvement also strengthens legitimacy and oversight.

Question 36Risk Management Fundamentals and Governance

A payment system requires dual authorization before any transfer above a set threshold is released. Which control type is this?

  1. Detective control
  2. Compensating control
  3. Corrective control
  4. Preventive control Correct answer.

Explanation

Dual authorization stops an unauthorized transaction before it is released, so it is preventive. Detective controls identify problems after they occur, corrective controls remedy them, and compensating controls substitute for another control.

Question 37Risk Management Fundamentals and Governance

Why is a consistent risk taxonomy important for enterprise risk reporting?

  1. It removes the need for risk owners to assess likelihood and impact.
  2. It guarantees that every identified risk will be eliminated.
  3. It ensures that all risks receive identical treatment across the organization.
  4. It enables risks to be aggregated and compared across business units. Correct answer.

Explanation

A common taxonomy gives the organization a shared risk language, which supports aggregation and comparison across units. It does not eliminate risks, replace risk assessment, or require identical treatment. Consistent categorization improves the quality of board and management reporting.

Question 38Risk Management Fundamentals and Governance

A trading desk exceeds its approved risk limit by a small amount late in the day. What is the most appropriate governance response?

  1. Escalate promptly and remediate under policy. Correct answer.
  2. Wait until the monthly risk report to decide whether action is needed.
  3. Ignore the breach because the desk was profitable that day.
  4. Raise the limit retroactively without approval to avoid a breach record.

Explanation

Limit breaches require timely escalation and remediation in line with approved policy. Delaying action, retroactively changing limits, or ignoring profitable breaches undermines the control framework. The response should include reducing the position or obtaining an approved remediation plan.

Question 39Risk Management Fundamentals and Governance

Which governance process best ensures emerging risks receive timely board attention?

  1. Delegating all emerging risk decisions to frontline staff without reporting.
  2. Horizon scanning with escalation criteria and regular board reporting. Correct answer.
  3. Adding every emerging risk to the register without assessing materiality.
  4. Reviewing only risks that have already produced measurable losses.

Explanation

Horizon scanning identifies potential emerging risks early, while escalation criteria filter material items for board attention. Waiting for measurable losses is reactive, and adding every risk without materiality assessment overwhelms reporting. Regular board reporting keeps oversight timely and focused.

Question 40Risk Management Fundamentals and Governance

Which compensation design most undermines a strong risk culture?

  1. Bonuses based mainly on short-term revenue with no risk adjustment. Correct answer.
  2. Scorecards that include risk metrics alongside financial measures.
  3. Rewards for employees who report control weaknesses promptly.
  4. Deferred bonuses subject to malus or clawback for poor risk outcomes.

Explanation

Unadjusted short-term revenue incentives encourage excessive risk-taking and weaken accountability for downstream consequences. Balanced scorecards, deferral, malus, and clawback align rewards with risk outcomes. Rewarding prompt control reporting also supports a healthy risk culture.

Question 41Risk Identification and Exposure Analysis

Which risk identification technique is most appropriate for quickly generating a broad list of potential risks from a diverse group of stakeholders?

  1. A value-at-risk calculation
  2. A facilitated brainstorming session Correct answer.
  3. A trend extrapolation model
  4. A Monte Carlo simulation

Explanation

Brainstorming is a group creativity method that encourages participants to propose many possible risks before judging feasibility. It is used early in risk identification to widen the risk inventory and surface issues across functions. Quantitative models such as Monte Carlo and value-at-risk are applied later to estimate impacts once exposures are defined.

Question 42Risk Identification and Exposure Analysis

In risk management terminology, what is the difference between a hazard and a peril?

  1. A hazard raises the chance or size of a loss; a peril is the cause of loss. Correct answer.
  2. A hazard is the financial consequence of a loss, while a peril is the frequency of the loss.
  3. A hazard is an uncertain event, while a peril is a certain event that produces no uncertainty.
  4. A hazard is the cause of a loss, while a peril is a condition that increases the chance of loss.

Explanation

A hazard is a condition or circumstance that increases the likelihood or severity of a loss, such as poor wiring or icy roads. A peril is the actual cause of the loss, such as fire, theft, or windstorm. Confusing the two can lead analysts to misclassify root causes and controls during exposure analysis.

Question 43Risk Identification and Exposure Analysis

Which statement best describes a pure risk?

  1. A situation whose outcome is guaranteed to be a loss
  2. A situation that offers the chance of both loss and gain
  3. A situation that offers only the chance of loss or no loss Correct answer.
  4. A situation that offers only the chance of gain or no change

Explanation

Pure risk involves only downside outcomes: a loss may occur, or no loss may occur, but there is no possibility of gain. Common examples include fire, liability claims, and equipment failure. Speculative risk, by contrast, involves the possibility of either gain or loss.

Question 44Risk Identification and Exposure Analysis

A risk team wants to gather expert opinions on emerging risks without allowing dominant personalities to influence the group. The experts are geographically dispersed and will respond in several anonymous rounds. Which technique fits best?

  1. Bow-tie analysis
  2. Fault tree analysis
  3. Delphi technique Correct answer.
  4. Nominal group technique with a single face-to-face vote

Explanation

The Delphi technique uses anonymous, iterative questionnaires with controlled feedback so experts can converge on views without face-to-face pressure. It is well suited to dispersed participants and multiple rounds of refinement. Fault tree and bow-tie analyses are structured causal techniques for specific loss events, not anonymous expert polling.

Question 45Risk Identification and Exposure Analysis

A risk analyst uses a SWOT analysis during risk identification. Which element of SWOT most directly highlights internal conditions that could increase exposure?

  1. Weaknesses Correct answer.
  2. Opportunities
  3. Strengths
  4. Threats

Explanation

SWOT separates internal factors, strengths and weaknesses, from external factors, opportunities and threats. Weaknesses are internal conditions that may increase vulnerability or exposure, such as skill gaps or outdated systems. Strengths reduce exposure, while opportunities and threats arise from the external environment.

Question 46Risk Identification and Exposure Analysis

During risk identification for a claims process, a team maps each step, decision point, and handoff to spot where errors or delays could occur. Which technique are they using?

  1. Sensitivity analysis
  2. Capital asset pricing model
  3. Process flowcharting Correct answer.
  4. Regression analysis

Explanation

Process flowcharting visually represents the sequence of steps, decisions, and handoffs so analysts can identify failure points, bottlenecks, and dependencies. It is a qualitative identification tool that reveals where errors or delays may enter a process. Sensitivity, regression, and capital asset pricing are quantitative analytical methods rather than process-mapping techniques.

Question 47Risk Identification and Exposure Analysis

What is the primary purpose of a risk register in the risk identification and exposure analysis process?

  1. To record identified risks, their attributes, and assigned owners for tracking Correct answer.
  2. To replace the need for periodic risk reassessment
  3. To guarantee that identified risks will not occur
  4. To calculate the precise market value of each identified risk

Explanation

A risk register is a central log that captures each identified risk together with attributes such as cause, potential impact, likelihood, controls, owner, and status. It supports monitoring, prioritization, and periodic updates throughout the risk cycle. It is not a valuation model, a substitute for reassessment, or a guarantee against loss.

Question 48Risk Identification and Exposure Analysis

An analyst counts the number of delivery vans, warehouse locations, and employees as part of risk assessment. What are these items called?

  1. Risk control measures
  2. Hazard classifications
  3. Loss reserves
  4. Exposure units Correct answer.

Explanation

Exposure units are the people, property, activities, or values subject to loss that are counted or measured to estimate potential exposure. Counting vans, locations, and employees helps analysts quantify how much value is at risk. Controls, reserves, and hazard categories serve different purposes in risk management.

Question 49Risk Identification and Exposure Analysis

A warehouse contains goods valued at $5 million. A fire could destroy the building and all contents, but the firm also faces a $2 million business interruption loss if operations stop for six months. Which measure represents the maximum possible loss from the fire scenario?

  1. $7 million, combining property damage and business interruption Correct answer.
  2. $5 million, because only physical property is counted
  3. $2 million, because business interruption is the only certain loss
  4. $3 million, representing the net of property and interruption values

Explanation

Maximum possible loss is the worst-case loss assuming all exposed values are affected, including direct property damage and consequential business interruption where relevant. Adding the $5 million property value to the $2 million interruption loss gives a $7 million worst-case exposure. Omitting either component understates the total exposure in this scenario.

Question 50Risk Identification and Exposure Analysis

A firm models a severe but plausible cyber incident by defining a sequence of events, estimating impacts under several assumptions, and comparing outcomes with and without controls. Which risk identification and exposure analysis approach is being used?

  1. Hazard and operability study
  2. Historic loss trending
  3. Compliance checklist review
  4. Scenario analysis Correct answer.

Explanation

Scenario analysis constructs plausible future event sequences and estimates consequences under explicit assumptions, including the effect of controls. It is useful for severe or emerging risks where historical data are limited. Checklist review, historic trending, and HAZOP each use different mechanisms and are not built around hypothetical event narratives.