IIA CRMA Practice Test

Certification in Risk Management Assurance (CRMA) is an IIA route for internal auditors and risk professionals focused on assurance over risk management, governance, control, and advisory activity.

Use these 12 original sample questions for initial self-assessment. They are not official IIA questions and do not reproduce a live exam; they are designed to preview risk-management assurance, governance, advisory-boundary, and evidence judgment before you choose whether this Finance Prep route is the one you want next.

What CRMA practice should test

• evaluating risk-management maturity, governance, and control design
• distinguishing assurance work from advisory support and management ownership
• choosing recommendations that improve risk oversight without compromising independence
• recognizing when evidence supports an assurance conclusion and when more work is needed

Sample Exam Questions

Use these questions to test whether you can evaluate risk management without taking over management’s risk ownership.

Question 1

Topic: risk-management maturity

An organization has a risk register, but risks are not linked to objectives, owners, appetite, controls, or monitoring. What is the best CRMA-style conclusion?

• A. The risk register proves risk management is mature
• B. The framework may be incomplete because risk information is not connected to decisions and accountability
• C. Risk registers are prohibited
• D. Internal audit should become the risk owner

Best answer: B

Explanation: Risk-management maturity requires more than a list. Risks should connect to objectives, ownership, appetite, responses, controls, monitoring, and reporting.

Question 2

Topic: risk appetite

The board approves growth targets but has not defined the level of credit, liquidity, operational, or compliance risk it is willing to accept. What is the key gap?

• A. The organization has too much risk reporting
• B. Risk appetite is unnecessary if targets are ambitious
• C. Internal audit should set risk appetite unilaterally
• D. Risk appetite has not been articulated enough to guide decisions and limits

Best answer: D

Explanation: Risk appetite translates strategy into acceptable risk boundaries. Internal audit may assess the process, but management and the board own appetite-setting.

Question 3

Topic: assurance versus ownership

Management asks internal audit to design and operate a new enterprise risk management process. What is the main concern?

• A. Internal audit independence may be impaired if it later provides assurance over a process it owns
• B. Risk management should never be documented
• C. Enterprise risk management applies only to insurers
• D. Internal audit should approve all risk responses

Best answer: A

Explanation: Internal audit can advise, facilitate, or assess, but owning or operating the risk process can impair future assurance. Management must own risk management.

Question 4

Topic: governance reporting

Risk reports to the board show only the number of risks, with no trend, severity, appetite comparison, or action status. What is the strongest issue?

• A. A risk count is always sufficient
• B. Board reporting should never include risk trends
• C. Risk reports should include fewer facts
• D. The report may not support oversight or decision-making

Best answer: D

Explanation: Effective risk reporting should help governance bodies understand exposure, trends, appetite breaches, actions, and accountability. A count alone is rarely decision-useful.

Question 5

Topic: key risk indicators

A key risk indicator has no threshold, owner, escalation path, or link to a decision. What is the best concern?

• A. Escalation is needed only after losses occur
• B. Indicators should never have thresholds
• C. Ownership makes indicators less reliable
• D. The indicator may not trigger useful risk response

Best answer: D

Explanation: KRIs should be actionable. Without thresholds, ownership, escalation, and decision linkage, they may create reporting noise rather than risk management.

Question 6

Topic: assurance evidence

Internal audit is asked to conclude that risk management is effective based only on management’s self-assessment. What should internal audit do?

• A. Accept the self-assessment as conclusive
• B. Obtain sufficient evidence, corroborate key claims, and evaluate the design and operation of risk processes
• C. Issue the conclusion without testing
• D. Avoid all use of management input

Best answer: B

Explanation: Management self-assessment can inform the audit, but assurance conclusions need sufficient, reliable, relevant evidence. Internal audit should corroborate and test where needed.

Question 7

Topic: risk culture

Employees report that risk issues are punished, so incidents are hidden until losses occur. What risk-management issue is most relevant?

• A. Weak risk culture and escalation environment
• B. Excessive transparency
• C. Too many control owners
• D. Strong risk appetite

Best answer: A

Explanation: Risk culture affects whether people identify, escalate, and address risk. Punishing transparency can hide early warning signs and undermine risk management.

Question 8

Topic: advisory engagement

Internal audit facilitates a workshop to help management identify emerging risks. Which action best preserves independence?

• A. Internal audit ranks and accepts risks on management’s behalf
• B. Internal audit documents that management owns risk decisions and responses
• C. Internal audit removes all difficult risks from the workshop
• D. Internal audit approves the budget for each response

Best answer: B

Explanation: Advisory support can be useful if roles are clear. Management should own risk decisions, responses, and acceptance; internal audit should preserve its ability to provide assurance.

Question 9

Topic: control assurance

A risk is rated high, but the main control has never been tested and has no evidence of operation. What should the assurance conclusion reflect?

• A. The control is effective because it is documented
• B. The risk should be removed from the register
• C. Evidence is insufficient to conclude the control is operating effectively
• D. Testing is unnecessary for high-risk areas

Best answer: C

Explanation: Documentation of a control is not enough. Assurance requires evidence that the control is designed appropriately and operating as intended.

Question 10

Topic: risk response

Management accepts a risk above approved appetite without board awareness. What is the most appropriate concern?

• A. Management can accept any risk without oversight
• B. Appetite applies only to financial reporting
• C. Risk acceptance may not be properly authorized or aligned with governance expectations
• D. Internal audit should secretly change the risk rating

Best answer: C

Explanation: Risk acceptance should follow the organization’s governance and authority structure. Risks outside appetite often require escalation, approval, or additional response.

Question 11

Topic: third-party risk

A critical vendor has no business-continuity evidence, weak security reporting, and no owner assigned internally. What is the best risk-assurance focus?

• A. Vendor governance, due diligence, monitoring, continuity, security, and ownership
• B. Vendor logo design
• C. The vendor’s marketing awards only
• D. Eliminating all outsourced services immediately

Best answer: A

Explanation: Third-party risk assurance should evaluate ownership, due diligence, contracts, monitoring, security, continuity, and exit or contingency arrangements. Outsourcing does not transfer all accountability.

Question 12

Topic: risk communication

A risk report uses technical language that business owners do not understand, and no decisions result from the report. What should be improved?

• A. More jargon and less action tracking
• B. Restricting the report to the risk department only
• C. Clearer risk communication linked to decisions, owners, actions, and appetite
• D. Removing risk reporting entirely

Best answer: C

Explanation: Risk communication should support action. Reports should be clear enough for owners and governance bodies to understand exposure, decisions, responsibilities, and progress.

CRMA quick checklist

• Can you tell when internal audit is providing assurance, advisory support, or improperly taking ownership?
• Can you connect risk appetite, KRIs, ownership, escalation, and board reporting?
• Can you decide whether evidence is strong enough for an assurance conclusion?

Related IIA pages

• CIA Part 1
• CIA Part 2
• IIA certification updates