Risk Management Assurance
What the exam tests
Risk management assurance is the independent, objective evaluation of whether an organization's risk management process is designed and operating effectively. The CRMA exam tests your ability to distinguish assurance on the risk management process from assurance on individual risks, and to apply frameworks such as COSO ERM 2017, ISO 31000, and The IIA's Three Lines Model.
Core rules and concepts
- Internal audit provides assurance; management owns risk. The CAE should not build or operate the risk register, set risk appetite, or make risk responses.
- Assurance covers the risk management process: governance and culture, strategy-risk alignment, risk identification and assessment, risk responses, monitoring, and communication.
- Evaluate risk appetite against strategy, tolerances, and decisions; a register without appetite is incomplete.
- Consider the governing body's oversight, risk culture, emerging risks, and coordination with other assurance providers.
- Report an overall conclusion tied to criteria; do not conclude that all risks are adequately managed. Assurance conclusions should be expressed at the process level and supported by sufficient, reliable evidence.
Worked example
An internal audit team reviews ERM at a retailer. Management has a register of 80 operational risks, a quarterly risk committee, and incident tracking. It has no documented risk appetite, no strategic risks, and no board discussion of emerging risks. The team should conclude that the ERM process is only partially effective. The register and committee are strengths, but the missing strategy linkage and appetite prevent a conclusion that risk management is effective. The report should state criteria, evidence, and root causes, and address the process-not opine that specific risks are acceptable.
Traps that cost marks
A common error is treating a risk register as ERM. Another is accepting management's risk ratings without evaluating the assessment methodology. Candidates also confuse the audit plan's risk-based approach with assurance on ERM. Do not let internal audit assume management's role by facilitating risk responses without safeguards. Where internal audit facilitates risk workshops, it must not later provide independent assurance on those outputs without safeguards.