IIA CRMA case studies
IIA CRMA · Put your knowledge to work in context.
The Certification in Risk Management Assurance (CRMA) is an IIA credential for professionals who provide risk management assurance to audit committees and executive management. The IIA describes the program as reflecting the in-depth organizational knowledge and skillsets required for that role, and notes that the CRMA no longer requires the CIA prerequisite, so candidates can pursue it independently of the CIA. The IIA CRMA case studies are 5 cases and about 2,937 words.
1ERM Build-Out: Consulting Help or Assurance Self-Review?
A regional bank with $8.2 billion in assets has 14 approved internal audit positions, 3 vacant. The risk function has 4 staff, 2 hired within the last five months.
645 words, about 3 min2Risk Appetite Without Metrics or Tolerances
A six-hospital specialty network with 1.2 billion in revenue approved a risk appetite statement last year: moderate appetite for patient safety, low for regulatory compliance, and high for growth. The statement has no metrics, tolerances, or escalation triggers.
603 words, about 3 min3Combined Assurance Map That Overstates Coverage
A property and casualty insurer with $2.5 billion in gross written premium produced a combined assurance map covering 11 principal risks. For underwriting risk, the map marks full assurance because the first line completed 38 self-assessments, second-line compliance performed 4 file reviews, and external audit tested controls over premium recognition.
587 words, about 3 min4Green KRIs That Mask Deteriorating Safety Risk
A trucking and logistics company with 1,200 tractors and $900 million in revenue uses four key risk indicators on its board dashboard: driver turnover, fuel price variance, on-time delivery, and total recordable incident rate. Behind the dashboard, near-miss reports fell 30% after a no-blame policy was announced but not implemented; telematics shows harsh-braking alerts up 45%; two major customers added safety clauses to contracts; and the safety director resigned, leaving the position vacant for four months.
538 words, about 3 min5Stale Risk Register and Missed Emerging Risks
A midstream energy company with 3.1 billion in assets refreshes its enterprise risk register annually through a consultant who interviews eight senior leaders. The top five risks have not changed in three years: commodity price, pipeline integrity, regulatory, weather, and contractor safety.
564 words, about 3 min