CRM55 study guide
CRM55 · Work through your exam, one topic at a time.
CRM55 is a risk management credential aimed at practitioners who must identify, evaluate, and control organizational risk across both traditional and enterprise contexts. It suits risk managers, insurance and finance professionals, operations and compliance staff, and anyone who turns exposure data into decisions senior leaders can act on. The CRM55 study guide has 6 sections and about 1,960 words.
01Risk Management Fundamentals and Governance
Risk management begins with a simple definition: risk is the effect of uncertainty on objectives. That definition matters in questions because it includes upside and downside, and it ties risk to objectives rather than to a list of hazards.
362 words, about 2 min02Risk Identification and Exposure Analysis
Risk identification asks what could happen, why, and where exposure exists. Candidates should know a portfolio of methods: brainstorming, structured interviews, process mapping, checklists, scenario analysis, root-cause analysis, loss-event data, SWOT, Delphi, and lessons learned.
317 words, about 2 min03Risk Control and Loss Prevention
Risk control changes the likelihood or impact of a risk. Candidates must distinguish preventive, detective, and corrective controls, and apply the hierarchy of controls: eliminate, substitute, engineer, administer, and personal protective equipment.
311 words, about 2 min04Risk Financing and Insurance
Risk financing answers how the organization pays for retained losses and protects capital. Candidates should know retention, transfer, insurance, captives, deductibles, self-insured retentions, limits, sublimits, coinsurance, exclusions, and claims-made versus occurrence coverage.
309 words, about 2 min05Enterprise and Operational Risk Management
Enterprise risk management integrates risk with strategy, appetite, capital, and performance. Candidates should understand a risk taxonomy, risk appetite statements, key risk indicators, scenario analysis, stress testing, and risk aggregation.
331 words, about 2 min06Program Administration, Monitoring, and Reporting
A risk program needs governance, policy, procedures, roles, a risk register, reporting cadence, issue management, training, and independent assurance. Candidates should know the difference between a risk owner (accountable for managing the risk) and a control owner (accountable for a control), and should expect every risk to have an owner, an action, and a due date.
330 words, about 2 min