CRM54 Principles Exam cheat sheet

Risk = combination of the probability of an event and its consequences (ISO Guide 73); pure risk offers only loss or no loss, speculative risk can yield gain or loss.

Risk management is coordinated activities to direct and control an organization with regard to risk; it creates and protects value rather than merely avoiding loss.

Residual risk is the risk remaining after treatment; inherent (gross) risk is measured before controls are applied, so control effectiveness = inherent minus residual.

Three lines model: operating management owns risk (first line), risk and compliance functions monitor and advise (second line), internal audit provides independent assurance (third line).

Risk appetite is the amount of risk an organization is willing to pursue or retain; risk tolerance is the acceptable variation around a specific objective.

Risk capacity is the maximum risk the organization can bear before breaching capital, liquidity, or solvency constraints; appetite must not exceed capacity.

The risk process is iterative: establish context, identify, analyze, evaluate, treat, communicate and consult, monitor and review.

Risk attitude (risk-averse, risk-neutral, risk-seeking) shapes decisions; two organizations with identical exposures may accept different residual risk levels.

Identification techniques include brainstorming, structured interviews, Delphi, SWIFT, HAZOP, FMEA, fault-tree analysis, and process or value-chain mapping.

Risk register fields: risk ID, description, cause, event, consequence, owner, inherent likelihood and impact, controls, residual rating, treatment action, review date.

A cause-event-consequence (bow-tie) structure separates threats and drivers on the left, the event in the center, and impacts on the right from preventive and mitigating barriers.

Qualitative scales (for example 1-5) are ordinal and should not be multiplied as if cardinal; a 5x5 matrix yields a 1-25 score with defined tolerance bands.

Expected loss = probability x impact; for frequency data, annualized loss expectancy = annual rate of occurrence x average loss per event.

Correlation matters: aggregated exposure of correlated risks can far exceed the sum of individually assessed losses; diversification reduces only imperfectly correlated risk.

FMEA scores risk priority number = severity x occurrence x detection; higher detection score means harder to detect, and RPN prioritizes corrective action.

Data quality limits assessment: assumptions, model error, and incomplete historical loss data must be documented as sources of assessment uncertainty.

Four treatment options: avoid, reduce (mitigate), transfer (share), and retain (accept); a fifth, exploit, applies to upside opportunity risk.

Hierarchy of controls, strongest to weakest: eliminate, substitute, engineering controls, administrative controls, then personal protective equipment.

Preventive controls reduce likelihood; detective controls find events after occurrence; corrective controls limit impact and restore operations.

Control cost is justified when marginal reduction in expected loss exceeds marginal control cost; residual risk must still sit within tolerance.

Segregation of duties, dual authorization, reconciliation, and access restriction are classic fraud-prevention controls; a single person controlling an entire transaction is a control gap.

Business continuity uses RTO (time to restore), RPO (acceptable data loss), and MTD (maximum tolerable downtime), where RTO must be shorter than MTD.

Risk transfer via contract (indemnity, hold-harmless, limitation of liability) shifts financial consequence but not all legal or reputational exposure.

Control testing samples transactions to verify design and operating effectiveness; a control that exists on paper but is not performed is a design-versus-operation failure.

Risk financing options: retention (funded or unfunded), insurance, captives, capital markets (catastrophe bonds), and contractual transfer.

Insurable risks are typically pure, measurable, accidental, and independent; speculative, intentional, or unmeasurable risks are generally excluded.

Premium components include expected loss, risk load for volatility, expense load, and profit margin; the pure premium excludes expenses and profit.

Deductible (excess) is the amount the insured pays per claim; a self-insured retention is a first-layer retention before the policy responds.

Coinsurance shares loss proportionally between insurer and insured; a coinsurance clause in property cover penalizes underinsurance relative to insured value.

Policy limits may be per occurrence, aggregate, or sub-limited; reinstatement provisions restore limit after a loss, sometimes for additional premium.

Utmost good faith requires disclosure of material facts; breach can allow the insurer to avoid the policy, and warranties are strict conditions.

Captive feasibility depends on predictable loss frequency, sufficient premium volume, and regulatory capital; captives retain risk and add administration cost.

Governance allocates authority and accountability: the board sets risk appetite and oversight, management executes, and committees monitor specialized exposures.

Independence requires that oversight functions do not report solely to the executives they assess; audit reports functionally to the board or audit committee.

Compliance obligations arise from law, regulation, contract, and voluntary codes; a compliance register maps each obligation to an owner and control.

Three components of the fraud triangle: pressure (incentive), opportunity, and rationalization; reducing opportunity through controls is the most direct lever.

Tone at the top and a speak-up culture reduce concealment; whistleblowing channels should allow anonymous reporting and be independently administered.

Conflicts of interest require disclosure, recusal, and register maintenance; gifts and hospitality policies set monetary thresholds and approval levels.

Codes of conduct state expected behavior; they are effective only when reinforced by training, monitoring, and consistent sanctions for breaches.

Ethical decision tests include the publicity test, the reversibility test, and the stakeholder-impact test; a legal act can still be unethical.

Stakeholder mapping plots power or influence against interest; high-power, high-interest parties need active engagement and detailed reporting.

Risk reporting should be decision-useful: state the exposure, trend versus prior period, tolerance status, and the action owner and due date.

Materiality thresholds determine escalation; incidents above appetite or above a defined financial threshold escalate to the board or committee.

Communication principles: accurate, timely, complete, consistent, and tailored to the audience's technical level and decision needs.

Heat maps communicate likelihood and impact visually but lose detail; they should be accompanied by a register extract for the highest-rated risks.

Key risk indicators are leading or lagging metrics with defined thresholds (green, amber, red) that trigger escalation when breached.

A risk owner is accountable for managing a specific risk; a risk action owner is accountable for delivering a specific treatment; the two roles can differ.

Regulatory and statutory reporting deadlines and prescribed formats override internal preferences; late breach notification can itself be a compliance failure.

Monitoring is continuous checking of controls and indicators; review is periodic reassessment of the risk profile, appetite, and process effectiveness.

Key control indicators track control performance (for example reconciliation completion rate); key risk indicators track exposure levels.

Assurance mapping consolidates first-line self-assessment, second-line compliance testing, and third-line audit to show coverage and gaps across risks.

Incident review uses root-cause analysis (5 Whys, fishbone) to distinguish the immediate cause from underlying system causes.

Lessons learned should update the risk register, control design, training, and appetite thresholds; without a closed loop the same failure recurs.

Benchmarking against peers, industry loss data, and maturity models identifies improvement opportunities beyond internal performance.

Audit findings are tracked to closure with an owner, remediation date, and verification of effectiveness, not merely evidence of a completed action.

The PDCA cycle (plan-do-check-act) and maturity models (for example from ad hoc to optimized) provide structure for continuous improvement.