CRM54 Principles Exam common mistakes
CRM54 Principles Exam · Understand the traps and how to avoid them.
Treating risk as synonymous with hazard or uncertainty, so answers describe a danger (e.g., 'a fire') or a knowledge gap rather than the effect of uncertainty on objectives.
Everyday usage blurs the terms, and candidates memorise a one-line definition without applying the effect-on-objectives test to scenario options.
What to do instead
Before answering, restate the stem as 'uncertainty about [event] affecting [objective]'. Eliminate any option that names only a source or a probability without an outcome on objectives.
Confusing inherent, current (residual), and target risk levels when a question asks which figure to report or compare.
The three baselines are learned as labels, and candidates default to whichever number appears in the stem rather than identifying which baseline the question names.
What to do instead
Build a three-column table (inherent / current / target) with a one-line definition and a worked example each, and underline in each practice stem the words that signal the baseline (e.g., 'before controls', 'as operated today', 'desired').
Selecting likelihood-and-consequence matrix ratings as if they were objective measurements, ignoring that scores are judgement-based and depend on defined scales and calibration.
Matrices look quantitative, so candidates treat a 'high/high' cell as a precise finding and miss options about scale definition, calibration, or assessor bias.
What to do instead
Practise questions that ask what weakens a matrix result; memorise that scales need defined criteria, consistent application, and validation, and prefer answers referencing calibration or documented rationale over answers treating scores as facts.
Mixing up the control types (preventive, detective, corrective, directive) and placing a control in the wrong layer, e.g., calling reconciliation a preventive control.
Controls are memorised as a list rather than by the timing question 'before, during, or after the event?', and exam options use plausible synonyms.
What to do instead
For every control in a question, ask when it acts relative to the event. Drill a sort exercise with 20 controls into the four layers until classification is automatic, and note that many real controls combine layers.
Recommending additional controls as the default treatment for every risk, ignoring avoid, transfer, share, and accept, or accepting a risk without stating authority and rationale.
Candidates equate 'risk management' with 'add a control', and acceptance is often treated as doing nothing rather than a documented, authorised decision.
What to do instead
Run a four-option checklist (avoid, reduce, transfer/share, accept) against each scenario before choosing, and require any acceptance answer to include named authority, rationale, and review trigger.
Confusing risk financing with risk control, or selecting insurance as the answer to a question about reducing the frequency or severity of loss.
Insurance is the most familiar financing tool, and candidates conflate the financial consequence with the physical event.
What to do instead
Separate the two questions: 'does this change the chance or size of the event?' (control) versus 'does this fund the consequence after the event?' (financing). Apply the test to each option before selecting.
Treating insurance as complete protection, overlooking exclusions, deductibles, limits, sub-limits, warranties, and the duty of disclosure.
Candidates reason from the headline cover name rather than the policy mechanics, and scenario stems often bury a condition in a single clause.
What to do instead
For any insurance question, list the five mechanics (cover, exclusion, deductible, limit, condition) and check the stem against each. Memorise that undisclosed material facts can void or reduce a claim.
Describing the three lines model as a hierarchy of who owns risk, or assigning risk ownership to internal audit or the risk function.
The word 'lines' suggests seniority, and candidates default to the risk team owning risk because it coordinates the framework.
What to do instead
Memorise the ownership rule: the first line owns and manages risk, the second provides oversight, challenge, and framework, the third provides independent assurance. Any option giving ownership or assurance to the same function should be rejected.
Producing risk reports that list raw risks and scores without linking them to objectives, appetite, trend, or agreed actions, and treating reporting as a one-way broadcast.
Candidates focus on demonstrating that risks were identified rather than on whether the report supports a decision, and stakeholder engagement is treated as an optional extra.
What to do instead
Structure every report answer as objective, appetite position, movement since last period, and decision required. For communication questions, include audience, channel, frequency, and a feedback loop.
Treating monitoring and review as a one-off annual exercise, or failing to distinguish monitoring (ongoing tracking of controls and indicators) from review (periodic reassessment of the risk profile and framework).
The two terms appear together so often that candidates merge them, and continuous improvement is recalled as a slogan rather than a cycle with triggers and owners.
What to do instead
Memorise the pairing: monitoring tracks indicators, controls, and incidents continuously; review reassesses assumptions, ratings, and framework effectiveness at set intervals or on trigger events. For improvement questions, name the trigger, the owner, and how the change is verified.