ERM & COSO Framework Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 ERM & COSO Framework flashcards as text
Which COSO ERM component includes the process of prioritizing risks based on their severity relative to risk appetite?
Answer: Performance
The Performance component covers risk identification, assessment, prioritization, and the selection of risk responses.
A Chief Risk Officer presents a heat map showing 12 risks mapped by likelihood and impact. Which limitation of heat maps should the board be most aware of?
Answer: They may obscure the aggregate correlation between risks
Heat maps display individual risks but do not inherently capture how correlated risks can amplify each other when occurring together.
In COSO's three-lines-of-defense model, which line is responsible for providing independent assurance to the board and senior management?
Answer: Third line — internal audit
Internal audit (third line) provides independent assurance on the effectiveness of governance, risk management, and internal controls.
When applying the COSO ERM framework to a strategic merger decision, risk identification should occur:
Answer: During strategy formulation, before the final decision is made
COSO ERM emphasizes integrating risk identification into strategy-setting so that risk informs—rather than follows—major decisions.
A company's risk register shows an inherent risk rated 'High' with a residual risk rated 'Low.' What does this indicate?
Answer: Existing controls are effectively reducing the risk to an acceptable level
The gap between inherent and residual risk reflects the effectiveness of controls in mitigating exposure.
Which COSO ERM principle states that organizations should 'identify risk in the context of business context'?
Answer: Principle 10 — Identifies Risk
Principle 10 states that the organization identifies risk and considers how it might affect the achievement of strategy and business objectives.
An organization that accepts more risk than its stated appetite to pursue higher returns is exhibiting:
Answer: Risk appetite drift
Risk appetite drift occurs when actual risk-taking exceeds the formally approved appetite, often without explicit board sanction.