I85PREP
⌘ K
IIA CRMA study materials
IIA CRMA study resources

IIA CRMA practice questions

One question at a time. Build your IIA CRMA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Under the IIA's three lines model, which group provides independent assurance to the board on the effectiveness of risk management across the whole organization?

  1. The second line risk and compliance functions
  2. Internal audit Correct answer.
  3. The external auditor engaged by management
  4. The first line operating management

Explanation

The three lines model assigns internal audit the assurance role over risk management and control, reporting objectively to the governing body. First-line management owns and manages risk, while second-line functions support and monitor risk activities without providing organization-wide independent assurance.

Question 2Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An internal auditor is assigned to review the risk management framework of the same function she managed two years ago. What is the most appropriate response?

  1. Decline or escalate the assignment because objectivity is impaired Correct answer.
  2. Accept the engagement because two years have passed since the transfer
  3. Accept the engagement but disclose the prior role in the report
  4. Accept the engagement if the former subordinates confirm her independence

Explanation

Objectivity requires auditors to avoid conflicts of interest, and a recent operational role in the area under review creates a self-review threat that elapsed time alone does not automatically remove. The auditor should decline the assignment or escalate it so that independence can be preserved or appropriately safeguarded.

Question 3Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which document issued by the chief audit executive is the primary vehicle for communicating internal audit's risk-based assurance plan and resource needs to the audit committee?

  1. The annual audit plan Correct answer.
  2. The engagement work program
  3. The quality assurance improvement program
  4. The audit report on a single engagement

Explanation

The annual (or periodic) audit plan sets out the risk-based assurance coverage and the resources required, and it is approved by the governing body. It is the principal mechanism for aligning internal audit's work with the organization's risk profile and for securing mandate and resources.

Question 4Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor concludes that management has accepted a level of residual risk that exceeds the board's stated risk appetite. According to professional guidance, the auditor's primary responsibility is to:

  1. Report the matter to the board or audit committee Correct answer.
  2. Direct management to reduce the exposure immediately
  3. Adjust the risk appetite statement in the risk register
  4. Document the acceptance and take no further action

Explanation

When residual risk exceeds the board's tolerance, internal audit must escalate the matter to the governing body so that it can exercise oversight. Internal audit advises and reports; it does not assume management's authority to accept or direct risk responses.

Question 5Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

In a risk-based audit plan, which factor most appropriately drives the prioritization of assurance engagements?

  1. The preferences of individual process owners
  2. The size of the department's headcount
  3. The residual risk and significance of the process to objectives Correct answer.
  4. The chronological order of last year's engagements

Explanation

Risk-based planning allocates limited assurance resources to areas with the greatest residual risk and greatest significance to organizational objectives. Headcount, rotation history, and owner preference are secondary considerations that should not displace risk as the primary driver.

Question 6Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

A chief audit executive reports functionally to the audit committee and administratively to the chief financial officer. Which statement best describes the effect of this arrangement?

  1. It is prohibited in all circumstances by the Standards
  2. It improves objectivity because the CFO controls the audit budget
  3. It may impair independence if the CFO influences audit scope, resources, or reporting Correct answer.
  4. It eliminates all threats to independence because the audit committee exists

Explanation

Administrative reporting to an executive whose area is subject to audit can create threats to independence, particularly if that executive controls budget, staffing, or scope decisions. The functional reporting line to the audit committee helps, but the arrangement must be structured so the CFO cannot constrain audit work or suppress findings.

Question 7Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

During a risk management assurance engagement, the auditor finds that the enterprise risk register has not been updated in 18 months and no risk owners have been assigned. Which conclusion is most supportable?

  1. The audit committee has fulfilled its oversight responsibility
  2. Risk responses are operating effectively because no losses have occurred
  3. The risk management process is not functioning as designed and needs remediation Correct answer.
  4. The organization has no risks because none are recorded

Explanation

A stale register with no assigned owners indicates the risk management process is not operating as designed, regardless of whether losses have occurred to date. The auditor should report the design and operating deficiency and recommend remediation.

Question 8Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the relationship between the risk appetite and the risk tolerance of an organization?

  1. Risk appetite applies only to financial risks; tolerance applies to operational risks
  2. Risk appetite is the aggregate level of risk the organization is willing to accept; tolerance is the acceptable variation around specific objectives Correct answer.
  3. They are identical concepts used interchangeably in risk frameworks
  4. Risk tolerance is set by internal audit; risk appetite is set by management

Explanation

Risk appetite expresses the broad amount and type of risk the organization is willing to pursue to meet objectives, while tolerance defines acceptable variation in performance around specific objectives. The two operate at different levels of specificity and are not interchangeable.

Question 9Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is testing whether a key risk indicator (KRI) is effective for monitoring. Which attribute is most important to evaluate?

  1. Whether the KRI is predictive, measurable, and linked to a defined threshold with escalation Correct answer.
  2. Whether the KRI has remained unchanged for several years
  3. Whether the KRI is reported in the annual financial statements
  4. Whether the KRI is calculated by the internal audit function

Explanation

An effective KRI should be relevant and predictive of the risk, measurable from reliable data, and tied to thresholds that trigger escalation. These attributes determine whether the indicator actually supports timely risk response.

Question 10Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Management asserts that a control activity mitigates a risk, but the auditor finds the control is performed only after the risk event has occurred. What is the most appropriate characterization?

  1. The control is preventive and effective
  2. The control is detective and timely
  3. The control is a compensating control for a design deficiency
  4. The control does not mitigate the risk as asserted because it operates too late Correct answer.

Explanation

A control that operates only after the risk event cannot prevent or timely detect the exposure it is said to mitigate, so the assertion that it mitigates the risk is not supported. The auditor should report the gap between the asserted and actual control effect.

Question 11Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

When internal audit provides consulting services related to risk management, which safeguard best preserves its ability to later provide assurance over the same area?

  1. Assigning the consulting work to a separate team and disclosing the arrangement to the audit committee Correct answer.
  2. Extending the consulting engagement indefinitely
  3. Omitting the consulting work from the audit plan records
  4. Having the same auditor perform both the consulting and the subsequent assurance engagement

Explanation

Separating personnel and disclosing the consulting role to the audit committee reduces the self-review threat and preserves the credibility of later assurance. The auditor must also assess whether assuming management responsibility would impair objectivity.

Question 12Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An organization's board has delegated risk oversight to a committee that meets once a year and receives only summary reports. From a risk management assurance perspective, the most significant concern is:

  1. The committee has too many members to make decisions
  2. The committee receives reports from the chief risk officer
  3. The committee lacks sufficient frequency and depth of information to exercise effective oversight Correct answer.
  4. The committee operates under a written charter

Explanation

Effective risk oversight requires sufficient frequency and depth of information for the governing body to challenge and direct risk management. Annual summary-only reporting is unlikely to support timely oversight of a changing risk profile.

Question 13Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following is the best example of a key control that supports the reliability of risk reporting to the board?

  1. A quarterly town hall presentation on risk awareness
  2. An annual employee survey on risk culture
  3. A monthly reconciliation of risk register entries to source system data, reviewed by the risk function Correct answer.
  4. A policy statement that risk reporting is important

Explanation

A reconciliation with independent review is a control activity that directly tests the accuracy and completeness of the data underlying risk reports. Awareness activities and policy statements support culture but do not provide the same assurance over reporting reliability.

Question 14Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is evaluating whether management's risk responses are proportionate. Which evidence would best support that conclusion?

  1. The response has been in place for more than one year
  2. The response cost is documented in the budget
  3. The response was approved by the process owner
  4. The response addresses the root cause and its cost is reasonable relative to the exposure Correct answer.

Explanation

Proportionality means the response targets the underlying risk and its cost is justified by the reduction in exposure achieved. Documentation, approval, and longevity are supporting attributes but do not by themselves demonstrate proportionality.

Question 15Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

The chief audit executive is asked to reduce the assurance coverage of a high-risk area to free resources for a low-risk area requested by a senior executive. The most appropriate action is to:

  1. Refuse to speak with the executive about the plan
  2. Shift the resources and note the change only in the working papers
  3. Discuss the request with the audit committee and document the risk-based rationale for coverage decisions Correct answer.
  4. Comply immediately because the executive has authority over resources

Explanation

Changes to risk-based coverage that are driven by influence rather than risk should be escalated to the audit committee, which approves the plan and protects audit independence. The rationale for any change should be documented and transparent.

Question 16Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which statement best reflects the auditor's responsibility when management's risk assessment appears reasonable but the auditor identifies a significant risk that management omitted?

  1. The auditor should communicate the omitted risk and consider its effect on the assurance plan and report Correct answer.
  2. The auditor should ignore the risk because it was not in scope
  3. The auditor should add the risk to the register and assign an owner
  4. The auditor should accept management's assessment because risk identification is a management responsibility

Explanation

Internal audit must exercise professional judgment and communicate significant risks it identifies, including their effect on planned coverage and conclusions. Adding the risk to the register and assigning an owner would be assuming management responsibility.

Question 17Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An audit committee asks internal audit to confirm that the organization's risk management framework is 'mature.' Which approach best supports a defensible conclusion?

  1. Assess the framework against defined maturity criteria and corroborate key attributes with evidence Correct answer.
  2. Compare the framework to a competitor's public disclosures
  3. Count the number of risks recorded in the register
  4. Rely on management's self-assessment score without corroboration

Explanation

A maturity conclusion must rest on defined criteria applied consistently and supported by corroborated evidence about design and operation. Self-assessment alone, peer comparison, or volume counts do not provide a sufficient basis for an assurance conclusion.

Question 18Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An organization uses a risk register in which likelihood and impact ratings are assigned by each business unit using different scales. What is the most likely consequence for enterprise-level risk aggregation?

  1. The register automatically corrects for scale differences
  2. Ratings become inconsistent and comparisons across the enterprise become unreliable Correct answer.
  3. Aggregation becomes more reliable because units apply local judgment
  4. Risk appetite statements become unnecessary

Explanation

Inconsistent scales prevent meaningful comparison and aggregation of risk ratings across business units, undermining enterprise reporting and prioritization. A common taxonomy and calibrated scales are needed for aggregation to be reliable.

Question 19Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Internal audit concludes that the second line's risk monitoring is well designed but that the first line routinely overrides the escalation thresholds. Which conclusion is most appropriate?

  1. The thresholds should be removed to eliminate the problem
  2. The risk management process is effective because the design is sound
  3. The second line is solely responsible for the override behavior
  4. The risk management process is ineffective in operation despite sound design Correct answer.

Explanation

Operating effectiveness requires that controls and processes function as designed in practice. Sound design in the second line does not compensate for first-line behavior that defeats escalation, so the process is deficient in operation.

Question 20Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

A chief audit executive is evaluating whether to rely on the work of a separate risk assurance function. Which consideration is most important to the reliance decision?

  1. The competence, objectivity, and systematic approach of the other function Correct answer.
  2. The size of the other function's budget
  3. Whether the other function reports to the same executive
  4. The number of reports the other function issues annually

Explanation

Reliance on another assurance provider depends on that provider's competence, objectivity, and use of a systematic and disciplined approach, together with the relevance of its work to the audit objectives. Budget, reporting lines, and output volume are not sufficient indicators.

Question 21Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which situation most clearly indicates that internal audit has assumed a management responsibility in a risk management project?

  1. Internal audit facilitated a risk workshop for management
  2. Internal audit reviewed the draft risk register and provided observations
  3. Internal audit tested the operation of a key control
  4. Internal audit designed the risk appetite statement and approved the final version Correct answer.

Explanation

Designing the risk appetite statement and approving its final version means internal audit has made management's decision, creating a fundamental conflict with later assurance. Reviewing drafts, facilitating workshops, and testing controls are compatible with the assurance role when objectivity is preserved.

Question 22Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

The audit committee asks how internal audit's assurance work should be coordinated with the external auditor's work on internal control over financial reporting. The best response is that coordination should:

  1. Eliminate internal audit's independent testing to avoid duplication
  2. Require internal audit to adopt the external auditor's conclusions without testing
  3. Align coverage and share relevant findings while preserving each function's independence and responsibility Correct answer.
  4. Be limited to exchanging the annual audit plan once

Explanation

Coordination seeks efficient coverage and information sharing while each function retains its own independence, judgment, and responsibility for its conclusions. Internal audit cannot simply adopt another auditor's conclusions or abandon its own testing.

Question 23Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the purpose of a risk management assurance engagement's engagement objectives?

  1. To record the time budget for fieldwork
  2. To define the specific risks, controls, and criteria the engagement will evaluate Correct answer.
  3. To list the audit staff assigned to the engagement
  4. To summarize the organization's strategic plan

Explanation

Engagement objectives define the scope and criteria for evaluating risks and controls so that conclusions are traceable to what was tested. Staffing, strategy summaries, and time budgets are planning inputs but not the objectives of the engagement.

Question 24Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor finds that a compensating control exists for a known deficiency in the primary control. What must the auditor evaluate before concluding the risk is adequately managed?

  1. Whether the primary control has a written procedure
  2. Whether the compensating control was approved by the process owner
  3. Whether the deficiency was reported in a prior year
  4. Whether the compensating control operates effectively and addresses the same risk Correct answer.

Explanation

A compensating control only supports a conclusion if it is designed to address the same risk and operates effectively. Approval, documentation of the primary control, and prior reporting history do not establish that the residual risk is adequately covered.

Question 25Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An organization's risk culture is described as weak, with employees reluctant to report emerging risks. Which audit approach best provides assurance over this area?

  1. Rely on the chief risk officer's statement that culture is improving
  2. Count the number of risk training sessions delivered
  3. Review the risk register for completeness only
  4. Gather corroborating evidence such as interviews, survey data, escalation logs, and observed behavior Correct answer.

Explanation

Assurance over culture requires multiple corroborating sources, including perceptions, behavior, and escalation records, because culture is not directly observable from a single document. Register completeness, management assertions, and training counts are insufficient on their own.

Question 26Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

In a risk management assurance engagement, which of the following best describes the primary purpose of defining the engagement's scope?

  1. To calculate the organization's aggregate risk appetite and tolerance thresholds
  2. To document management's risk response decisions for regulatory filing
  3. To establish which risk management processes, business units, and time periods the assurance conclusion will cover Correct answer.
  4. To assign accountability for each identified risk to a named risk owner in the first line

Explanation

Scope in a risk management assurance engagement defines the boundaries of the assurance conclusion: the processes, entities, and periods examined. Without a defined scope the auditor cannot state what the conclusion does and does not cover, which limits reliance by the board and audit committee.

Question 27Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is assessing whether an organization's risk management framework aligns with a recognized model such as COSO ERM. Which evidence provides the strongest support for the alignment conclusion?

  1. The number of risk workshops held across business units during the year
  2. Documented mapping of the organization's risk processes to each framework component, corroborated by walkthroughs Correct answer.
  3. The presence of a risk management policy approved by the board within the past three years
  4. A statement in the annual report that the organization follows COSO ERM

Explanation

Alignment is demonstrated by evidence that each framework component is actually implemented, not merely asserted. A documented mapping corroborated by walkthroughs shows the design and operation of the processes against the framework's components.

Question 28Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

During a risk management assurance engagement, the auditor determines that management's risk identification process omits emerging risks that have no historical loss data. Which conclusion is most appropriate?

  1. The omission is acceptable because emerging risks cannot be quantified
  2. The process is effective because historical data is the most reliable risk indicator
  3. The omission should be reported to the external auditor rather than to management
  4. The risk identification process is deficient because it relies only on historical experience Correct answer.

Explanation

An effective risk identification process considers both historical experience and forward-looking sources such as scenario analysis and emerging-risk scanning. Relying solely on past loss data leaves significant exposures unidentified and unmanaged.

Question 29Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the auditor's role when management has designed a risk response but has not yet implemented it?

  1. The auditor should implement the response to ensure timely mitigation
  2. The auditor should approve the response before implementation proceeds
  3. The auditor should disregard the response because it is not yet operating
  4. The auditor should assess the design of the response and note that operating effectiveness cannot yet be concluded Correct answer.

Explanation

Internal audit can evaluate whether a designed response is appropriate in concept, but conclusions about operating effectiveness require evidence of implementation. The report should distinguish design adequacy from operating status.

Question 30Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is evaluating the governance of risk management and finds that the board receives risk information only after quarterly aggregation by the second line. Which concern is most relevant to the assurance conclusion?

  1. Quarterly reporting is prohibited under enterprise risk management frameworks
  2. The aggregation process may delay escalation of time-sensitive risks to the board Correct answer.
  3. The second line lacks the technical skill to aggregate risk data
  4. The board should perform the aggregation itself to preserve objectivity

Explanation

Timeliness of risk information is a core governance attribute; delayed escalation can leave the board unaware of fast-moving exposures. The auditor should assess whether the reporting cadence and escalation triggers are adequate for the risk profile.

Question 31Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

When internal audit reports on the effectiveness of risk management, which of the following best characterizes the appropriate use of management's self-assessment results?

  1. They should be rejected because self-assessments are inherently biased
  2. They may be used as a starting point but require corroboration through independent audit procedures Correct answer.
  3. They should replace the audit program to avoid duplication of effort
  4. They should be accepted as sufficient evidence without further testing

Explanation

Management self-assessments can inform the audit approach but cannot substitute for independent evidence. The auditor corroborates the assertions through testing before relying on them in the assurance conclusion.

Question 32Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor finds that risk owners consistently rate likelihood as 'low' for a category of risk that has produced three losses in the past two years. Which audit response is most appropriate?

  1. Escalate the ratings directly to the regulator without management involvement
  2. Recommend that the risk category be removed from the register
  3. Recalculate the ratings and report the inconsistency as a weakness in risk assessment Correct answer.
  4. Accept the ratings because risk owners are closest to the activity

Explanation

Ratings that conflict with observable loss history indicate a calibration or bias problem in the risk assessment process. The auditor should document the inconsistency, assess its cause, and report it as a weakness in the risk assessment process.

Question 33Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the relationship between residual risk and the auditor's evaluation of risk response adequacy?

  1. Residual risk must fall within the tolerance set for that risk for the response to be considered adequate Correct answer.
  2. Residual risk is determined solely by the external auditor's assessment
  3. Residual risk is irrelevant because only inherent risk matters for assurance
  4. Residual risk should always be reduced to zero before a response is deemed adequate

Explanation

A risk response is adequate when residual risk is brought within the tolerance the organization has established for that risk. The auditor compares residual exposure to the approved tolerance rather than to an absolute standard.

Question 34Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is planning a risk management assurance engagement over a newly acquired subsidiary. Which factor most affects the extent of testing required?

  1. The subsidiary's revenue relative to the parent
  2. The maturity of the subsidiary's risk processes and the risk it introduces to the group Correct answer.
  3. The length of time since the acquisition was announced
  4. The number of employees transferred from the parent

Explanation

Engagement effort should be driven by risk and the state of the subsidiary's risk management processes. An immature process combined with significant introduced risk warrants more extensive testing.

Question 35Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes how internal audit should treat a risk that management has accepted but that exceeds the board-approved risk appetite?

  1. Report the acceptance to the board or audit committee as a matter requiring attention Correct answer.
  2. Remain silent because acceptance is a management prerogative
  3. Disclose the matter only if a loss subsequently occurs
  4. Override management's decision and require mitigation

Explanation

Management may accept risk, but acceptance outside approved appetite is a governance matter that the board must know about. Internal audit reports the condition so those charged with governance can act.

Question 36Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is assessing the design of a risk committee. Which feature most strongly supports effective challenge of management's risk decisions?

  1. Membership composed primarily of the executives who own the risks
  2. Independent members with relevant expertise and a documented mandate to challenge Correct answer.
  3. A schedule of meetings aligned with the financial reporting calendar
  4. Rotation of the committee chair among business unit heads

Explanation

Effective challenge requires independence from the executives whose decisions are being reviewed, relevant expertise, and an explicit mandate. Without these, the committee tends to ratify rather than challenge.

Question 37Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

During fieldwork, an auditor discovers that a key risk indicator is calculated from data maintained by the same team whose performance it measures. Which conclusion is most defensible?

  1. The KRI should be discontinued immediately without further analysis
  2. The KRI is reliable because the team understands the data best
  3. The KRI's independence is compromised and its reliability should be tested further Correct answer.
  4. The KRI is acceptable if the calculation formula is documented

Explanation

When the party being measured controls the measurement data, there is an incentive and opportunity to bias the indicator. The auditor should test the data's integrity and consider whether independent validation exists.

Question 38Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the auditor's responsibility when management's risk register contains risks that are not linked to any control activity?

  1. The auditor should assess whether those risks are unmanaged and report the gap Correct answer.
  2. The auditor should add controls to the register personally
  3. The auditor should delete the risks to keep the register consistent
  4. No action is needed because the register is a management tool

Explanation

Risks without associated controls may be unmanaged exposures, which is a significant finding about the risk management process. The auditor evaluates and reports rather than editing the register.

Question 39Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is evaluating whether the organization's risk reporting to the board is decision-useful. Which attribute is most important?

  1. The report is reviewed by the chief financial officer before distribution
  2. The report is prepared in the same format each period for consistency
  3. The report presents risks ranked by severity with trend information and clear ownership Correct answer.
  4. The report includes every risk in the register regardless of materiality

Explanation

Decision-useful reporting highlights material risks, shows how exposures are changing, and identifies accountable owners so the board can act. Volume and formatting consistency are secondary to relevance and clarity.

Question 40Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following situations most clearly indicates that a risk management assurance engagement lacks sufficient objectivity?

  1. The engagement was requested by the audit committee
  2. The engagement team includes a specialist in the risk area being reviewed
  3. The engagement leader previously designed the risk framework being assessed Correct answer.
  4. The engagement team reviewed the prior year's working papers

Explanation

Objectivity is impaired when an auditor assesses work they previously designed or performed. Such self-review threats should be avoided or safeguarded by assigning the engagement to others.

Question 41Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor concludes that management's risk responses are adequate in design but that monitoring of those responses is informal and undocumented. Which conclusion is most appropriate?

  1. Monitoring is a second-line responsibility and outside the scope of assurance
  2. Monitoring weakness limits the assurance conclusion even when responses are well designed Correct answer.
  3. Informal monitoring is acceptable if no losses have occurred
  4. The risk management process is fully effective because responses are adequate

Explanation

Adequate design is not sufficient if there is no reliable mechanism to detect when responses degrade or fail. Undocumented monitoring reduces the auditor's ability to conclude that the process operates effectively over time.

Question 42Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the auditor's approach when the organization's risk appetite statement is qualitative and lacks measurable thresholds?

  1. Treat the absence of thresholds as a significant deficiency in the risk framework Correct answer.
  2. Ignore the appetite statement and assess risks independently
  3. Conclude that qualitative appetite statements are prohibited by frameworks
  4. Assume management has set thresholds elsewhere and stop testing

Explanation

An appetite statement without measurable thresholds cannot be used to judge whether exposures are acceptable, which undermines monitoring and reporting. The auditor should evaluate this as a framework weakness and recommend that tolerances be defined.

Question 43Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

The chief audit executive is developing the risk-based audit plan. Which input is most relevant to prioritizing risk management assurance coverage?

  1. The number of audit staff available in each quarter
  2. The preferences of business unit managers for audit timing
  3. The organization's risk profile, including changes in strategy and external environment Correct answer.
  4. The prior year's audit plan without modification

Explanation

Risk-based planning prioritizes areas of greatest risk, including emerging and strategic exposures. Staffing and manager preferences are constraints, not drivers, of coverage priorities.

Question 44Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor finds that the organization's scenario analysis exercises are conducted annually but results are never used to adjust risk responses. Which finding is most appropriate?

  1. The finding should be reported only if scenario losses materialize
  2. The scenario results are not integrated into decision-making, limiting the value of the exercise Correct answer.
  3. The scenario analysis process is well designed and requires no comment
  4. The exercise should be discontinued because it consumes resources

Explanation

Scenario analysis adds value only when its outputs inform risk responses, capital planning, or strategy. An exercise whose results are ignored represents a design-to-operation gap that the auditor should report.

Question 45Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes how internal audit should coordinate with the second line when both provide assurance over the same risk?

  1. Internal audit should duplicate the second line's testing to confirm its results
  2. Internal audit should understand the second line's work and determine whether it can be relied upon, adjusting its own coverage accordingly Correct answer.
  3. Internal audit should cease testing any risk covered by the second line
  4. Internal audit should direct the second line's testing program

Explanation

Coordination requires the auditor to evaluate the second line's methodology, objectivity, and results before relying on them, then target remaining coverage at gaps. This avoids duplication while preserving independent assurance.

Question 46Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is testing whether risk owners actually review and update their risk assessments. Which procedure provides the most direct evidence?

  1. Interviewing the chief risk officer about the review process
  2. Inspecting system logs and timestamps showing owner reviews and updates Correct answer.
  3. Counting the number of risks in the register
  4. Reviewing the risk policy's description of owner responsibilities

Explanation

System logs and timestamps provide direct evidence that reviews occurred and updates were made. Interviews and policy documents show intent or design but not actual performance.

Question 47Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor concludes that a business unit's risk register is comprehensive but that its top risks are not reflected in the unit's budget or strategic plan. Which conclusion is most appropriate?

  1. Risk information is not integrated into planning, indicating a disconnect between risk management and decision-making Correct answer.
  2. The budget process is outside the scope of risk management assurance
  3. The register should be reduced to match the strategic plan
  4. The risk process is effective because the register is comprehensive

Explanation

Risk management is effective only when risk information informs resource allocation and strategy. A comprehensive register that does not influence planning indicates the process is not embedded in decision-making.

Question 48Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the auditor's responsibility regarding management's assertion that its risk management process complies with regulatory requirements?

  1. Rely on the regulator's prior examination results as complete evidence
  2. Accept the assertion because management is accountable for compliance
  3. Obtain evidence that the process meets each relevant requirement before concluding Correct answer.
  4. Confirm compliance only for requirements the auditor considers important

Explanation

The auditor must obtain sufficient evidence that each applicable requirement is met rather than accepting management's assertion. Prior regulatory examinations may inform the assessment but do not cover all requirements or periods.

Question 49Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

An auditor is evaluating the organization's process for identifying changes that affect risk, such as new regulations or technology adoption. Which weakness would most concern the auditor?

  1. Changes are logged with assigned owners and target dates
  2. Changes are reported to the risk committee quarterly
  3. Change identification relies on a single annual management meeting Correct answer.
  4. Changes are identified through multiple channels including industry groups and regulators

Explanation

Relying on a single annual meeting creates a significant lag between change and detection, leaving the organization exposed to unidentified risks. Multiple channels, ownership, and regular reporting all support effective change identification.

Question 50Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source)

Which of the following best describes the appropriate treatment of a risk management deficiency that management has agreed to remediate after the audit report date?

  1. Delay the report until remediation is complete
  2. Report the deficiency only to the external auditor
  3. Exclude the deficiency from the report because remediation is planned
  4. Report the deficiency with management's response and monitor remediation progress Correct answer.

Explanation

The deficiency exists at the time of the engagement and must be reported with management's response and target date. Follow-up monitoring confirms whether remediation actually occurs.