IIA CRMA study guide
IIA CRMA · Work through your exam, one topic at a time.
The Certification in Risk Management Assurance (CRMA) is an IIA credential for professionals who provide risk management assurance to audit committees and executive management. The IIA describes the program as reflecting the in-depth organizational knowledge and skillsets required for that role, and notes that the CRMA no longer requires the CIA prerequisite, so candidates can pursue it independently of the CIA. The exam is a 150-minute, 120-question computer-based test delivered at secure global test centers, using interactive question types that ask you to apply concepts, analyze and evaluate data, make sound judgments, and formulate conclusions and recommendations. The syllabus is currently supported by the 2017 Standards; the IIA states there are currently no plans to update the CRMA exam to reflect the Global Internal Audit Standards, and that the core principles of risk management and internal auditing remain consistent. Eligibility depends on your education: a master's degree or higher requires proof of 1 year of internal audit experience, a bachelor's degree requires 2 years, and without a degree you need 5 years, with 2 of those years within the past 3. Active IAP holders also have a pathway. Topics on this exam: Risk management assurance (domain topics per CRMA exam syllabus; individual domain weights not published in source). The IIA CRMA study guide has 1 section and about 409 words.
01Risk Management Assurance
Risk management assurance is the independent, objective evaluation of whether an organization's risk management process is designed and operating effectively. The CRMA exam tests your ability to distinguish assurance on the risk management process from assurance on individual risks, and to apply frameworks such as COSO ERM 2017, ISO 31000, and The IIA's Three Lines Model. Internal audit provides assurance; management owns risk. The CAE should not build or operate the risk register, set risk appetite, or make risk responses.
409 words, about 2 minMore study resources for IIA CRMA
- Practice questionsUnder the IIA's three lines model, which group provides independent assurance to the board on the effectiveness of risk management across the whole organization?
- FlashcardsThree lines model. A governance structure in which operating management owns risk, an independent oversight function monitors and challenges it, and internal audit provides independent assurance to the governing body.
- Cheat sheetThree lines model: first line owns and manages risk (operating management); second line provides independent oversight, monitoring, and challenge (risk, compliance, quality); third line is internal audit, which provides independent assurance to the governing body on the effectiveness of risk management and control.
- Key termsRisk management assurance. Independent, objective evaluation of how well an organization identifies, assesses, and controls risk, giving the board and management confidence that risk processes work as intended.
- Study planMap the CRMA exam syllabus into a personal checklist that lists every risk management assurance subtopic and marks each as unknown, shaky, or solid before any study begins.
- Common mistakesCandidates carry over habits from operational audit, where the audited process's own list is the starting point.
- Exam-day guideIIA exams are delivered through Pearson VUE testing centers and, where the provider allows it, online proctoring.