CRA Strategic Risk and Governance 2 — Questions and Answers
Question 1: A board's Risk Appetite Statement (RAS) sets a tolerance of 2% annual revenue loss from operational failures. When a cyber breach causes 1.8% loss, the BEST governance response is to:
- Treat the event as within tolerance and close the incident
- Escalate to the board because proximity to the limit signals control weakness (Correct answer)
- Immediately revise the RAS upward to 3%
- Transfer all residual risk to a third-party insurer
Correct answer: Escalate to the board because proximity to the limit signals control weakness
Near-miss breaches signal that controls may be inadequate even when technically within appetite, requiring board-level review.
Question 2: Which governance structure BEST supports an integrated risk architecture across business silos in a large financial institution?
- Decentralized risk ownership with no central oversight
- A Chief Risk Officer with dotted-line authority to all business lines
- A Risk Management Committee with cross-functional representation reporting to the board (Correct answer)
- Embedding risk staff exclusively within each business unit with no shared framework
Correct answer: A Risk Management Committee with cross-functional representation reporting to the board
A cross-functional Risk Management Committee with board-level reporting enables enterprise-wide visibility while preserving business ownership.
Question 3: Under the Three Lines of Defense model, internal audit's PRIMARY role in strategic risk governance is to:
- Own and manage identified strategic risks
- Design and implement risk controls for the first line
- Provide independent assurance that governance and risk processes are effective (Correct answer)
- Set the organization's risk appetite on behalf of the board
Correct answer: Provide independent assurance that governance and risk processes are effective
Internal audit (third line) provides independent assurance rather than owning or designing controls.
Question 4: A company's strategic plan projects entry into an emerging market. The risk architecture process should FIRST:
- Purchase political-risk insurance for the new market
- Perform a risk identification and materiality assessment for the market-entry strategy (Correct answer)
- Assign a risk owner after the strategy is fully implemented
- Wait for the first annual risk review cycle to assess the new exposure
Correct answer: Perform a risk identification and materiality assessment for the market-entry strategy
Risk identification and materiality assessment must precede strategic commitments so that risk-informed decisions can be made.
Question 5: Concentration risk in a strategic context refers to:
- Over-reliance on a single revenue source, customer, supplier, or geography (Correct answer)
- The tendency of senior managers to focus attention on top-rated risks only
- Capital concentration in liquid assets rather than operating investments
- The cognitive bias of focusing on risks that have occurred before
Correct answer: Over-reliance on a single revenue source, customer, supplier, or geography
Concentration risk arises when excessive exposure to a single factor amplifies potential losses if that factor deteriorates.
Question 6: When the board approves a new corporate strategy, the risk function's MOST important immediate action is to:
- Update the risk register to reflect new and changed strategic risks (Correct answer)
- Issue a press release describing the company's risk management capabilities
- Pause all ongoing risk monitoring until the new strategy is fully rolled out
- Replace existing key risk indicators with financial performance metrics only
Correct answer: Update the risk register to reflect new and changed strategic risks
Updating the risk register ensures the risk architecture reflects the new strategic direction and activates monitoring for emergent exposures.
Question 7: Which metric is MOST appropriate as a Key Risk Indicator (KRI) for strategic execution risk?
- Current ratio and quick ratio
- Percentage of strategic initiative milestones completed on schedule (Correct answer)
- Total number of employee training hours completed
- Gross margin trend over the prior five years
Correct answer: Percentage of strategic initiative milestones completed on schedule
Milestone completion rates provide forward-looking signals about whether strategy execution is on track, making them effective KRIs for execution risk.
CRA Strategic Risk and Governance 2
A board's Risk Appetite Statement (RAS) sets a tolerance of 2% annual revenue loss from operational failures.
When a cyber breach causes 1.8% loss, the BEST governance response is to: