PRMIA CCRM common mistakes
PRMIA CCRM · Understand the traps and how to avoid them.
Treating cyber risk identification as an IT asset inventory exercise, listing servers and applications rather than identifying risk scenarios tied to business processes and threat events.
Candidates transfer general IT-audit habits into the exam and miss that identification means naming the loss event (data breach, ransomware, third-party outage) and the business process it threatens, not cataloguing infrastructure.
What to do instead
For every scenario, force the chain: threat actor → attack vector → vulnerable asset → business process affected → loss type (confidentiality, integrity, availability, financial, regulatory). Practise writing identification statements in that five-part form until it is automatic.
Confusing risk identification with risk assessment and starting to score likelihood or impact inside an identification question.
The domains overlap in practice, and candidates who have done quantitative work instinctively jump to scoring, which produces the wrong answer when the question asks what should happen first.
What to do instead
Memorise the boundary: identification produces the risk register entries and scenario definitions; assessment assigns likelihood, impact, and inherent/residual values. When a stem says 'first step' or 'during identification', answer only with discovery and framing activities.
Ignoring third-party, fourth-party, and supply-chain exposure when identifying an organisation's cyber risk universe.
Candidates scope the organisation to its own perimeter, reflecting older security thinking, and miss that the exam consistently treats vendor and cloud concentration risk as in-scope identification.
What to do instead
Build a standing checklist of external dependencies: cloud providers, managed service providers, payment processors, software libraries, and data-sharing partners. In any identification question, explicitly ask whether a third party sits on the path to the loss event.
Confusing inherent risk with residual risk and applying controls before the control-adjusted figure is requested.
Candidates read a scenario describing existing controls and report the controlled number when the question asked for inherent exposure, or vice versa; the two terms look interchangeable under time pressure.
What to do instead
Before computing, underline the words 'inherent', 'current', 'residual', or 'target' in the stem. State the definition you are applying in one line, then calculate. Inherent = no controls; residual = controls as they exist today; target = controls after planned remediation.
Using qualitative high/medium/low labels in a question that supplies frequencies and loss magnitudes, or mixing the two scales in one answer.
Many candidates are more comfortable with heat maps and default to ordinal ratings even when the data supports a frequency-severity calculation, producing an answer that ignores the numbers given.
What to do instead
If the stem gives annualised frequencies, per-event losses, or a tolerance figure, compute expected loss (frequency × magnitude) and compare to tolerance. Reserve qualitative ratings for genuinely unquantified scenarios, and never blend a dollar figure with a red/amber/green label in the same conclusion.
Treating a risk assessment as a one-off project rather than a repeatable process with defined scope, methodology, data sources, and validation.
Candidates answer with a single control or tool recommendation when the question probes the assessment process itself, such as how to keep the assessment current or how to validate its inputs.
What to do instead
Learn the assessment lifecycle as distinct steps: scope and boundary setting, threat and vulnerability data collection, scenario construction, likelihood and impact estimation, calibration and challenge, and reporting to the risk committee. When a question asks 'how should the assessment be performed', answer with the process step, not a product.
Selecting a control because it is a recognised best practice rather than because it addresses the specific loss driver in the scenario.
Candidates pattern-match keywords such as 'phishing' to 'security awareness training' without checking whether the described loss came from, for example, an unpatched internet-facing service or excessive user privileges.
What to do instead
For each management question, restate the loss mechanism in one sentence before choosing. Then test each candidate control against that mechanism: does it prevent, detect, or transfer this specific loss? Reject any option that is merely generically sound.
Treating cyber risk transfer as complete once an insurance policy is purchased, without addressing exclusions, limits, sublimits, and aggregation.
Candidates equate 'buy insurance' with 'transfer the risk' and miss that cyber policies typically exclude or sublimit exactly the catastrophic scenarios the exam describes, such as systemic outages or war-related state attacks.
What to do instead
When insurance appears in an option, immediately check the scenario for aggregation risk (many simultaneous claims), named exclusions, retention levels, and whether the limit is adequate against the stated severity. Transfer answers must state what remains retained.
Proposing controls that are disproportionate to the assessed risk, either over-engineering low risks or accepting high risks with weak mitigation.
Candidates answer with the strongest available control regardless of cost or proportionality, ignoring that risk management requires treatment commensurate with exposure and tolerance.
What to do instead
Anchor every treatment recommendation to the assessed rating and the stated risk appetite. For low risks, prefer accept-and-monitor; for risks above tolerance, require treatment with an owner, deadline, and residual target. Say explicitly how the chosen treatment brings the risk within appetite.
Failing to assign ownership, monitoring, and escalation, so the answer describes a control activity but not a managed risk.
Candidates focus on the technical fix and omit the governance layer, yet exam questions on management frequently test accountability, key risk indicators, and reporting lines rather than the control itself.
What to do instead
Close every management answer with the governance triad: named accountable owner, key risk indicator with a threshold that triggers escalation, and the committee or function to which it is reported. If an answer option lacks an owner or a monitoring mechanism, treat it as incomplete.