CRA Cheat Sheet 2026

The 30 highest-yield CRA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is a Credit Default Swap (CDS) primarily used for in risk management? → Transferring credit risk to another party
2. In scenario planning, the 'worst-case scenario' approach differs from 'most-likely scenario' planning primarily because it: → Designs plans for the most severe plausible outcome regardless of probability
3. In a corporate governance context, an 'independent director' is typically defined as one who: → Has no material relationship with the company that could impair objectivity
4. Under COSO ERM 2017, 'Substantial Change' is a trigger for which component's activities? → Review and Revision
5. During a facilitated risk workshop, participants generate risks by asking 'What could go wrong if this assumption is false?' This technique is known as: → Assumption analysis
6. A bank's KRI shows a spike in failed trade settlements over three consecutive days. What is the primary operational risk concern? → Execution, Delivery & Process Management failures
7. Which risk dashboard metric directly measures the effectiveness of risk treatment actions? → Residual risk trend over successive review periods
8. Which numerical technique is best suited for pricing path-dependent options (e.g., Asian options) where closed-form solutions do not exist? → Monte Carlo simulation
9. The 'number of simulation runs' in Monte Carlo VaR most directly affects which property of the estimate? → Statistical precision (standard error) of the VaR estimate
10. A risk appetite statement includes both qualitative and quantitative elements. What is the PRIMARY advantage of quantitative metrics in the statement? → They provide measurable thresholds that enable objective monitoring and reporting
11. A manufacturing company's ERM team identifies that a key supplier has a single point of failure. This is an example of which risk category? → Operational/supply chain risk
12. The term 'polycrisis' in global risk management refers to: → Multiple simultaneous crises that interact and amplify each other's impact
13. A company enters a joint venture specifically to share the capital cost and risk of entering a new market. This is an example of: → Risk sharing
14. What is a primary limitation of a static risk heat map? → It fails to capture changes in risk exposure over time
15. The COSO 2013 Internal Control framework requires that the five components and 17 principles be: → Present and functioning for an effective system of internal control
16. Which method for computing VaR explicitly accounts for fat tails by fitting a parametric distribution with degrees-of-freedom parameter ν? → Parametric VaR using Student's t-distribution
17. In a risk bow-tie diagram, the 'knot' in the center represents: → The critical risk event or hazard
18. What is the purpose of a risk velocity indicator on a risk dashboard? → To capture how fast a risk is moving toward or away from its impact threshold
19. A CRA professional encounters an unfamiliar situation while performing emerging & geopolitical risks duties. What is the most appropriate first action? → Consult relevant standards, guidelines, or a qualified supervisor before proceeding
20. Which credit enhancement technique involves a third party guaranteeing the debt obligations of a borrower? → Credit Guarantee
21. Which of the following is a 'people risk' sub-category of operational risk? → Key person dependency and inadequate succession planning
22. Which component of a BCP specifically addresses how an organization will maintain or restore customer-facing services during a disruption to protect revenue? → Customer continuity strategy
23. Which test is commonly used to assess whether a time series of financial returns exhibits autoregressive conditional heteroskedasticity (ARCH effects)? → Engle's ARCH-LM test
24. Which COSO ERM principle states that organizations should 'identify risk in the context of business context'? → Principle 10 — Identifies Risk
25. Under Dodd-Frank, which newly created agency oversees systemic risk in the U.S. financial system and monitors threats to financial stability? → Financial Stability Oversight Council (FSOC)
26. Which data quality issue most commonly undermines the reliability of a risk heat map? → Inconsistent scoring criteria applied by different business units
27. Which method is used for quantitative risk assessment? → Decision tree analysis
28. In quantitative risk assessment, Value at Risk (VaR) at the 95% confidence level means: → There is a 5% chance losses will exceed the VaR amount
29. Which component of the Basel III framework specifically addresses the risk of excessive bank leverage during periods of growth? → Leverage Ratio
30. In Monte Carlo simulation for interest rate risk, a mean-reverting process like Vasicek is preferred over GBM because: → Interest rates tend to revert to a long-run mean, unlike equity prices