Practice Test Geeks(CRA) Certified Risk Architect Practice Test
← All CRA Flashcard Decks

Regulatory and Compliance Standards Flashcards

6 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Regulatory and Compliance Standards flashcards as text

  1. A Certified Risk Architect (CRA) is tasked with designing a new enterprise risk management (ERM) framework for a multinational corporation. Which of the following international standards provides a principle-based approach and general guidelines for risk management, rather than a prescriptive, certifiable management system?

    Answer: ISO 31000

    ISO 31000 provides principles and generic guidelines for risk management. It is designed to be applicable to any organization, regardless of its size, type, or sector, and it is not intended for certification purposes. Unlike ISO 9001 (quality management), SOX (US financial regulation), or COBIT (IT governance), ISO 31000 offers a flexible, high-level framework to integrate risk management into an organization's overall governance and strategy.

  2. A financial services firm is concerned about its exposure to operational, compliance, and strategic risks. The board wants to ensure that risk management is integrated with strategic planning and performance. Which framework is best suited for linking risk management directly with the organization's strategic objectives and performance?

    Answer: COSO ERM Framework

    The COSO Enterprise Risk Management (ERM) Framework is specifically designed to integrate risk management with strategy and performance to drive organizational success. While ISO 31000 provides general guidelines, COSO ERM offers a more detailed structure for aligning risk appetite with strategic goals, making it ideal for organizations looking to deeply embed risk considerations into their core operations and decision-making processes.

  3. As a Risk Architect for a healthcare technology company, you are assessing compliance risks associated with a new cloud-based platform that will store patient data. Which of the following regulatory standards would be of PRIMARY concern for this project in the United States?

    Answer: Health Insurance Portability and Accountability Act (HIPAA)

    The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data in the United States. Any company that deals with protected health information (PHI) must ensure that all the required physical, network, and process security measures are in place and followed. GDPR is the European equivalent, SOX relates to financial reporting, and PCI DSS is for payment card data.

  4. A manufacturing company is implementing its risk management process. According to the ISO 31000 standard, which of the following activities is a core part of the risk management 'process,' as distinct from the 'framework'?

    Answer: Risk Identification, Risk Analysis, and Risk Evaluation.

    ISO 31000 distinguishes between the 'framework' and the 'process.' The framework includes elements like mandate and commitment, policy design, and continual improvement of the system. The 'process' describes the specific, iterative steps for managing risks, which are: establishing the context, risk assessment (which includes identification, analysis, and evaluation), and risk treatment.

  5. During a risk architecture review for a global bank, it was found that while compliance and operational risks were well-documented in silos, there was no integrated view of how these risks could impact the achievement of strategic objectives. This is a failure to properly implement the principles of:

    Answer: Enterprise Risk Management (ERM)

    Enterprise Risk Management (ERM) is a holistic, top-down approach that aims to identify, assess, and manage all types of risks across an organization to help it achieve its strategic goals. The scenario describes a siloed approach, which is the direct opposite of the integrated, enterprise-wide perspective that ERM promotes.

  6. A Certified Risk Architect is advising a company on its compliance management system. To ensure the system is effective, it must be integrated into which broader organizational framework?

    Answer: The Enterprise Risk Management (ERM) framework.

    Compliance risk is a critical category of risk that an organization faces. Therefore, compliance risk management should not stand alone but be integrated into the overall Enterprise Risk Management (ERM) framework. This ensures that compliance risks are identified, assessed, managed, and monitored alongside other risks (e.g., operational, strategic, financial) in a consistent and holistic manner.