CRMA - Certification in Risk Management Assurance Evaluating Risk Culture Questions and Answers

Question 1

An internal audit of a sales division reveals that high-performing employees are frequently celebrated for 'doing whatever it takes' to close major deals, even when this involves bypassing established credit check controls.
Management is aware of this behavior but does not intervene, citing the division's strong revenue performance.
This observation is a primary indicator of a weakness in which aspect of the risk culture?

Accepted Answer

The alignment between stated values and actual behaviors ('tone at the top').

Answer

The formal risk management framework and policies.

Answer

The effectiveness of IT general controls over sales systems.

Answer

The competency and training of the sales staff.

Question 2

A CRMA is planning an engagement to evaluate the 'tone at the middle' regarding risk management. Which of the following audit activities would provide the MOST direct insight into this area?

Accepted Answer

Conducting interviews and workshops with departmental managers to understand how they translate risk policies into daily operations.

Answer

Reviewing the board of directors' meeting minutes for discussions on risk appetite.

Answer

Analyzing the organization's annual employee compensation and bonus structure.

Answer

Testing the effectiveness of automated application controls within the ERP system.

Question 3

Which of the following is a key qualitative indicator that an organization has a strong and healthy risk culture?

Accepted Answer

Employees feel empowered to escalate concerns and report bad news without fear of reprisal.

Answer

The number of key risk indicators (KRIs) that are within their defined thresholds.

Answer

The internal audit function has a direct and unrestricted reporting line to the audit committee.

Answer

A comprehensive risk register is maintained by the risk management function and updated quarterly.

Question 4

During an audit, a CRMA observes that while the organization has a well-defined risk appetite statement approved by the board, there is little evidence that it is used to inform strategic or operational decision-making. Business unit leaders are unable to articulate their specific risk tolerances. This finding suggests a failure in:

Accepted Answer

The embedding and communication of the risk management framework.

Answer

The design of the risk appetite statement itself.

Answer

The annual risk identification and assessment process.

Answer

The effectiveness of the third line of defense (internal audit).

Question 5

When evaluating risk culture, which of the following provides the most compelling evidence of accountability for risk management?

Accepted Answer

Performance evaluations and incentive compensation plans that explicitly incorporate risk management responsibilities and outcomes.

Answer

The existence of a dedicated Chief Risk Officer (CRO) position.

Answer

A mandatory annual online training module on the code of conduct.

Answer

Quarterly reports from the risk management function to the board.

Question 6

An internal auditor is assessing the organization's risk culture. Which of the following methods is considered a primarily qualitative technique for gathering evidence?

Accepted Answer

Conducting focus groups and anonymous staff surveys about risk perceptions.

Answer

Trend analysis of health and safety incident reports over five years.

Answer

Reviewing employee turnover rates in high-risk departments.

Answer

Analyzing the percentage of overdue actions from past audit reports.