CSRM common mistakes
CSRM · Understand the traps and how to avoid them.
Treating 'risk' as synonymous with 'hazard' and picking the answer that names a physical condition (a broken stair, a bus route) when the stem asks which element of risk is present.
Candidates memorize the risk vocabulary casually and default to the most concrete noun in the options. The exam defines risk as a combination of the probability of an event and its consequences, and distinguishes hazard (source of harm), peril (cause of loss), and exposure (what is at stake). Choosing the tangible object feels safer than choosing an abstraction.
What to do instead
Before reading the options, restate the stem in one line: is it asking about a source of harm, a cause of loss, a chance of loss, or the thing that can be lost? Drill with paired scenarios - same school, same broken stair, four different question stems - until the vocabulary maps to the exact element rather than to the object. When two options describe the same physical thing, the discriminator is always the definitional category, not the description.
Answering uncertainty questions with the pure 'chance of loss' definition and rejecting answers that include 'deviation from expected outcomes', even when the stem involves upside or variability.
Many candidates learn one short definition and stop. Exam stems that describe a field trip that could go better or worse than planned, or a budget that could over- or under-perform, are testing the variability framing, and the short definition makes those options look wrong.
What to do instead
Hold both framings explicitly: risk as the chance of an unfavorable outcome, and risk as variability around an expected result. Sort practice stems into 'pure downside' and 'variability' bins before choosing. If the stem mentions both favorable and unfavorable departures from plan, the variability framing is the intended one.
Misclassifying a loss as indirect when the stem describes lost instructional time, reputational damage, or a drop in enrollment after an incident, and choosing the direct-cost option because the incident itself was physical.
Candidates anchor on the triggering event (a fire, an injury) and assume everything downstream is also direct. The distinction is about causal distance from the event, not about whether the consequence is tangible, and consequential losses like lost productivity or reputation are easy to overlook.
What to do instead
Build a two-column list for each scenario type: costs that flow immediately from repairing or replacing the damaged property, versus costs that flow from the interruption, the response, or the changed perception. Practice labeling the same event (a boiler failure) with four to six consequences and assigning each to direct or indirect. On the exam, ask 'would this line item exist if the property were restored instantly?' - if not, it is indirect.
Selecting the risk-control technique by the label that sounds most thorough (usually 'avoidance') instead of matching the technique to the actual exposure and its feasibility in a school setting.
Avoidance sounds like the strongest answer, and candidates under time pressure pick the strongest-sounding word. In practice, avoidance is often unavailable or creates a worse exposure - canceling all off-campus trips to eliminate transportation risk removes a curricular benefit and may create a different liability.
What to do instead
For each option, ask three questions: does it reduce frequency, reduce severity, or remove the activity entirely? Is the activity required by the program or curriculum? What new exposure does the technique create? Elimination and substitution come first in the hierarchy, but only when the activity is genuinely discretionary. Practice with scenarios where avoidance is impossible (state-mandated services, required physical education) so the word loses its default appeal.
Confusing retention with transfer, and treating a deductible, a self-insured retention, or an unfunded reserve as if it were insurance because a policy document is involved.
Deductibles appear on insurance paperwork, so candidates file them under transfer. The exam tests whether the candidate can see that the retained layer is still the school's own money at risk, regardless of which document mentions it.
What to do instead
Draw the layer diagram for every retention question: the first-dollar layer the entity bears, the layer above it the insurer bears, and any gap. Ask 'who pays this dollar?' rather than 'which document mentions it?'. Note explicitly that a deductible is retained risk even though it lives inside a transferred policy, and that a funded reserve is still retention because funding does not move the risk.
Choosing an exposure-basis (occurrence) figure when the stem describes a maximum possible loss under worst-case conditions, or vice versa, without checking which valuation basis the stem names.
The terms maximum possible loss, probable maximum loss, and expected loss sound interchangeable to a candidate who has read them once. The exam deliberately supplies the same property with different assumptions (all fire protection fails versus protection works as designed) and expects the candidate to match the assumption to the basis, not to pick the largest number.
What to do instead
Memorize the three bases as a ladder with their assumptions attached: expected loss assumes normal conditions; probable maximum loss assumes protection systems function but some loss control is compromised; maximum possible loss assumes total destruction with no effective response. When a stem gives you an assumption, name it in the margin before looking at the numbers, then select the basis that carries that assumption.
Treating a risk assessment matrix as a scoring exercise and ranking a high-frequency, low-severity exposure above a low-frequency, catastrophic exposure because the numeric product is larger.
Multiplying likelihood by impact is easy and feels quantitative, so candidates stop there. Schools face exposures where a single event is existential (a student fatality on a trip, a sexual misconduct claim) even though its frequency is tiny, and the naive product buries them.
What to do instead
Before ranking, check the matrix for a severity override: any exposure above a catastrophic-severity threshold is prioritized regardless of frequency score. Practice ranking sets that include one rare-but-severe item, and articulate in writing why the override applies. On the exam, if an option says 'prioritize because of potential severity despite low likelihood', test it seriously rather than dismissing it as overreaction.
Assuming a school's property and liability coverage automatically follows students and staff onto trips, athletic events, and work-based learning sites, and selecting the 'covered' answer without checking the policy trigger.
Candidates reason from intuition about what a school 'should' cover rather than from coverage triggers. Off-premises exposures, borrowed or rented equipment, and non-owned vehicles are classic gaps that require specific endorsements or separate policies.
What to do instead
For any scenario set off district property, run a three-part check: is the location covered, is the person or entity an insured, and is the activity within the described operations? If any answer is uncertain, the correct exam answer is usually the one identifying a gap or an endorsement need. Build a short list of recurring gap triggers - off-site trips, athletic injuries, volunteer drivers, interns placed at employers - and rehearse them.
Treating the premium as the cost of risk and ignoring retained losses, administrative costs, and the cost of loss-control measures when a stem asks for total cost of risk.
The premium is the visible, budgeted line item, so it dominates attention. Retained losses and internal administration are real costs that do not appear on the insurance invoice, and candidates routinely omit them from a total-cost calculation.
What to do instead
Write the four-part formula on scratch paper before any cost-of-risk question: insurance premium plus retained losses plus administrative and risk-control costs plus the opportunity cost of funds set aside. For calculation stems, list each component and mark whether the stem supplied it. If an option equals the premium alone and the stem asked for total cost, eliminate it immediately.
Confusing the risk management function with the compliance or safety-inspection function - answering that the risk manager's job is to inspect playgrounds or enforce regulations, rather than to identify, evaluate, and finance risk across the district.
In many districts the risk manager also handles safety and compliance, so the day-to-day tasks look like the definition. Exam stems test the coordinating and financing role, and candidates pick the operational task because it is familiar and concrete.
What to do instead
State the function first: identify and analyze exposures, select treatment techniques, implement and monitor the program, and arrange financing. Then place operational tasks as inputs to that function rather than as its definition. When an option describes a single hands-on task, ask whether it is the whole job or one data source for the job - the exam rewards the coordinating answer.