CRM54 Principles Exam study plan
CRM54 Principles Exam · Give each week a clear focus.
8 weeks · About 6 hours per week
Principles of Risk Management
Define risk, uncertainty, and opportunity, and distinguish each with your own written examples
Explain how risk appetite, tolerance, and capacity differ, and map each to a workplace scenario
Outline the risk management process end to end and label where each later domain fits
Compare at least three frameworks (for example ISO 31000, COSO ERM, ISO 27005) on scope, terminology, and process steps
Your checkpoint
A one-page concept map of the risk management process with every domain of the exam mapped to a stage, plus a 15-term glossary in your own words.
Principles of Risk Management & Risk Treatment and Control
Apply the hierarchy of controls to four different risk scenarios and justify each chosen level
Classify controls as preventive, detective, or corrective and identify gaps in a described control set
Calculate inherent versus residual risk for three scenarios and explain the delta
Evaluate why a control can create new risk and give two concrete examples
Your checkpoint
A control register for a fictional organisation listing eight risks, each with inherent rating, at least two controls, control type, and residual rating.
Risk Identification and Assessment
Select appropriate identification techniques (workshops, interviews, checklists, scenario analysis, bow-tie) for five stated situations
Build a risk statement in cause-event-consequence form for six identified risks
Compare qualitative, semi-quantitative, and quantitative assessment and state when each is defensible
Rate likelihood and impact using a defined matrix and document the rationale for each rating
Your checkpoint
A risk assessment worksheet with ten risks written in cause-event-consequence form, each scored on a 5x5 matrix with written justification.
Risk Financing and Insurance
Distinguish risk retention, transfer, avoidance, and reduction, and match each to a scenario
Explain the purpose and mechanics of insurance, including deductible, limit, and premium relationships
Compare insurance with alternative risk financing such as captives, self-insurance, and contractual transfer
Identify insurable versus uninsurable exposures and justify each classification
Your checkpoint
A risk financing plan for the fictional organisation that assigns a treatment or financing route to each of the ten assessed risks, with cost-benefit reasoning.
Governance, Ethics, and Compliance
Describe the three lines model and assign risk responsibilities to each line in a written example
Explain how governance structures, board oversight, and policy hierarchies interact
Analyse two ethical dilemmas in risk decision-making and recommend a defensible course of action
Outline how regulatory and contractual compliance obligations feed into the risk register
Your checkpoint
A governance brief describing roles, escalation paths, and an ethical decision framework for three dilemma scenarios.
Stakeholder Communication and Reporting & Monitoring, Review, and Continuous Improvement
Draft risk messages tailored to three audiences (board, operational staff, external stakeholders)
Design a risk reporting dashboard with the metrics and indicators each audience needs
Define key risk indicators with thresholds and state how each triggers escalation
Build a monitoring and review cycle that specifies frequency, owner, and inputs for each review
Your checkpoint
A sample quarterly risk report including a dashboard mock-up, three key risk indicators with thresholds, and an escalation protocol.
Monitoring, Review, and Continuous Improvement & Principles of Risk Management & Risk Treatment and Control
Diagnose weaknesses in a risk management programme using a structured maturity or gap assessment
Recommend improvements that address root causes rather than symptoms
Revisit earlier concept maps and correct any misconceptions you now see
Trace how lessons learned from incidents should feed back into identification and control design
Your checkpoint
A gap analysis of the fictional programme with at least six findings, prioritised, each with a corrective action and owner.
Principles of Risk Management & Risk Identification and Assessment & Risk Treatment and Control & Risk Financing and Insurance & Governance, Ethics, and Compliance & Stakeholder Communication and Reporting & Monitoring, Review, and Continuous Improvement
Synthesise all domains into a single integrated risk management framework narrative
Complete two full-length timed practice sets and analyse every error by domain
Re-teach the three weakest areas aloud or in writing without notes
Finalise a one-page recall sheet of formulas, definitions, and process steps
Your checkpoint
A timed mock exam score report by domain plus a one-page recall sheet covering all seven domains.
Milestones
Week 2: Can explain the hierarchy of controls and inherent versus residual risk without notes, scoring at least 80% on a self-written 20-question quiz.
Week 4: Every one of the ten assessed risks has a justified treatment or financing route, and you can defend each choice in two sentences.
Week 6: Can produce a board-ready risk report from a blank page in under 45 minutes with indicators, thresholds, and escalation logic.
Week 8: Score at least 75% on both timed practice sets with no domain below 60%, and complete the recall sheet from memory.