IIA CRMA common mistakes
IIA CRMA · Understand the traps and how to avoid them.
Answering risk-identification questions by listing the risks the organization already tracks in its risk register, rather than testing whether the register itself is complete and current.
Candidates carry over habits from operational audit, where the audited process's own list is the starting point. CRMA questions instead ask whether risk management is working, so accepting the client's inventory as the universe of risk is itself the control weakness being examined. The register feels authoritative and saves time, so it goes unchallenged.
What to do instead
For any question about assessing risk coverage, first ask 'who validated that this list is complete?' Build the habit of comparing the client's inventory against independent sources (industry risk taxonomies, prior loss events, peer disclosures, strategy documents, emerging-risk scans) and flagging gaps as findings. Practise phrasing findings as 'the process does not identify X' rather than 'risk X exists'.
Treating the three lines model as a rigid org chart and concluding that any risk activity performed by the second line is a violation of independence.
Simplified training material presents the model as strict separation, so candidates over-apply it. In practice the model is about distinct roles and effective challenge, and the internal audit activity's independence is compromised only when it takes on management responsibility or its work is directed by those it reviews.
What to do instead
When a scenario describes the second line owning a framework, facilitating risk workshops, or aggregating risk data, classify that as appropriate second-line work and focus the answer on whether assurance over it is objective. Reserve independence concerns for cases where internal audit designs controls, sets risk appetite, implements risk responses, or reports to the function it audits. Drill the distinction by writing one sentence for each scenario naming who owns the decision and who provides assurance.
Selecting 'report the issue to the audit committee' as the first action whenever a risk management weakness is found, skipping engagement-level steps such as validating the observation with management or assessing whether it is isolated or systemic.
Candidates memorize escalation as the safe answer. Exam items usually reward the earliest appropriate professional action, and premature escalation signals poor engagement management and weak evidence gathering.
What to do instead
Apply an escalation ladder: gather sufficient evidence, discuss with the responsible manager, determine root cause and whether the issue is pervasive, then escalate proportionally. Choose escalation only when the scenario indicates management is unresponsive, the risk is significant and time-sensitive, or the issue affects the audit activity's own objectivity. Practise ranking candidate actions by 'first, next, best' ordering.
Confusing inherent risk, residual risk, and risk appetite when interpreting whether a risk response is adequate, and judging adequacy against the inherent figure.
The terms appear together in framework material and candidates learn definitions without practising the arithmetic and logic of the relationship. Comparing inherent risk to appetite makes almost every response look inadequate, producing wrong conclusions.
What to do instead
Before answering, explicitly label what the scenario gives you: exposure before controls (inherent), exposure after controls (residual), and the tolerance threshold (appetite). Then test residual against appetite. If only inherent risk is stated, the correct answer often involves obtaining control-effectiveness evidence first. Build a one-page worksheet with the three columns and run every practice scenario through it.
Designing an assurance engagement that only tests whether risk responses exist (documented policies, completed assessments) without testing whether those responses operate effectively or reduce risk to within appetite.
Existence testing is easier to scope and produces clean workpapers, so candidates default to it. CRMA items frequently hinge on the difference between conformance and effectiveness, and an engagement that stops at documentation cannot support an opinion on risk management.
What to do instead
For each engagement objective, write a paired test: one attribute for design and one for operating effectiveness, with evidence sources for each. Include at least one outcome-based measure (loss frequency, incident trends, key risk indicator breaches) alongside process measures. When a question asks what would best determine whether risk management is effective, prefer answers that examine outcomes and challenge, not document counts.
Writing the engagement communication around a list of individual control exceptions instead of stating an overall conclusion on the risk management process and its alignment with the organization's objectives.
Candidates transfer financial-audit reporting conventions, where findings dominate. CRMA reporting is expected to answer a broader question, and a findings-only report leaves the audit committee without the assurance judgment it commissioned.
What to do instead
Structure every practice report with an explicit overall opinion or conclusion, the criteria used, the basis for the conclusion, and then findings that support it. Draft conclusions using graded language (effective, effective with exceptions, ineffective) and tie each grade to defined criteria in the engagement plan. Review sample reports and check that the first paragraph answers 'is risk management working?' without reading further.
Accepting a heat map or risk score at face value without probing the scoring scales, aggregation logic, or the consistency of ratings across business units.
Heat maps look quantitative and authoritative, and candidates lack practice interrogating the underlying methodology. Inconsistent scales and optimistic ratings are among the most common real weaknesses in risk frameworks, so this is fertile ground for exam items.
What to do instead
Memorize a standard challenge checklist for risk scoring: are scales defined with objective anchors, are likelihood and impact calibrated to the same time horizon, who can override ratings, is aggregation meaningful, and are ratings comparable across units? When a scenario shows a suspiciously low rating for a known exposure, the best answer usually involves testing calibration or comparing to external data rather than accepting the map.
Assuming the internal audit activity's own risk assessment is unnecessary once an enterprise risk management function exists, and simply adopting the ERM risk universe as the basis for the audit plan.
It appears efficient and avoids duplication, and candidates read 'coordination with other assurance providers' as 'rely on their assessment'. Doing so transfers audit judgment to management and undermines the independence of the plan.
What to do instead
Treat the ERM output as an input, not a substitute. Practise describing the audit activity's own process: independent input gathering, its own scoring criteria, consideration of assurance coverage from other providers, and documented rationale for prioritization. On questions about the audit plan, prefer answers where internal audit performs its own assessment and reconciles differences with ERM, documenting the reasons.
Misreading questions that describe a mature risk culture and answering with a control-based remedy, when the scenario calls for evaluating tone at the top, incentives, or risk-taking behaviour.
Candidates prepare heavily on frameworks and controls, which are easier to memorize than culture concepts, so they pattern-match to the familiar. Culture items require reasoning about behaviour and incentives rather than testing artifacts.
What to do instead
Build a short culture-assessment toolkit: board and executive engagement with risk, whether risk limits are respected under pressure, how compensation rewards risk-taking, escalation without retaliation, and how bad news travels. When a scenario mentions pressure to meet targets, deferred projects, or silenced dissent, screen the answer choices for those that examine behaviour and incentives rather than document existence.
Failing to apply due professional care and skepticism when a risk owner provides a verbal assurance or a self-assessment result, and treating it as sufficient evidence.
Time pressure and deference to seniority make verbal representations feel adequate, and candidates underestimate how often exam scenarios plant an unverified assertion. The scenario usually rewards corroboration.
What to do instead
Adopt a standing rule: any management assertion in a scenario is a claim to be corroborated, not evidence. Practise naming the corroborating source (system data, independent report, walkthrough observation, third-party confirmation) for each type of assertion. On questions asking for the next action after receiving an assurance, prefer obtaining corroborating evidence over accepting, escalating, or closing the issue.