Certified Risk Architect (CRA) — Questions and Answers

Question 1: As a Risk Architect for a healthcare technology company, you are assessing compliance risks associated with a new cloud-based platform that will store patient data. Which of the following regulatory standards would be of PRIMARY concern for this project in the United States?

Payment Card Industry Data Security Standard (PCI DSS)
Sarbanes-Oxley Act (SOX)
General Data Protection Regulation (GDPR)
Health Insurance Portability and Accountability Act (HIPAA) (Correct answer)

Correct answer: Health Insurance Portability and Accountability Act (HIPAA)

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data in the United States. Any company that deals with protected health information (PHI) must ensure that all the required physical, network, and process security measures are in place and followed. GDPR is the European equivalent, SOX relates to financial reporting, and PCI DSS is for payment card data.

Question 2: When using structured interviews for risk identification, what is the PRIMARY advantage over group workshops?

Interviews allow individuals to express concerns without group influence or anchoring bias (Correct answer)
Structured interviews eliminate the need for a facilitator
Structured interviews are less time-consuming than workshops
Interviews produce more quantitative risk data than workshops

Correct answer: Interviews allow individuals to express concerns without group influence or anchoring bias

One-on-one interviews prevent groupthink and anchoring bias, allowing interviewees to freely share risks they might suppress in a group setting.

Question 3: How does regulatory compliance impact risk management?

Regulatory compliance only applies to financial risks.
Regulatory compliance helps mitigate legal risks and align with industry standards (Correct answer)
Regulatory compliance has no impact on risk assessment.
Regulatory compliance is not important for risk management.

Correct answer: Regulatory compliance helps mitigate legal risks and align with industry standards

Regulatory compliance is a critical aspect of risk management, as it ensures an organization operates within legal and ethical boundaries. By adhering to regulations, organizations proactively mitigate legal risks, avoid potential fines and penalties, and enhance their reputation. It also helps align business practices with industry standards, fostering a more secure and responsible operational environment.

Question 4: A risk architect is using a sensitivity analysis to identify which project risks have the most significant potential impact on the project's overall outcome. The results are typically displayed in which type of chart?

Gantt Chart
Control Chart
Tornado Diagram (Correct answer)
Fishbone Diagram

Correct answer: Tornado Diagram

Sensitivity analysis results are most commonly displayed using a Tornado Diagram. This chart compares the relative importance of different variables by showing bars of varying lengths, with the most impactful variables at the top, resembling a tornado.

Question 5: A software development company has a zero-appetite for risks related to the breach of customer personally identifiable information (PII). Which of the following control sets would be most appropriate to align with this stated risk appetite?

A single annual data backup and a basic firewall.
Implementing end-to-end encryption, multi-factor authentication, regular vulnerability scanning, and strict access controls. (Correct answer)
Accepting the risk and setting aside a contingency fund for potential fines.
Transferring the risk by purchasing a basic cyber liability insurance policy.

Correct answer: Implementing end-to-end encryption, multi-factor authentication, regular vulnerability scanning, and strict access controls.

A zero-appetite for a specific risk implies that the organization is not willing to tolerate any exposure. This requires the implementation of the most robust and comprehensive set of controls possible to reduce the risk to the lowest possible level. The combination of encryption, MFA, vulnerability scanning, and access controls represents a strong, multi-layered defense appropriate for a zero-appetite stance. The other options represent some level of risk acceptance or insufficient control.

Question 6: What is the primary purpose of a Business Continuity Plan (BCP)?

To eliminate all possible risks to the organization
To record and archive all past disruption incidents
To provide documentation required for insurance claims
To ensure critical business functions can continue during and after a disruption (Correct answer)

Correct answer: To ensure critical business functions can continue during and after a disruption

A BCP provides documented procedures enabling an organization to maintain or quickly resume critical functions during a disruption.

Question 7: What is the key difference between Value at Risk (VaR) and Expected Shortfall (ES)?

ES averages losses beyond the VaR threshold; VaR only marks a loss quantile (Correct answer)
VaR is computed at 99% confidence; ES is always at 95%
ES ignores tail events while VaR incorporates all scenarios
VaR captures average losses; ES captures the worst single loss

Correct answer: ES averages losses beyond the VaR threshold; VaR only marks a loss quantile

Expected Shortfall (CVaR) is the mean of losses that exceed the VaR level, providing a fuller picture of tail risk.

Question 8: A risk architect recommends replacing a manual approval workflow with an automated system to reduce processing errors. This is best classified as:

Risk transfer
Residual risk acceptance
Risk avoidance
Control automation as risk reduction (Correct answer)

Correct answer: Control automation as risk reduction

Automating controls reduces the likelihood of human error, directly lowering operational risk exposure.

Question 9: A risk architect is assessing operational risk in a financial institution. Which component of the Basel III framework specifically addresses operational risk capital requirements?

Leverage Ratio Framework
Pillar 2 – Supervisory Review Process
Pillar 1 – Minimum Capital Requirements (Correct answer)
Pillar 3 – Market Discipline

Correct answer: Pillar 1 – Minimum Capital Requirements

Pillar 1 of Basel III sets minimum capital requirements that explicitly include operational risk alongside credit and market risk.

Question 10: What is the primary responsibility of a Crisis Management Team (CMT)?

To direct and coordinate the organization's strategic response to a major incident (Correct answer)
To market products and services during a business crisis
To process all insurance claims resulting from a crisis
To manage media subscription renewals during incidents

Correct answer: To direct and coordinate the organization's strategic response to a major incident

The Crisis Management Team coordinates the overall organizational response to a crisis, making strategic decisions to protect people, assets, and reputation.

Question 11: What is the primary role of senior management in a business continuity program?

To personally author all detailed technical recovery procedures
To manage IT help desk operations during active recovery scenarios
To personally conduct and lead all business continuity tests and exercises
To provide strategic direction, resources, and accountability for the BCP program (Correct answer)

Correct answer: To provide strategic direction, resources, and accountability for the BCP program

Senior management champions the BCP program, ensures adequate resources, sets risk tolerance, and holds the organization accountable for maintaining continuity capabilities.

Question 12: An organization uses penetration testing to evaluate its cybersecurity posture. This is an example of which type of control assessment?

Design effectiveness review
Inherent risk scoring
Residual risk quantification
Operating effectiveness testing (Correct answer)

Correct answer: Operating effectiveness testing

Penetration testing actively probes systems to determine whether security controls are operating effectively in practice, making it an operating effectiveness assessment.

Question 13: What is the primary purpose of a Risk Breakdown Structure (RBS) in the identification phase?

To prioritize risks by their likelihood scores
To assign financial budgets to each identified risk
To define the escalation path for each risk category
To hierarchically categorize risk sources to ensure comprehensive coverage across all domains (Correct answer)

Correct answer: To hierarchically categorize risk sources to ensure comprehensive coverage across all domains

An RBS organizes risks into a hierarchical framework by source category, helping ensure that no major risk domain is overlooked during identification.

Question 14: What is ISO 22301 the international standard for?

Environmental and sustainability management
Information security management systems
Business continuity management systems (Correct answer)
Product and service quality management systems

Correct answer: Business continuity management systems

ISO 22301 is the international standard specifying requirements for a Business Continuity Management System (BCMS) to protect against and recover from disruptions.

Question 15: In the context of credit risk, what does 'Loss Given Default' (LGD) measure?

The probability that a counterparty will default within one year
The proportion of exposure that is lost when a default occurs (Correct answer)
The time between default and recovery of assets
The total notional value of a credit portfolio

Correct answer: The proportion of exposure that is lost when a default occurs

LGD is the fraction of the exposure at default that the lender cannot recover after a counterparty defaults.

Question 16: Which U.S. regulation specifically requires broker-dealers to maintain a minimum net capital ratio and restricts the use of customer funds for proprietary activities?

SEC Rule 17a-4
Regulation SHO
SEC Rule 15c3-1 (Net Capital Rule) (Correct answer)
Regulation T

Correct answer: SEC Rule 15c3-1 (Net Capital Rule)

SEC Rule 15c3-1 establishes minimum net capital requirements for broker-dealers to ensure they have sufficient liquid assets to meet obligations to customers.

Question 17: A firm discovers that a rogue trader has been hiding losses in a fictitious account for 18 months, resulting in a $200M loss. Which Basel II event category applies?

Clients, Products and Business Practices
External Fraud
Internal Fraud (Correct answer)
Execution, Delivery and Process Management

Correct answer: Internal Fraud

Unauthorized trading and concealment of losses by an employee constitutes Internal Fraud, which covers intentional misrepresentation or asset misappropriation by insiders.

Question 18: Which of the following best describes 'epistemic uncertainty' in quantitative risk analysis?

Uncertainty caused by model parameter rounding
Uncertainty arising from lack of knowledge or data (Correct answer)
Uncertainty from inherent randomness in a process
Uncertainty from correlated risk events occurring simultaneously

Correct answer: Uncertainty arising from lack of knowledge or data

Epistemic uncertainty stems from incomplete knowledge and can theoretically be reduced by gathering more information.

Question 19: Which of the following represents the most significant challenge in managing nth-party (extended supply chain) risk?

The high licensing cost of vendor management and SLA monitoring software tools
The difficulty in identifying and onboarding first-tier direct vendors
Limited visibility into the risk controls and practices of sub-vendors beyond direct vendor relationships (Correct answer)
Excessive documentation requirements imposed by primary vendor contracts

Correct answer: Limited visibility into the risk controls and practices of sub-vendors beyond direct vendor relationships

Extended supply chain risk is inherently challenging because organizations have limited visibility into and control over the risk management practices of sub-vendors and lower-tier suppliers.

Question 20: In risk-adjusted performance measurement, RAROC is calculated as:

Gross revenue minus operational expenses
Net income divided by total assets
Expected loss divided by regulatory capital
Risk-adjusted return divided by economic capital (Correct answer)

Correct answer: Risk-adjusted return divided by economic capital

RAROC (Risk-Adjusted Return on Capital) = Risk-adjusted net income / Economic capital, used to compare performance across business units on a risk basis.

Question 21: How can technology aid in regulatory compliance?

By delaying decision-making processes.
By eliminating the need for training.
By automating monitoring and updates (Correct answer)
By reducing the need for compliance officers.

Correct answer: By automating monitoring and updates

Technology significantly aids regulatory compliance by automating various monitoring and update processes. This includes tracking regulatory changes, ensuring adherence to internal policies, generating compliance reports, and managing vast amounts of documentation. Automation reduces manual effort, improves accuracy, and enables organizations to respond quickly and efficiently to evolving compliance requirements.

Question 22: What is the primary purpose of a tabletop exercise in business continuity testing?

To discuss and walk through responses to hypothetical scenarios in a low-stress environment (Correct answer)
To audit financial records and controls for accuracy
To physically test evacuation and emergency egress procedures
To onboard new employees to standard operating procedures

Correct answer: To discuss and walk through responses to hypothetical scenarios in a low-stress environment

Tabletop exercises allow teams to verbally walk through their response to simulated crisis scenarios, identifying plan gaps without operational disruption.

Question 23: Which of the following quantitative risk analysis techniques is best suited for modeling the combined effect of uncertainties in multiple project variables to estimate the probability of achieving cost and schedule objectives?

Sensitivity Analysis
Decision Tree Analysis
Monte Carlo Simulation (Correct answer)
Expected Monetary Value (EMV)

Correct answer: Monte Carlo Simulation

Monte Carlo Simulation is a technique that runs a project model thousands of times, each time with different random values for the uncertain variables (like task durations or costs). This process generates a probability distribution of possible outcomes for the entire project, making it ideal for understanding the combined impact of multiple uncertainties on objectives like cost and schedule.

Question 24: In multi-period risk modeling, which of the following correctly describes the 'square root of time' rule for scaling VaR?

Multiply 1-day VaR by the number of holding days to get multi-day VaR
Apply the square root only when losses are negatively correlated across days
Multiply 1-day VaR by the square root of the number of holding days assuming i.i.d. returns (Correct answer)
Divide 1-year VaR by 252 to obtain daily VaR in all market conditions

Correct answer: Multiply 1-day VaR by the square root of the number of holding days assuming i.i.d. returns

Under the assumption of independent, identically distributed returns, the T-day VaR equals the 1-day VaR multiplied by √T.

Question 25: A Certified Risk Architect who discovers a material misstatement in a risk report they previously certified has an ethical obligation to:

Promptly notify appropriate parties and issue a corrected report (Correct answer)
Wait until the next reporting cycle to correct it
Treat the matter as confidential to protect the organization
Only correct it if a regulator specifically requests a revision

Correct answer: Promptly notify appropriate parties and issue a corrected report

Professional ethics require prompt notification and correction of material misstatements in certified reports, regardless of reputational inconvenience.

Question 26: Which section of the Dodd-Frank Act created the Financial Stability Oversight Council (FSOC) to identify and respond to systemic risks to U.S. financial stability?

Title II
Title VII
Title I (Correct answer)
Title X

Correct answer: Title I

Title I of the Dodd-Frank Act established FSOC and authorized it to designate nonbank financial companies as systemically important financial institutions (SIFIs).

Question 27: What is the primary challenge of unstructured data in risk management analytics?

It is difficult to analyze using traditional risk modeling tools (Correct answer)
It is inherently inaccurate and unreliable by nature
It is prohibitively expensive to store in data centers
It is only relevant to marketing and sales functions

Correct answer: It is difficult to analyze using traditional risk modeling tools

Unstructured data such as text, emails, and news requires advanced analytics like natural language processing to extract risk insights, unlike structured database records.

Question 28: The four Ts of risk response are: Tolerate, Treat, Transfer, and:

Test
Track
Transform
Terminate (Correct answer)

Correct answer: Terminate

The four Ts of risk response are Tolerate (accept), Treat (mitigate), Transfer (insure/outsource), and Terminate (avoid by ceasing the activity).

Question 29: An organization identifies that multiple independently unlikely events, if they occurred simultaneously, would create a catastrophic outcome. Which risk assessment concept describes this scenario?

Systemic risk
Compound risk or risk confluence (Correct answer)
Risk aggregation
Tail risk

Correct answer: Compound risk or risk confluence

Compound or confluent risk describes scenarios where the simultaneous occurrence of individually unlikely events combines to produce catastrophic outcomes.

Question 30: A bank's compliance testing reveals that loan officers in one branch systematically deny qualified minority applicants. This MOST likely violates which regulation?

Home Mortgage Disclosure Act (HMDA) only
Gramm-Leach-Bliley Act (GLBA)
Equal Credit Opportunity Act (ECOA) and Fair Housing Act (Correct answer)
Truth in Lending Act (TILA)

Correct answer: Equal Credit Opportunity Act (ECOA) and Fair Housing Act

Systematic denial of qualified minority applicants constitutes illegal redlining or disparate treatment, violating both ECOA and the Fair Housing Act.

Question 31: What technology platform is most commonly used for enterprise-wide real-time risk monitoring?

Standard spreadsheet applications
Email-based alert systems
Manual paper-based reporting systems
Integrated Risk Management (IRM) platforms (Correct answer)

Correct answer: Integrated Risk Management (IRM) platforms

Integrated Risk Management platforms consolidate risk data and provide real-time monitoring capabilities across multiple risk domains.

Question 32: Which metric is MOST appropriate as a Key Risk Indicator (KRI) for strategic execution risk?

Total number of employee training hours completed
Percentage of strategic initiative milestones completed on schedule (Correct answer)
Gross margin trend over the prior five years
Current ratio and quick ratio

Correct answer: Percentage of strategic initiative milestones completed on schedule

Milestone completion rates provide forward-looking signals about whether strategy execution is on track, making them effective KRIs for execution risk.

Question 33: What does Recovery Point Objective (RPO) represent in business continuity?

The ceiling on total recovery spending
The maximum acceptable amount of data loss measured in time (Correct answer)
The minimum number of data backup copies required
The geographic location of the primary recovery facility

Correct answer: The maximum acceptable amount of data loss measured in time

RPO defines the maximum tolerable data loss, representing how far back in time data can be restored from backups in a recovery scenario.

Question 34: A risk architect is reviewing a vendor contract that includes an indemnification clause requiring the vendor to cover losses from their service failures. This is an example of:

Risk avoidance
Operational risk acceptance
Contractual risk transfer (Correct answer)
Risk reduction through SLAs

Correct answer: Contractual risk transfer

An indemnification clause contractually shifts financial liability for the vendor's failures to the vendor, constituting a risk transfer mechanism.

Question 35: The EU's General Data Protection Regulation (GDPR) right to erasure primarily applies when:

An employee requests a salary increase
A data subject withdraws consent and no other legal basis exists (Correct answer)
A regulatory audit is requested
Data is encrypted at rest

Correct answer: A data subject withdraws consent and no other legal basis exists

GDPR Article 17 grants individuals the right to erasure when consent is withdrawn and no overriding legal basis for processing remains.

Question 36: What is a 'hot site' in the context of disaster recovery?

A fully operational backup facility ready for immediate takeover if the primary site fails (Correct answer)
A temporary leased office location for displaced employees
A site used exclusively for long-term data archival storage
A data center with elevated cooling requirements

Correct answer: A fully operational backup facility ready for immediate takeover if the primary site fails

A hot site is a fully equipped and operational backup facility that can immediately assume operations if the primary site becomes unavailable.

Question 37: The concept of 'regulatory capital arbitrage' refers to:

Issuing capital instruments in foreign markets to lower costs
Using regulatory differences across jurisdictions to reduce required capital below the spirit of the rules (Correct answer)
Investing excess regulatory capital in arbitrage strategies
Allocating economic capital across business lines

Correct answer: Using regulatory differences across jurisdictions to reduce required capital below the spirit of the rules

Regulatory capital arbitrage involves structuring transactions or operations to minimize required capital while circumventing the intent of capital adequacy regulations.

Question 38: A risk has a 5% annual probability of occurrence and a loss of $2 million. What is the annual expected loss (AEL)?

$400,000
$100,000 (Correct answer)
$40,000
$200,000

Correct answer: $100,000

AEL = probability × impact = 0.05 × $2,000,000 = $100,000.

Question 39: A risk architect is evaluating whether to recommend risk avoidance, reduction, sharing, or acceptance for a new product line. This decision framework is BEST known as:

Risk identification cycle
Risk scoring matrix
Risk aggregation protocol
Risk treatment selection (Correct answer)

Correct answer: Risk treatment selection

Choosing among avoid, reduce, share, and accept options is the core of the risk treatment selection process in ERM frameworks.

Question 40: What is the significance of transparency in compliance?

It avoids penalties and fines.
It leads to fewer regulatory checks.
It promotes trust and accountability (Correct answer)
It reduces the need for ethical standards.

Correct answer: It promotes trust and accountability

Transparency in compliance is significant because it fosters trust and accountability both internally and externally. By openly communicating compliance efforts and outcomes, organizations demonstrate their commitment to ethical conduct and regulatory adherence. This openness builds confidence with regulators, customers, and the public, while also encouraging a culture of responsibility within the organization.

Question 41: What distinguishes a 'near miss' from an operational loss event in loss data collection?

Near misses involve external parties while loss events are internal
A near miss is an event that could have resulted in a loss but did not due to chance or control intervention (Correct answer)
A near miss always exceeds the reporting threshold
Near misses are always caused by technology failures

Correct answer: A near miss is an event that could have resulted in a loss but did not due to chance or control intervention

A near miss is an incident where a loss was averted—by luck or control—providing valuable risk intelligence without an actual financial impact.

Question 42: In a Monte Carlo simulation for project risk, what does the 80th percentile of the cost distribution represent?

The cost value below which 80% of simulated outcomes fall (Correct answer)
The average expected cost outcome
The cost associated with 80% probability of project failure
The maximum possible cost in the simulation

Correct answer: The cost value below which 80% of simulated outcomes fall

The 80th percentile means 80% of simulated outcomes produced a cost at or below that value, making it a confidence threshold.

Question 43: Which control is most effective at mitigating the risk of ransomware causing permanent data loss?

Firewall rules blocking inbound traffic
User awareness training alone
Regular offline or immutable data backups (Correct answer)
Real-time antivirus scanning only

Correct answer: Regular offline or immutable data backups

Immutable or offline backups ensure data can be restored even after ransomware encrypts production systems, directly mitigating the impact of an attack.

Question 44: What is cyber resilience in the context of business continuity management?

The practice of installing stronger network firewalls and perimeter defenses
The policy of hiring additional cybersecurity personnel
The strategy of eliminating all external internet connectivity
The ability to continuously deliver intended outcomes despite cyber attacks or incidents (Correct answer)

Correct answer: The ability to continuously deliver intended outcomes despite cyber attacks or incidents

Cyber resilience combines cybersecurity with business continuity, ensuring the organization can maintain operations and recover quickly from cyber incidents.

Question 45: When applying a risk mitigation hierarchy, which approach should typically be considered first before other response strategies?

Risk acceptance
Risk elimination (avoidance) (Correct answer)
Risk transfer
Risk reduction

Correct answer: Risk elimination (avoidance)

Risk elimination — removing the source of the risk entirely — is the most effective response and should be evaluated before less complete strategies.

Question 46: How is organizational resilience best defined in a risk management context?

The ability to completely prevent all business disruptions
The number of redundant backup systems deployed
The capacity to anticipate, absorb, and adapt to disruptions while maintaining core functions (Correct answer)
The total financial reserves held for emergency expenditures

Correct answer: The capacity to anticipate, absorb, and adapt to disruptions while maintaining core functions

Organizational resilience is the ability to anticipate threats, withstand shocks, and adapt and recover while continuing to deliver core objectives.

Question 47: The 'four-eyes principle' in compliance and risk governance requires that:

All risk models must be reviewed by four separate analysts
Quarterly risk reports require four levels of sign-off
Significant decisions or transactions require approval by at least two authorized individuals (Correct answer)
Audit committees must have four independent directors

Correct answer: Significant decisions or transactions require approval by at least two authorized individuals

The four-eyes principle mandates that consequential actions require review and approval by a second authorized person to prevent errors and fraud.

Question 48: What is the key distinction between business continuity and disaster recovery?

Business continuity only applies to regulated financial firms
Disaster recovery has broader scope than business continuity
They are identical disciplines with different names
Business continuity addresses maintaining all operations broadly; disaster recovery focuses specifically on restoring IT systems (Correct answer)

Correct answer: Business continuity addresses maintaining all operations broadly; disaster recovery focuses specifically on restoring IT systems

Business continuity encompasses maintaining all critical business functions during a disruption, while disaster recovery specifically addresses restoring IT systems and data.

Question 49: Which of the following is a key limitation of using historical data alone for quantitative operational risk modeling?

Historical data is always too large to process statistically
Rare tail events may not be represented in the historical record (Correct answer)
Historical data cannot be used to calculate frequency distributions
Regulatory frameworks prohibit using historical data for capital models

Correct answer: Rare tail events may not be represented in the historical record

Black swan or low-frequency, high-severity events may simply not appear in historical datasets, causing models to underestimate tail risk.

Question 50: Under the Three Lines of Defense model, internal audit's PRIMARY role in strategic risk governance is to:

Provide independent assurance that governance and risk processes are effective (Correct answer)
Design and implement risk controls for the first line
Set the organization's risk appetite on behalf of the board
Own and manage identified strategic risks

Correct answer: Provide independent assurance that governance and risk processes are effective

Internal audit (third line) provides independent assurance rather than owning or designing controls.

Certified Risk Architect (CRA)

The Certified Risk Architect (CRA) credential validates expertise in designing and implementing enterprise risk management frameworks, covering business continuity, regulatory compliance, quantitative risk analysis, mitigation strategies, and risk technology.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds