ARM Cheat Sheet 2026

The 30 highest-yield ARM facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. After a breach at a cloud vendor exposes a client's customer records, who generally bears the regulatory obligation to notify affected customers? → The data owner (the client organization)
2. The Board of Directors' primary role in strategic risk management is to: → Provide oversight and ensure risk management aligns with organizational strategy
3. Which reinsurance arrangement is negotiated separately for each individual risk? → Facultative reinsurance
4. In the IIA Three Lines Model, which role belongs to the second line? → Providing expertise, support, and challenge on risk-related matters
5. Why is a range of possible outcomes often more useful than a single expected loss figure when analyzing risk? → It shows the variability and potential for severe outcomes
6. How does risk assessment support decision-making? → By identifying and prioritizing threats.
7. Why are loss development factors applied to recent accident years in a loss projection? → To estimate the ultimate value of claims, including IBNR and growth on reported claims
8. An organization states it will accept up to a 5% variation from its targeted return on equity. This statement is best described as which of the following? → Risk tolerance
9. When selecting a risk control measure using cash flow analysis, the measure should be adopted if: → The net present value of its expected cash flows is positive
10. A retailer that processes credit card payments must comply with which industry standard governing cardholder data protection? → PCI DSS
11. Which statistical measure describes how widely individual loss outcomes are dispersed around the mean? → Standard deviation
12. Why does a larger number of similar, independent exposure units improve the accuracy of loss projections? → The law of large numbers makes actual results converge toward expected results
13. A risk manager changes only the assumed interest rate in a model to see how projected losses respond. What type of analysis is this? → Sensitivity analysis
14. A protected cell company is MOST useful because it: → Legally separates each cell's assets and liabilities from other cells
15. A contingent capital arrangement gives an organization: → The right to issue securities or borrow at prearranged terms after a specified loss occurs
16. In strategic risk management, 'risk tolerance' refers to: → The acceptable variation in outcomes relative to stated objectives
17. Which statement about cyber risk aggregation is most accurate for insurers? → A single widespread event, like a cloud outage, can trigger many correlated claims at once
18. Risk appetite in strategic risk management is best defined as: → The amount and type of risk an organization is willing to accept pursuing its objectives
19. Which catastrophe bond trigger carries the LEAST basis risk for the sponsor? → Indemnity trigger
20. What is the primary goal of risk control? → Reducing risk likelihood and impact.
21. Which technique gathers anonymous expert opinions over several rounds, with feedback after each round, until the group reaches a consensus? → Delphi technique
22. Which risk control technique is the only one that reduces the probability of loss from a specific activity to zero? → Avoidance
23. A manufacturer earns most of its revenue in euros but reports in US dollars. Its exposure to exchange-rate movements is best classified as which type of risk? → Financial risk
24. Which statement about risk according to ISO 31000 is correct? → Risk is the effect of uncertainty on objectives and can be positive or negative
25. In business continuity planning, 'Recovery Point Objective' (RPO) refers to: → The acceptable amount of data loss measured in time
26. Which type of risk assessment involves evaluating past data and trends? → Quantitative risk assessment.
27. A manufacturer forms a wholly owned insurance subsidiary that insures only the parent's own loss exposures. What type of captive is this? → Pure (single-parent) captive
28. Installing a sprinkler system in a warehouse primarily serves which purpose? → Loss reduction
29. How does risk transfer help organizations manage risk? → By shifting financial responsibility to another entity.
30. A firm's loss history shows only small, frequent losses over five years. What is the MAIN risk of relying solely on this data? → Low-frequency, high-severity exposures may be absent from the record