I85PREP
⌘ K
CRM54 Principles Exam study materials
CRM54 Principles Exam study resources

CRM54 Principles Exam practice questions

One question at a time. Build your CRM54 Principles Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Principles of Risk Management

Which statement best defines risk in the context of risk management?

  1. The total cost of insurance premiums
  2. The effect of uncertainty on objectives Correct answer.
  3. The guarantee that a project will fail
  4. The list of hazards found on a site

Explanation

Risk is defined as the effect of uncertainty on objectives, combining the likelihood of an event with its consequences. It can be positive or negative, so it is not limited to hazards or financial losses.

Question 2Principles of Risk Management

In a risk matrix, what two dimensions are typically combined?

  1. Cost and schedule
  2. Owner and reviewer
  3. Cause and control
  4. Likelihood and consequence Correct answer.

Explanation

A risk matrix plots likelihood against consequence (severity) to produce a risk rating. This rating helps prioritize which risks need attention first.

Question 3Principles of Risk Management

What is the primary purpose of a risk register?

  1. To store the organization's financial statements
  2. To record identified risks with their ratings, owners, and responses Correct answer.
  3. To document employee attendance records
  4. To list only risks that have already occurred

Explanation

A risk register is the central log capturing each identified risk, its assessment, assigned owner, and planned response. It supports monitoring and review throughout the risk lifecycle.

Question 4Principles of Risk Management

Which risk response involves taking action to reduce the likelihood or impact of a risk?

  1. Avoidance
  2. Transfer
  3. Acceptance
  4. Mitigation Correct answer.

Explanation

Mitigation (reduction) lowers either the probability of the risk occurring or the severity of its consequences. It is distinct from accepting, transferring, or avoiding the risk entirely.

Question 5Principles of Risk Management

What does risk appetite describe?

  1. The maximum number of risks a register can hold
  2. The total budget assigned to insurance
  3. The amount of risk an organization is willing to pursue or retain Correct answer.
  4. The speed at which risks are closed

Explanation

Risk appetite expresses the level of risk an organization is prepared to accept in pursuit of its objectives. It guides decisions about which risks to take and how much treatment is warranted.

Question 6Principles of Risk Management

Which of these is an example of risk transfer?

  1. Deciding to tolerate a minor risk
  2. Purchasing an insurance policy Correct answer.
  3. Installing a fire suppression system
  4. Cancelling a planned product launch

Explanation

Transfer moves the financial consequences of a risk to a third party, and insurance is the classic example. The underlying risk still exists, but another party bears the loss.

Question 7Principles of Risk Management

What is an inherent risk?

  1. The risk owned by the board only
  2. The risk that has already been realized
  3. The risk remaining after controls are applied
  4. The risk level before any controls are applied Correct answer.

Explanation

Inherent risk is assessed as if no controls exist, providing a baseline for comparison. Comparing it with residual risk shows how much controls actually reduce exposure.

Question 8Principles of Risk Management

Which activity comes first in the risk management process?

  1. Monitoring and reviewing controls
  2. Establishing context and identifying risks Correct answer.
  3. Recording residual risk levels
  4. Treating the highest-rated risks

Explanation

Risk management begins by establishing the organizational context and then identifying the risks that could affect objectives. Assessment, treatment, and monitoring follow these initial steps.

Question 9Principles of Risk Management

A project team rates a supplier failure as likely and highly severe, then decides to dual-source critical components. Which step of risk management does dual-sourcing represent?

  1. Risk treatment Correct answer.
  2. Risk monitoring
  3. Context establishment
  4. Risk identification

Explanation

Dual-sourcing is a deliberate action that reduces the impact of a supplier failure, making it a treatment (mitigation) response. Treatment follows the assessment that rated the risk highly.

Question 10Principles of Risk Management

Why is a risk owner assigned to each entry in a risk register?

  1. To guarantee the risk will never occur
  2. To eliminate the need for any further risk review
  3. To transfer legal liability to that individual
  4. To ensure accountability for monitoring and responding to that risk Correct answer.

Explanation

A named owner provides clear accountability for watching the risk and executing the agreed response. Ownership supports follow-through but does not remove the need for periodic review.

Question 11Principles of Risk Management

What distinguishes residual risk from inherent risk?

  1. Residual risk is measured only in financial terms
  2. Residual risk always equals zero once treated
  3. Residual risk is what remains after controls are applied Correct answer.
  4. Residual risk applies only to insurance policies

Explanation

Residual risk is the exposure left after existing controls and treatments take effect. It is compared against risk tolerance to decide whether further action is needed.

Question 12Principles of Risk Management

A company sets a threshold stating that any risk rated above a defined level must be escalated to senior management. What does this threshold represent?

  1. A risk tolerance limit Correct answer.
  2. A residual risk register
  3. A risk identification technique
  4. A control testing schedule

Explanation

A risk tolerance limit defines the boundary beyond which exposure is unacceptable without escalation or action. Risks exceeding it trigger management attention.

Question 13Principles of Risk Management

Which technique is most associated with gathering expert opinion to estimate risk likelihood and impact?

  1. Benchmarking
  2. Delphi method Correct answer.
  3. Pareto charting
  4. Fishbone diagramming

Explanation

The Delphi method collects and iteratively refines expert judgments anonymously to reach consensus estimates. It is well suited to quantifying likelihood and impact where data is scarce.

Question 14Principles of Risk Management

A risk has low likelihood but catastrophic impact. Which response is often most appropriate?

  1. Accept it silently, because it is unlikely
  2. Increase the likelihood deliberately
  3. Transfer or mitigate, because the impact is severe Correct answer.
  4. Ignore it, because probability is low

Explanation

Low-probability, high-impact risks can be devastating when they occur, so organizations typically seek transfer (such as insurance) or mitigation. Low likelihood alone does not justify ignoring severe consequences.

Question 15Principles of Risk Management

What is the main benefit of maintaining a risk heat map?

  1. It eliminates the need for risk owners
  2. It calculates the exact financial loss of each risk
  3. It replaces the need for a risk register
  4. It visually prioritizes risks by likelihood and impact Correct answer.

Explanation

A heat map presents risks in a grid so that high-likelihood, high-impact items stand out for priority action. It supports communication and prioritization but does not replace detailed records.

Question 16Principles of Risk Management

Which statement about opportunity risk is correct?

  1. Risk can include positive outcomes as well as threats Correct answer.
  2. Opportunities never require any response
  3. Risk refers only to negative events
  4. Opportunities are excluded from risk registers

Explanation

Modern risk definitions treat risk as the effect of uncertainty on objectives, which includes both threats and opportunities. Organizations may choose to pursue positive risks to gain advantage.

Question 17Principles of Risk Management

What role does a control play in risk management?

  1. It documents the organization's profit margin
  2. It guarantees the risk is fully eliminated
  3. It replaces the need to assess risk
  4. It modifies the likelihood or impact of a risk Correct answer.

Explanation

A control is any measure that modifies risk by reducing likelihood, reducing impact, or both. Controls are assessed for effectiveness, but they rarely eliminate risk entirely.

Question 18Principles of Risk Management

A manager decides to stop offering a hazardous service entirely rather than manage its risks. Which response has been chosen?

  1. Mitigation
  2. Acceptance
  3. Transfer
  4. Avoidance Correct answer.

Explanation

Avoidance removes the activity that generates the risk, so the exposure no longer exists. It differs from reducing, tolerating, or shifting the risk to another party.

Question 19Principles of Risk Management

Why is risk monitoring an ongoing activity rather than a one-time event?

  1. Risk levels change as internal and external conditions evolve Correct answer.
  2. Monitoring is required only for financial risks
  3. Risks disappear permanently once first assessed
  4. Controls never change after implementation

Explanation

Risk exposure shifts as circumstances, controls, and objectives change, so ratings must be revisited. Continuous monitoring ensures responses stay relevant and effective.

Question 20Principles of Risk Management

What is the relationship between risk likelihood and risk impact in determining overall risk level?

  1. Overall risk level depends only on likelihood
  2. Overall risk level depends only on impact
  3. Overall risk level is unrelated to either factor
  4. Overall risk level combines both likelihood and impact Correct answer.

Explanation

Overall risk level is derived from both the probability of occurrence and the severity of consequences. A high score on either dimension can raise the overall rating.

Question 21Principles of Risk Management

A firm buys a warehouse that sits on a known floodplain and decides to self-fund any flood damage instead of insuring it. Which response is this?

  1. Transfer
  2. Avoidance
  3. Acceptance Correct answer.
  4. Mitigation

Explanation

Self-funding a known exposure without changing the activity is acceptance of the risk. The organization retains the consequences rather than avoiding, transferring, or reducing them.

Question 22Principles of Risk Management

In risk analysis, what is the purpose of a sensitivity analysis?

  1. To determine how changes in one variable affect outcomes Correct answer.
  2. To record customer complaints
  3. To calculate the total number of risks in a register
  4. To list all employees with access to systems

Explanation

Sensitivity analysis tests how variation in a key input changes the overall result, revealing which variables most influence outcomes. This helps focus attention on the most impactful uncertainties.

Question 23Principles of Risk Management

An organization compares the cost of a control against the reduction in expected loss it delivers. What concept is being applied?

  1. Control self-assessment
  2. Risk avoidance
  3. Cost-benefit analysis of risk treatment Correct answer.
  4. Risk appetite statement

Explanation

Cost-benefit analysis weighs the expense of a treatment against the expected reduction in loss to judge whether it is worthwhile. Treatments whose cost exceeds the benefit they deliver are generally not justified.

Question 24Principles of Risk Management

Which situation best illustrates correlation between two risks that should be considered in aggregate exposure?

  1. Two suppliers located in the same flood-prone region Correct answer.
  2. Two suppliers in separate countries with unrelated operations
  3. A single supplier with a strong continuity plan
  4. A supplier whose contract renews annually

Explanation

Risks are correlated when a single event can trigger both simultaneously, as with suppliers in the same flood zone. Aggregating correlated exposures prevents underestimating total impact.

Question 25Principles of Risk Management

A team uses historical loss data to estimate the frequency of a recurring operational failure. Which approach does this describe?

  1. Quantitative risk assessment Correct answer.
  2. Scenario brainstorming
  3. Delphi consensus
  4. Qualitative risk assessment

Explanation

Quantitative assessment uses numerical data, such as historical frequencies, to estimate likelihood and impact. Qualitative methods rely on descriptive scales and expert judgment instead.

Question 26Principles of Risk Management

Which term describes the possibility of loss or injury arising from uncertainty?

  1. Exposure
  2. Risk Correct answer.
  3. Hazard
  4. Peril

Explanation

Risk is the fundamental concept in risk management, defined as the effect of uncertainty on objectives, often expressed as the possibility of loss or injury. It encompasses both the likelihood of an event and its potential consequences.

Question 27Principles of Risk Management

In risk management, what does the term 'likelihood' refer to?

  1. The financial impact if a risk event occurs
  2. The probability that a risk event will occur Correct answer.
  3. The number of risk events that have already occurred
  4. The speed at which a risk event unfolds

Explanation

Likelihood is a key dimension of risk assessment that measures the chance or probability of a risk event happening within a given timeframe. It is often combined with impact to determine overall risk level.

Question 28Principles of Risk Management

Which of the following best describes a risk appetite?

  1. The amount and type of risk an organization is willing to pursue or retain Correct answer.
  2. The maximum level of risk that can be tolerated before breaching a limit
  3. The total value of assets exposed to risk
  4. The process of identifying and assessing risks

Explanation

Risk appetite is the broad amount and type of risk an organization is willing to accept in pursuit of its objectives. It sets the tone for risk-taking and guides the setting of more specific risk tolerances and limits.

Question 29Principles of Risk Management

A company decides to implement additional security controls to reduce the likelihood of a data breach. Which risk response strategy is this?

  1. Risk mitigation Correct answer.
  2. Risk avoidance
  3. Risk transfer
  4. Risk acceptance

Explanation

Risk mitigation involves taking actions to reduce the likelihood or impact of a risk. Implementing additional controls is a classic mitigation strategy because it lowers the probability of the breach occurring.

Question 30Principles of Risk Management

When assessing risk, why is it important to consider both likelihood and impact?

  1. Because a risk's overall significance depends on the combination of how often it might occur and how severe the consequences would be Correct answer.
  2. Because likelihood alone determines the need for insurance
  3. Because they are independent and cannot be combined
  4. Because impact alone determines the priority of risk treatment

Explanation

Risk is typically evaluated as a function of likelihood and impact. A high-likelihood, low-impact risk may be less significant than a low-likelihood, high-impact risk, so both dimensions must be weighed together to prioritize risks and allocate resources effectively.

Question 31Principles of Risk Management

Which of the following is an example of a key risk indicator (KRI)?

  1. The number of customer complaints received per month Correct answer.
  2. The average age of the workforce
  3. The total revenue of the company
  4. The number of employees in the risk department

Explanation

A key risk indicator is a metric that provides early warning of increasing risk exposure. Customer complaints per month can signal rising operational or reputational risk, making it a KRI. Other options are general business metrics not directly tied to risk trends.

Question 32Principles of Risk Management

What is the role of a risk owner?

  1. To set the organization's risk appetite
  2. To be accountable for managing a specific risk and its response Correct answer.
  3. To conduct internal audits of risk controls
  4. To provide legal advice on risk issues

Explanation

A risk owner is an individual accountable for managing a particular risk, including implementing and monitoring the chosen response. This accountability ensures that risks are actively managed rather than just identified.

Question 33Principles of Risk Management

A project manager identifies a risk that the key supplier might go bankrupt. She decides to find an alternative supplier as a backup. Which risk response is this?

  1. Risk mitigation Correct answer.
  2. Risk acceptance
  3. Risk transfer
  4. Risk avoidance

Explanation

Finding a backup supplier reduces the impact or likelihood of disruption from the primary supplier's failure, which is a mitigation strategy. It does not eliminate the risk entirely but lessens its consequences.

Question 34Principles of Risk Management

Which statement best describes the concept of residual risk?

  1. The risk that exists before any controls are applied
  2. The risk that is transferred to a third party
  3. The risk that remains after risk responses have been implemented Correct answer.
  4. The risk that is deemed unacceptable by management

Explanation

Residual risk is the level of risk remaining after controls and responses have been applied. It is the risk that the organization still faces and must monitor.

Question 35Principles of Risk Management

In the context of risk management, what is a 'black swan' event?

  1. A risk that is always ignored by management
  2. A rare and unpredictable event with severe consequences Correct answer.
  3. A common and easily forecasted risk
  4. A risk that is fully insured

Explanation

A black swan event is characterized by its rarity, high impact, and retrospective predictability. Such events are often outside the realm of regular expectations and can have catastrophic effects.

Question 36Principles of Risk Management

A company uses a risk matrix to prioritize risks. Which of the following best explains why a risk with high likelihood and low impact might be ranked lower than a risk with low likelihood and high impact?

  1. Because high-likelihood risks are always easier to manage
  2. Because risk matrices ignore likelihood
  3. Because the potential severity of the high-impact risk outweighs the frequency of the low-impact risk Correct answer.
  4. Because low-impact risks are never worth addressing

Explanation

Risk matrices combine likelihood and impact to produce a risk score. A low-likelihood, high-impact risk can have a higher score than a high-likelihood, low-impact risk if the potential severity is great enough, reflecting the greater potential loss.

Question 37Principles of Risk Management

What is the primary benefit of conducting a risk assessment workshop with cross-functional participants?

  1. It guarantees that all risks will be mitigated
  2. It transfers risk to the participants
  3. It eliminates the need for a risk register
  4. It brings diverse perspectives to identify and evaluate risks more comprehensively Correct answer.

Explanation

A cross-functional workshop leverages varied expertise and viewpoints, leading to a more thorough identification and assessment of risks. This collaborative approach helps uncover risks that might be missed by a single department.

Question 38Principles of Risk Management

Which of the following best illustrates the concept of risk correlation?

  1. Two risks that tend to occur together due to a common cause Correct answer.
  2. Two risks that are both transferred to the same insurer
  3. Two risks that have the same risk owner
  4. Two risks that are completely independent

Explanation

Risk correlation occurs when two or more risks are linked, often because they share a common trigger or causal factor. This means they may materialize simultaneously, leading to compounded impacts that should be considered in aggregate.

Question 39Principles of Risk Management

In risk management, what does the 'precautionary principle' suggest when scientific evidence is uncertain but the potential harm is serious or irreversible?

  1. Wait for conclusive evidence before acting
  2. Proceed with the activity but monitor closely
  3. Take preventive action even without full certainty Correct answer.
  4. Transfer the risk to a third party

Explanation

The precautionary principle holds that when an activity raises threats of harm to human health or the environment, precautionary measures should be taken even if some cause-and-effect relationships are not fully established scientifically. It shifts the burden of proof to those proposing the activity.

Question 40Principles of Risk Management

Which of the following best describes the concept of 'risk velocity'?

  1. The frequency of risk assessments
  2. The rate at which risks are identified
  3. The speed at which a risk event can impact the organization Correct answer.
  4. The amount of risk that is transferred

Explanation

Risk velocity refers to how quickly a risk event can affect an organization once it occurs. It is an important consideration because a fast-moving risk may require more immediate response and can have greater impact than a slower-onset risk.

Question 41Risk Identification and Assessment

In risk management, which term describes the possibility of loss or injury resulting from an uncertain event?

  1. Compliance
  2. Control
  3. Risk Correct answer.
  4. Assurance

Explanation

Risk is defined as the effect of uncertainty on objectives, commonly expressed as the possibility of loss, injury, or other adverse outcome. It combines the likelihood of an event with its potential consequences. Controls, compliance, and assurance are responses to or evaluations of risk rather than risk itself.

Question 42Risk Identification and Assessment

Which component of a risk statement identifies what could go wrong if a threat exploits a weakness?

  1. The event Correct answer.
  2. The appetite statement
  3. The residual level
  4. The control owner

Explanation

A well-formed risk statement pairs a cause with an event and a consequence, where the event is the occurrence that could harm objectives. The event links the underlying threat and vulnerability to the resulting impact. Residual level, appetite, and control ownership are governance attributes recorded alongside the risk, not the event itself.

Question 43Risk Identification and Assessment

A team records the chance that a key supplier fails to deliver within a quarter and the cost that would follow. Which two dimensions are being assessed?

  1. Inherent and residual
  2. Velocity and duration
  3. Appetite and tolerance
  4. Likelihood and impact Correct answer.

Explanation

Risk assessment commonly rates each risk on likelihood, how probable the event is, and impact, how severe the consequence would be. The supplier failure probability maps to likelihood and the resulting cost maps to impact. Velocity, duration, appetite, and residual levels are separate attributes or governance concepts.

Question 44Risk Identification and Assessment

What is the primary purpose of maintaining a risk register?

  1. To document completed internal audit fieldwork
  2. To list every employee who handles customer data
  3. To record and track identified risks with their ratings and owners Correct answer.
  4. To publish the annual financial statements

Explanation

A risk register is the central record of identified risks, capturing descriptions, ratings, owners, controls, and treatment status so they can be monitored and reported. It supports consistent tracking and accountability across the risk portfolio. Audit fieldwork, staff inventories, and financial statements serve different purposes.

Question 45Risk Identification and Assessment

Which risk category covers losses arising from failed internal processes, people, systems, or external events?

  1. Reputational risk
  2. Strategic risk
  3. Market risk
  4. Operational risk Correct answer.

Explanation

Operational risk is defined as the risk of loss from inadequate or failed internal processes, people, systems, or external events. It focuses on execution failures rather than market movements or long-term strategic choices. Strategic, market, and reputational risks each address different sources of exposure.

Question 46Risk Identification and Assessment

Which technique gathers structured expert opinion through anonymous rounds with feedback between rounds?

  1. SWOT analysis
  2. Brainstorming
  3. Fault tree analysis
  4. Delphi method Correct answer.

Explanation

The Delphi method collects expert judgments anonymously over several rounds, summarizing and sharing results between rounds so opinions can converge without pressure from dominant participants. Brainstorming is typically a single open group session. SWOT and fault tree analysis are structured analytical frameworks rather than iterative opinion surveys.

Question 47Risk Identification and Assessment

In a typical five-by-five risk matrix, what does the position of a risk indicate?

  1. The number of controls applied to it
  2. The seniority of its owner
  3. Its combined likelihood and impact rating Correct answer.
  4. The date it was last reviewed

Explanation

A risk matrix plots likelihood against impact, and a risk's cell position represents the combined severity rating used to prioritize attention. The grid converts two ordinal scales into a single comparative score. Control counts, review dates, and owner seniority are metadata that do not determine the plotted position.

Question 48Risk Identification and Assessment

Which statement best describes residual risk?

  1. The exposure remaining after existing controls are taken into account Correct answer.
  2. The risk that remains unidentified after a full assessment
  3. The exposure before any controls are considered
  4. The maximum loss the organization could ever suffer

Explanation

Residual risk is the level of risk that remains once current controls and mitigations have been applied. It is contrasted with inherent risk, which is assessed before controls. Maximum possible loss and unidentified risk are different concepts entirely.

Question 49Risk Identification and Assessment

A risk assessment team rates likelihood on a five-point scale and impact on a five-point scale, then multiplies the two scores. What is the main limitation of this scoring approach?

  1. It cannot produce a score for risks with low impact
  2. The multiplication implies a precision and equal spacing that ordinal scales do not truly have Correct answer.
  3. It prevents the use of a risk matrix entirely
  4. It requires that all risks have identical controls

Explanation

Multiplying ordinal ratings treats subjective categories as if they were equally spaced cardinal numbers, which can exaggerate small differences and create false precision. The resulting scores are useful for ranking but should not be interpreted as precise quantitative values. The method still works for low-impact risks and is the basis of many matrices.

Question 50Risk Identification and Assessment

An analyst assesses a data breach risk as high before considering encryption and access controls, then reassesses it as medium afterward. Which two concepts do these assessments illustrate?

  1. Inherent risk and residual risk Correct answer.
  2. Appetite and capacity
  3. Detection and response
  4. Likelihood and velocity

Explanation

The pre-control assessment is inherent risk, reflecting exposure if nothing were in place, while the post-control assessment is residual risk. Comparing the two shows the effect of the encryption and access controls. Likelihood, velocity, appetite, and capacity are distinct attributes or thresholds.