CRM56 common mistakes
CRM56 · Understand the traps and how to avoid them.
Treating risk appetite, risk tolerance, and risk capacity as interchangeable terms and selecting whichever appears in the answer choice, rather than distinguishing the maximum risk the institution can bear from the risk it chooses to pursue.
The three concepts are introduced together in governance material and sound similar in casual usage, so candidates memorize one definition and apply it to all three stems, especially when the question is phrased around limits or thresholds.
What to do instead
Build a three-column comparison card: capacity (objective ability to absorb loss, driven by capital and liquidity), appetite (broad statement of how much risk the board chooses to accept in pursuit of strategy), tolerance (quantified deviation limits within the appetite). For each practice stem, underline the phrase that signals which concept is being tested before reading the options.
When a scenario describes a sequence of events, naming the hazard or the final loss as the 'risk' instead of identifying the risk as the effect of uncertainty on objectives arising from the event chain.
Everyday language equates risk with bad outcomes, and scenario stems deliberately embed a cause, an event, and a consequence, so candidates latch onto the most vivid element rather than the uncertainty of outcome.
What to do instead
Apply a fixed decomposition to every scenario: driver, event, consequence, and objective affected. Write the risk statement in cause-event-impact form before looking at options, then reject any option that names only a cause or only an impact.
Confusing inherent risk with residual risk, and treating control effectiveness as a property of the control design rather than of how it is actually operating.
Assessment questions frequently present a control that exists on paper but is applied inconsistently, and candidates score it as effective because it is documented, leading them to report residual risk equal to inherent risk or vice versa.
What to do instead
For each scenario, record two separate numbers or ratings: gross exposure before controls and net exposure after controls, with an explicit note on design versus operating effectiveness. If the stem shows evidence of override, workarounds, or untested controls, treat residual risk as closer to inherent risk.
Selecting a risk quantification technique by name recognition rather than by matching the technique to the data available, the distribution shape, and the question being asked, such as using a normal approximation for a fat-tailed operational loss or a simple variance-covariance measure for a non-linear option position.
Candidates memorize technique names and headline formulas but not the assumptions each technique requires, so they default to the most familiar method whenever a calculation appears.
What to do instead
Maintain a technique-selection table with columns for data requirement, distributional assumption, treatment of non-linearity and tails, and typical output. Before computing, state the assumptions the stem violates, and eliminate any technique whose assumptions are broken before doing arithmetic.
Producing a defensible number but failing to state the units, time horizon, confidence level, and whether the figure is gross or net, so the answer is numerically right yet does not answer the question asked.
Under time pressure candidates stop reading the final clause of the stem, and quantification items often differ only in horizon or confidence level while sharing the same underlying inputs.
What to do instead
Adopt a habit of annotating the answer line with four tags: measure, horizon, confidence level, and gross or net basis. Reread the final sentence of the stem after computing and confirm each tag matches what was requested.
Ranking controls by perceived strength rather than by where in the causal chain they act, so a strong detective control is preferred over a weaker preventive control when the question asks how to reduce likelihood.
Candidates evaluate controls on a single good-bad scale and overlook that preventive, detective, and corrective controls affect different parts of the risk equation and different components of expected loss.
What to do instead
Classify every control in the stem as preventive, detective, or corrective, and note whether it reduces frequency, severity, or both. Answer likelihood questions with preventive controls, severity questions with limits and recovery arrangements, and detection questions with monitoring controls.
Treating enterprise risk management framework components as a checklist to be implemented independently, and missing questions about how appetite setting, risk aggregation, and escalation connect across the three lines of defense.
Framework material is studied chapter by chapter, so candidates recall individual elements but not the flow of information and accountability between the board, the business line, the risk function, and internal audit.
What to do instead
Draw the framework as a single flow diagram from board appetite through business-line ownership, independent oversight, and assurance, annotating each arrow with the information that travels along it. Practice explaining one end-to-end scenario aloud using only that diagram.
Confusing probability of default, exposure at default, and loss given default, and applying a recovery rate in the wrong direction when computing expected loss or credit-adjusted pricing.
The three components appear together in formulas, and candidates who memorize expected loss as a single product lose track of which input changes under a collateral, guarantee, or seniority assumption.
What to do instead
Before calculating, write the three components on separate lines and note which stem fact changes each one: credit quality changes default probability, facility usage changes exposure, and collateral or seniority changes loss given default. Sanity-check that adding collateral lowers loss given default and leaves default probability unchanged.
Mixing duration and convexity effects with liquidity and funding concepts, for example answering a large rate-shock question with a short-term liquidity ratio or applying a parallel-shift duration measure to a non-parallel curve change.
Interest rate risk, liquidity risk, and market risk share vocabulary around sensitivity and buffers, and stems that combine a rate move with a funding stress invite candidates to reach for whichever ratio they remember most recently.
What to do instead
Separate the two lenses explicitly: economic value sensitivity answers what the position is worth under a rate change, while liquidity answers whether cash can be raised when due. For each stem, decide which lens the question asks about, then choose between duration, convexity, and gap or ratio measures accordingly.
Labeling conduct, legal, and compliance events as purely operational failures, or vice versa, and therefore choosing the wrong remediation: process redesign versus culture and incentive reform.
The categories overlap in practice, and candidates classify by the visible symptom, such as a loss or a fine, rather than by the underlying cause and the type of control that would have prevented it.
What to do instead
Classify by root cause: failed process, people, or system points to operational risk; deliberate misconduct, mis-selling, or incentive-driven behavior points to conduct and culture; breach of a rule or contractual obligation points to compliance and legal risk. Match the remediation to the root cause, not to the size of the loss.
Treating risk reporting as a formatting exercise and judging a report by its length or polish rather than by whether it is timely, audience-appropriate, forward-looking, and tied to appetite limits with clear escalation triggers.
Candidates read reporting material as a list of report types and recipients, so they miss questions that test the design attributes that make reporting useful to a board or committee.
What to do instead
Evaluate every reporting scenario against four criteria: timeliness relative to the decision, aggregation level suited to the audience, inclusion of forward-looking indicators alongside historical loss data, and an explicit breach and escalation path. Reject options that improve presentation without improving decision usefulness.
Answering ethics and professional standards items by choosing the option that is legally permissible or most profitable for the firm rather than the one consistent with the duty owed to clients, market integrity, and the profession's standards.
Candidates apply a commercial or compliance-minimum frame under exam pressure, and distractors are deliberately written to sound prudent and defensible while still falling short of the standard.
What to do instead
Apply a fixed hierarchy to every ethics stem: client interest and market integrity first, then disclosure and consent, then firm interest. Eliminate any option that relies on silence, on a technicality, or on the client's failure to ask, and prefer the option that documents and escalates the conflict.