IIA CRMA study plan

Map the CRMA exam syllabus into a personal checklist that lists every risk management assurance subtopic and marks each as unknown, shaky, or solid before any study begins.

Define the three lines model in your own words and write a one-page note explaining how internal audit's assurance role differs from management's ownership of risk.

Distinguish assurance over risk management from consulting on risk management, and list five concrete situations that would count as a scope or independence conflict.

Build a glossary of at least 20 core terms (inherent risk, residual risk, risk appetite, risk tolerance, control effectiveness, assurance mapping) with your own definitions.

Explain how an organization's risk appetite and tolerance statements should drive the criteria an internal auditor uses to judge risk management effectiveness.

Trace the full risk management process (identification, assessment, response, monitoring, reporting) and note at least two assurance questions an auditor should ask at each stage.

Compare inherent versus residual risk and practice computing residual exposure from a simple likelihood-impact matrix you construct yourself.

Identify the key elements of a risk register and critique a hypothetical register you draft for missing owners, stale ratings, or absent response plans.

Draft a risk-based internal audit plan for a fictional mid-size company, justifying engagement selection using the company's risk profile rather than a fixed cycle.

Write three engagement-level objectives that each map to a specific organizational risk and state the criteria you would audit against.

Design an assurance map that shows where internal audit, compliance, risk management, and external audit each provide coverage, and flag the gaps.

Practice scoping decisions by writing a short memo on what you would exclude from one engagement and why.

Explain how to evaluate whether management's risk responses are designed effectively and are operating as intended, using a worked example.

Distinguish controls testing from risk management process evaluation, and describe when each is the right assurance approach.

Identify the reporting lines and governance structures (board, audit committee, CRO, risk committee) that determine whether risk management is functioning, and list red flags of a weak structure.

Write a set of ten interview questions an internal auditor would ask a chief risk officer during a risk management assurance engagement.

Draft findings from a hypothetical risk management assurance engagement, each with condition, criteria, cause, effect, and a specific recommendation.

Practice rating findings by severity and justify each rating against residual risk and management's stated appetite.

Write a concise audit report summary that communicates a significant risk management weakness to an audit committee without jargon.

Review your own draft findings and rewrite any that state an opinion without supporting criteria.

Build a monitoring plan that defines how internal audit would follow up on risk management recommendations, including owners, dates, and escalation triggers.

Describe how emerging and strategic risks should be surfaced and monitored, and list signals that a risk process is failing to catch them.

Explain the role of key risk indicators and test three sample KRIs for whether they are leading, measurable, and tied to appetite.

Draft an escalation memo for a recommendation that management has accepted but not implemented past its due date.

Complete a timed set of at least 60 original practice questions covering the full domain and record your accuracy by subtopic.

Re-study only the subtopics where your accuracy fell below 70 percent, and write a corrected note for each.

Practice explaining your reasoning aloud for ten scenario questions, focusing on why the wrong answers are wrong.

Refine your glossary with any terms you missed and add the specific distinction that tripped you up.

Retake the subtopic areas you remediated in week 7 and confirm accuracy above 80 percent.

Assemble a one-page exam-day reference sheet of decision rules (independence, scope, criteria, reporting) drawn only from your own notes.

Simulate exam conditions with a full timed mixed set and review every incorrect answer to root cause.

Write a final gap list of no more than five items and a plan for reviewing them in the 48 hours before the exam.