CRMA CRMA - Certification in Risk Management Assurance Emerging Risks and Technology Questions and Answers

Question 1

Which of the following BEST describes an 'emerging risk' in the context of enterprise risk management?

Accepted Answer

A risk that is newly identified, evolving in nature, or increasing in significance with high uncertainty about its likelihood and impact

Answer

A risk that has already materialized into a loss event but has not yet been fully resolved

Answer

A risk that is currently managed below the organization's risk appetite threshold

Answer

A risk exclusively associated with new technology implementations

Question 2

How should the CRMA professional approach the assessment of cybersecurity risk within an ERM framework?

Accepted Answer

Treat cybersecurity as an enterprise risk requiring board-level oversight, risk appetite alignment, and integrated assurance across all three lines

Answer

Delegate cybersecurity risk entirely to the IT department as a technical matter outside ERM scope

Answer

Assess cybersecurity risk only when a breach has already occurred

Answer

Include cybersecurity only in the IT audit plan, not the overall risk register

Question 3

When using data analytics in a risk-based internal audit engagement, which benefit is MOST significant for the CRMA professional?

Accepted Answer

The ability to analyze entire populations of transactions rather than samples, increasing the likelihood of identifying anomalies and control failures

Answer

Eliminating the need for professional judgment in risk assessments

Answer

Replacing qualitative risk interviews with automated scoring models

Answer

Reducing the need to document audit evidence since analytics are self-explanatory

Question 4

An organization is deploying artificial intelligence in a high-stakes decision-making process. Which risk category is MOST unique to AI compared to traditional software systems?

Accepted Answer

Algorithmic bias risk — the possibility that AI outputs systematically disadvantage certain groups based on flawed training data

Answer

Operational downtime risk from system outages

Answer

Vendor concentration risk from reliance on a single technology provider

Answer

Data storage costs exceeding budget projections

Question 5

Which framework is MOST commonly referenced when assessing risks related to information technology and cybersecurity controls in a US organization?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

ISO 31000

Answer

COSO ERM 2017

Answer

Basel III

Question 6

Which of the following represents the MOST effective way for internal audit to stay current on emerging technology risks?

Accepted Answer

Continuously updating the risk assessment through horizon scanning, technology-specific training, and engaging subject matter experts

Answer

Waiting for a technology risk to materialize before including it in the audit plan

Answer

Relying solely on prior-year audit findings to identify technology risks

Answer

Limiting technology risk coverage to systems managed by the IT department only