ARM - Associate in Risk Management — Questions and Answers

Question 1: When evaluating a proposed risk control measure, a risk manager discounts its expected future after-tax cash flows and subtracts the initial cost. Which method is being used?

Net present value analysis (Correct answer)
Payback period
Loss triangle development
Probability analysis

Correct answer: Net present value analysis

NPV compares the present value of future cash flows with the investment's upfront cost.

Question 2: A catastrophe bond pays investors' principal to the issuer when a hurricane's measured wind speed at set locations passes a threshold. What trigger is this?

Parametric trigger (Correct answer)
Modeled loss trigger
Indemnity trigger
Industry index trigger

Correct answer: Parametric trigger

Parametric triggers are based on physical measures of an event, not actual losses.

Question 3: Which type of risk assessment involves evaluating past data and trends?

Subjective risk evaluation.
Quantitative risk assessment. (Correct answer)
Qualitative risk assessment.
Heuristic risk modeling.

Correct answer: Quantitative risk assessment.

Quantitative risk assessment involves using numerical data, statistical analysis, and mathematical models to analyze and evaluate risks. This approach relies on past data, historical trends, and objective measurements to assign monetary values or probabilities to risks, providing a more precise understanding of their potential financial impact or frequency. Qualitative assessment, in contrast, uses descriptive categories.

Question 4: Business interruption insurance in the context of business continuity primarily covers:

Lost income and ongoing expenses when operations are disrupted by a covered event (Correct answer)
Data breach notification costs
Physical damage to company property
Employee health and disability claims

Correct answer: Lost income and ongoing expenses when operations are disrupted by a covered event

Business interruption insurance replaces lost revenue and covers fixed operating expenses during the period when normal operations are suspended due to a covered loss.

Question 5: According to Haddon's energy release theory, what is the first and most basic strategy for preventing harm?

Make the target more resistant to damage
Start recovery and rehabilitation
Prevent the creation of the hazard in the first place (Correct answer)
Separate the hazard from what it could harm

Correct answer: Prevent the creation of the hazard in the first place

Haddon's first strategy is to prevent the hazardous energy from being created at all.

Question 6: Which term describes the risk that remains after risk treatment has been applied?

Residual risk (Correct answer)
Speculative risk
Systemic risk
Inherent risk

Correct answer: Residual risk

Residual risk is whatever exposure remains after controls and financing measures are in place.

Question 7: Two loss distributions have the same mean, but Distribution A has a larger standard deviation. What can be concluded?

Distribution A's outcomes are less predictable (Correct answer)
Distribution A is normally distributed
Distribution A has fewer losses
Distribution A has a higher expected loss

Correct answer: Distribution A's outcomes are less predictable

A larger standard deviation means greater dispersion around the mean, so outcomes are less predictable.

Question 8: A firm keeps its cyber insurance deductible high and self-funds small incidents. This is an example of combining transfer with:

Risk avoidance
Separation
Hedging
Risk retention (Correct answer)

Correct answer: Risk retention

Paying losses below the deductible from the firm's own funds is risk retention.

Question 9: Which probability distribution is most often used to model the number of losses (loss frequency) in a period?

Lognormal distribution
Poisson distribution (Correct answer)
Uniform distribution
Normal distribution

Correct answer: Poisson distribution

The Poisson distribution models how many discrete events occur in a fixed period, so it is a standard choice for loss frequency.

Question 10: A company averages 20 property losses per year with an average severity of $5,000 per loss. What is its expected annual loss?

$100,000 (Correct answer)
$4,000
$5,000
$25,000

Correct answer: $100,000

Expected loss equals frequency times severity: 20 × $5,000 = $100,000.

Question 11: Why might an organization adopt a risk control measure even if its cash flow analysis shows a negative net present value?

Because insurers prohibit cash flow analysis
Because of legal requirements, social responsibility, or nonfinancial goals such as employee safety (Correct answer)
Because risk control costs are tax-exempt
Because negative NPV always means losses will increase

Correct answer: Because of legal requirements, social responsibility, or nonfinancial goals such as employee safety

Legal mandates, ethical duties, and goals like humanitarian concern or public image can justify measures that are not financially optimal.

Question 12: An unpatched server with a known vulnerability sits on an internet-facing network. In risk terms, the unpatched software is best described as a:

Consequence
Vulnerability (Correct answer)
Loss
Threat

Correct answer: Vulnerability

A vulnerability is a weakness that a threat can exploit to cause a loss.

Question 13: Installing a sprinkler system in a warehouse primarily serves which purpose?

Risk transfer
Risk avoidance
Loss reduction (Correct answer)
Loss prevention

Correct answer: Loss reduction

Sprinklers reduce the severity of a fire once it starts rather than preventing it from occurring.

Question 14: Which reinsurance arrangement is negotiated separately for each individual risk?

Treaty reinsurance
Catastrophe treaty
Facultative reinsurance (Correct answer)
Quota share treaty

Correct answer: Facultative reinsurance

Facultative reinsurance is placed risk by risk, and the reinsurer may accept or decline each one.

Question 15: The Basel Committee defines operational risk as the risk of loss resulting from which of the following?

Changes in interest rates and currency values
Poor long-term strategic decisions by the board
Inadequate or failed internal processes, people, and systems or from external events (Correct answer)
A counterparty's failure to pay its obligations

Correct answer: Inadequate or failed internal processes, people, and systems or from external events

Basel defines operational risk as loss from failed internal processes, people, and systems or from external events, including legal risk but excluding strategic and reputational risk.

Question 16: Which international standard provides guidance on business continuity management systems?

ISO 14001
ISO 22301 (Correct answer)
ISO 9001
ISO 31000

Correct answer: ISO 22301

ISO 22301 is the international standard specifically designed to specify requirements for a business continuity management system (BCMS).

Question 17: A manufacturer worried about rising copper prices buys copper futures contracts. Which risk management technique is this?

Noninsurance risk control
Insurance
Hedging (Correct answer)
Retention

Correct answer: Hedging

Futures contracts offset price risk and are a form of hedging.

Question 18: Which strategic risk management approach involves deliberately accepting higher risk to pursue greater potential returns?

Risk avoidance
Risk sharing
Risk exploitation (Correct answer)
Risk mitigation

Correct answer: Risk exploitation

Risk exploitation involves deliberately increasing exposure to certain risks to capitalize on the opportunities and returns they present.

Question 19: An organization holds several exposures that are strongly positively correlated. How does this affect its risk portfolio?

The exposures offset one another
Diversification benefits increase
Diversification benefits decrease because losses tend to occur together (Correct answer)
Overall variability becomes zero

Correct answer: Diversification benefits decrease because losses tend to occur together

Positively correlated exposures tend to produce losses at the same time, which reduces the risk-reducing benefit of diversification.

Question 20: Which practice best reduces the likelihood that a single malicious insider can commit and conceal a fraudulent data change?

Data compression
Annual antivirus updates
Network address translation
Segregation of duties (Correct answer)

Correct answer: Segregation of duties

Segregation of duties requires more than one person to complete sensitive tasks, making concealment harder.

Question 21: What does Monte Carlo simulation mainly do in ERM risk quantification?

Ranks risks purely by management opinion
Sets a single point estimate using only historical averages
Runs many random trials of uncertain variables to produce a probability distribution of outcomes (Correct answer)
Removes uncertainty from forecasts

Correct answer: Runs many random trials of uncertain variables to produce a probability distribution of outcomes

Monte Carlo simulation repeatedly samples from input distributions to build a full distribution of possible outcomes.

Question 22: Which of the following BEST describes 'emerging risks' in strategic risk management?

Risks that have been transferred to third parties
Newly developing or evolving risks that are difficult to assess (Correct answer)
Risks that are fully quantified and well-managed
Risks that have already caused major financial losses

Correct answer: Newly developing or evolving risks that are difficult to assess

Emerging risks are new or changing risks that lack historical data, making them challenging to quantify and manage proactively.

Question 23: Which of the following strategies is specifically designed to use financial derivatives to offset potential losses from price movements?

Retention
Risk avoidance
Hedging with derivatives (Correct answer)
Diversification

Correct answer: Hedging with derivatives

Hedging with derivatives (such as options, futures, or swaps) creates a counterbalancing position that offsets losses from adverse price movements in an underlying exposure.

Question 24: In a holistic approach to risk, senior management's role is critical. What is one of their primary responsibilities in establishing a holistic framework?

Establishing the organization's overall risk appetite and cascading it down through the organization. (Correct answer)
Personally investigating every minor operational failure.
Selecting the insurance broker for every individual policy.
Conducting daily risk monitoring for every department.

Correct answer: Establishing the organization's overall risk appetite and cascading it down through the organization.

A key aspect of a holistic or ERM approach is that senior management establishes the enterprise's appetite for risk in the context of its strategic objectives. They then determine how to communicate and implement this appetite down through the organization via risk tolerances and limits.

Question 25: Which tool plots risks on a grid by likelihood and impact so that managers can prioritize them visually?

Risk map (heat map) (Correct answer)
Organizational chart
Gantt chart
Cash flow statement

Correct answer: Risk map (heat map)

A risk map places each risk by its likelihood and severity, which makes high-priority risks easy to see.

Question 26: A risk manager determines that the most a fire could reasonably cost under normal conditions is $2 million. This figure is BEST described as:

Retained loss
Maximum possible loss
Expected loss
Probable maximum loss (Correct answer)

Correct answer: Probable maximum loss

Probable maximum loss is the largest loss likely to occur, whereas maximum possible loss is the worst-case total loss.

Question 27: An organization sets aside a dedicated reserve fund to pay for retained losses. This is an example of:

Unfunded retention
Funded retention (Correct answer)
Guaranteed cost insurance
Hold-harmless transfer

Correct answer: Funded retention

Funded retention means money is set aside in advance to pay retained losses.

Question 28: Which statement about cyber risk aggregation is most accurate for insurers?

Aggregation only affects property insurers
Aggregation is eliminated by small deductibles
Cyber losses are independent like auto accidents
A single widespread event, like a cloud outage, can trigger many correlated claims at once (Correct answer)

Correct answer: A single widespread event, like a cloud outage, can trigger many correlated claims at once

Shared technology dependencies mean one event can hit many insureds simultaneously, creating accumulation risk.

Question 29: An organization is implementing multi-factor authentication (MFA) as a security control. This measure is primarily designed to mitigate the risk associated with what common cyber threat?

Fileless malware
Unpatched software vulnerabilities
Distributed Denial-of-Service (DDoS) attacks
Compromised credentials (Correct answer)

Correct answer: Compromised credentials

Multi-factor authentication (MFA) requires a user to provide two or more verification factors to gain access to a resource. Its primary purpose is to add another layer of security beyond just a password. If a user's password (their credential) is stolen or compromised, MFA prevents an attacker from using it to gain unauthorized access because they would still need the second factor (e.g., a code from a mobile app).

Question 30: A manufacturer keeps a full set of critical machine parts at an off-site warehouse that is used only if the primary stock is destroyed. Which risk control technique is this?

Duplication (Correct answer)
Separation
Diversification
Loss prevention

Correct answer: Duplication

Duplication relies on backups or spares that are not used in daily operations unless a loss occurs.

Question 31: A plastics manufacturing plant experiences a fire that severely damages its primary production line, forcing a shutdown for three months. While property insurance covers the cost to repair the machinery, the company loses $5 million in profits and incurs extra expenses to outsource some production temporarily. These lost profits and extra expenses are classified as what type of loss?

Business income (interruption) loss (Correct answer)
Direct loss
General liability loss
Asset depreciation loss

Correct answer: Business income (interruption) loss

A business income loss, also known as business interruption, is an indirect or consequential loss. It results from a direct loss (the physical damage from the fire) and is designed to cover the net income that would have been earned and any continuing normal operating expenses. Direct loss refers only to the physical damage to the property itself.

Question 32: What distinguishes a disaster recovery plan from a business continuity plan?

Disaster recovery focuses on preventing disasters while BCP focuses on response
Disaster recovery specifically addresses IT and technology restoration, while BCP covers all critical business functions (Correct answer)
There is no distinction between the two plans
Disaster recovery applies only to financial institutions

Correct answer: Disaster recovery specifically addresses IT and technology restoration, while BCP covers all critical business functions

Disaster recovery focuses primarily on restoring IT systems and data, while a BCP encompasses the full range of critical business operations.

Question 33: A financial services firm discovers that an unauthorized third party accessed and potentially exfiltrated a database containing the names, addresses, and social security numbers of thousands of its customers. According to most U.S. state data breach notification laws, which of the following is the firm's most critical and immediate responsibility?

Launching a public relations campaign to manage reputational damage.
Determining the financial impact on the firm.
Notifying affected individuals, and potentially regulators, without unreasonable delay. (Correct answer)
Terminating the employees responsible for the security lapse.

Correct answer: Notifying affected individuals, and potentially regulators, without unreasonable delay.

All 50 states have data breach notification laws that require organizations to inform affected individuals when their personally identifiable information (PII) is compromised. The primary and most urgent obligation is to notify these individuals and, in many cases, state regulators or attorneys general, so they can take steps to protect themselves from identity theft or fraud. While other actions are important parts of incident response, notification is the key legal requirement.

Question 34: When selecting a risk control measure using cash flow analysis, the measure should be adopted if:

It eliminates all loss frequency
It is required by the insurer
Its initial cost is lower than the annual insurance premium
The net present value of its expected cash flows is positive (Correct answer)

Correct answer: The net present value of its expected cash flows is positive

A positive NPV indicates the measure's discounted benefits, such as reduced losses and premiums, exceed its costs.

Question 35: A manufacturer's operations halt for six days after ransomware encrypts its production servers, though no customer data is stolen. Which first-party cyber insurance coverage most directly responds to the lost profits?

Privacy liability
Media liability
Network security liability
Business interruption (Correct answer)

Correct answer: Business interruption

Cyber business interruption coverage pays lost income and extra expense caused by a network outage.

Question 36: In a business continuity plan, the recovery time objective (RTO) refers to:

The average time between losses
The target time within which a critical function must be restored after a disruption (Correct answer)
The maximum data loss measured in time
The time needed to settle the insurance claim

Correct answer: The target time within which a critical function must be restored after a disruption

RTO is the maximum acceptable downtime before a critical process must be back up and running.

Question 37: A risk control measure lowers expected losses but also slows production enough to cut revenue. When the risk manager judges whether the measure is worthwhile, this lost revenue should be:

Included as a cost when evaluating the measure's net cash flows (Correct answer)
Counted only if the measure is required by law
Treated as a retained loss
Ignored, because only loss savings matter

Correct answer: Included as a cost when evaluating the measure's net cash flows

Cash flow analysis must include any revenue reductions the measure causes, not just its direct costs.

Question 38: A manufacturing company is conducting a comprehensive risk identification process. The risk management team decides to analyze the company's internal capabilities, such as its skilled workforce and proprietary technology, as well as external factors like new market entrants and changing regulations. Which of the following identification tools is best suited for this type of analysis?

Checklists and Questionnaires
Process Flow Analysis
Incident Analysis
SWOT Analysis (Correct answer)

Correct answer: SWOT Analysis

SWOT Analysis is a strategic planning technique used to identify Strengths, Weaknesses, Opportunities, and Threats related to a project or business venture. It is ideal for evaluating both internal (Strengths, Weaknesses) and external (Opportunities, Threats) factors. [22, 27, 28]

Question 39: In business continuity management, the maximum time a critical process can be down before unacceptable consequences occur is used to set the:

Expense ratio
Loss ratio
Recovery time objective (Correct answer)
Recovery point objective

Correct answer: Recovery time objective

The recovery time objective sets the target time for restoring a process before the outage becomes unacceptable.

Question 40: Which of the following best describes the primary purpose of network segmentation as a cyber risk control measure?

To encrypt all data that travels between different parts of the network.
To contain the impact of a breach by limiting an attacker's ability to move laterally across the network. (Correct answer)
To monitor all incoming and outgoing network traffic for viruses.
To ensure all employees have access to the resources they need.

Correct answer: To contain the impact of a breach by limiting an attacker's ability to move laterally across the network.

Network segmentation involves dividing a computer network into smaller, isolated subnetworks. Its main security benefit is that if one segment is compromised, the breach can be contained within that subnetwork, preventing the attacker from easily accessing other parts of the organization's systems and data. This limits the overall impact of a security incident.

Question 41: The Technique of Operations Review (TOR) attributes accidents primarily to:

Failures of management and supervisory systems (Correct answer)
Random chance and natural hazards
Inherited personality traits of workers
Defective equipment design alone

Correct answer: Failures of management and supervisory systems

TOR holds that accidents stem from operational errors that management controls, not just individual worker mistakes.

Question 42: Which risk financing approach is BEST suited to losses of high frequency and low severity?

Retention (Correct answer)
Excess of loss reinsurance
Contingent capital
Purchasing catastrophe bonds

Correct answer: Retention

Frequent, small losses are predictable and generally more economical to retain.

Question 43: Which of the following is generally the most appropriate risk control strategy for a low-frequency, high-severity exposure such as an earthquake?

Loss prevention aimed at stopping earthquakes
Loss reduction and contingency planning combined with risk transfer (Correct answer)
Retaining the full exposure with no controls
Ignoring the exposure because losses are rare

Correct answer: Loss reduction and contingency planning combined with risk transfer

Since earthquakes cannot be prevented, organizations focus on limiting severity, planning for recovery, and transferring the financial impact.

Question 44: A company's earthquake exposure produces an expected loss of $50,000 per year. How is expected loss calculated?

Maximum possible loss minus deductible
Frequency plus severity
Frequency multiplied by severity (Correct answer)
Severity divided by frequency

Correct answer: Frequency multiplied by severity

Expected loss (expected value) equals the average number of losses times the average size of each loss.

Question 45: Market risk is best characterized as:

Risk arising exclusively from equity price movements
The risk that a competitor launches a superior product
Operational risk caused by inefficient trading systems
The risk of loss from adverse changes in market prices, including equities, commodities, interest rates, and foreign exchange (Correct answer)

Correct answer: The risk of loss from adverse changes in market prices, including equities, commodities, interest rates, and foreign exchange

Market risk (also called systematic risk) is the broad risk of losses from unfavorable movements in any traded market variable, not just equities.

Question 46: A smartphone manufacturer relies exclusively on one supplier in a single geographic region for its high-resolution camera sensors. A fire at the supplier's factory halts production for six months, causing a major disruption. This situation is a primary example of which type of operational risk?

Legal risk from non-compliance with regulations.
Process risk due to single-source dependency. (Correct answer)
Systems risk related to internal software failure.
People risk stemming from inadequate employee training.

Correct answer: Process risk due to single-source dependency.

This scenario highlights a process risk, specifically the vulnerability created by a single point of failure in the supply chain. Over-reliance on a single supplier is a classic operational process risk that can be triggered by an external event (like a fire at the supplier's facility). The other options are incorrect as the root cause is not related to employee actions, internal systems, or legal compliance.

Question 47: Liquidity risk in financial risk management refers to:

The chance that customers will pay their invoices late
The risk that an organization cannot easily buy or sell an asset without significantly affecting its price, or cannot meet short-term obligations (Correct answer)
The risk that cash reserves will earn below-inflation returns
The probability that a company's stock will be delisted from an exchange

Correct answer: The risk that an organization cannot easily buy or sell an asset without significantly affecting its price, or cannot meet short-term obligations

Liquidity risk encompasses both the inability to convert assets to cash at fair value (market liquidity risk) and the inability to fund obligations when due (funding liquidity risk).

Question 48: Crisis communication planning is critical to business continuity because it:

Replaces the need for a formal BCP
Reduces the organization's tax liabilities
Is required only for publicly traded companies
Ensures stakeholders receive timely, accurate information during disruptions (Correct answer)

Correct answer: Ensures stakeholders receive timely, accurate information during disruptions

Effective crisis communication maintains stakeholder trust and prevents misinformation from compounding the impact of a disruption.

Question 49: A 'hot site' in business continuity planning refers to:

A location where sensitive documents are archived
A fully equipped backup facility that can immediately assume operations after a disruption (Correct answer)
A geographic region with high natural disaster risk
An online portal for reporting risk incidents

Correct answer: A fully equipped backup facility that can immediately assume operations after a disruption

A hot site is a fully operational duplicate of the primary facility that can take over operations immediately with minimal activation time.

Question 50: A manufacturing company relies on a third-party cloud provider to host its critical production and inventory management software. A vulnerability in the cloud provider's platform leads to a significant data breach, exposing the manufacturer's sensitive operational data. This scenario is a prime example of which type of cyber risk?

Supply chain risk (Correct answer)
Reputational risk
Insider threat
Operational risk

Correct answer: Supply chain risk

This is a classic example of supply chain risk, where a vulnerability in a third-party vendor or partner creates a risk for the primary organization. The company's security is dependent on the security of its supplier (the cloud provider). The breach originated with a third party in the company's supply chain, not from an internal employee or a direct failure of its own operational processes.

Question 51: A technology company is developing a new software product. The project team identifies a potential risk that a key competitor might launch a similar product first. To address this, they decide to allocate additional resources to accelerate their development timeline. This action is an example of which component of the risk management process?

Risk Identification
Risk Monitoring
Risk Assessment
Risk Treatment (Correct answer)

Correct answer: Risk Treatment

Risk Treatment (or Risk Response) involves selecting and implementing options for addressing risk. In this scenario, the company is taking a specific action (accelerating development) to modify the risk, which is a core activity of risk treatment.

ARM - Associate in Risk Management

The ARM designation from The Institutes validates expertise in identifying, assessing, and treating organizational risks across three exams: ARM 400 (Risk in an Evolving World), ARM 401 (Holistically Assessing Risk), and ARM 402 (Successfully Treating Risk).

Questions

65 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds