CRMC practice questions
Management and Strategy Institute (MSI) · CRMC · 300 questions
Validates foundational corporate risk management skills issued by the Management and Strategy Institute, covering risk identification and evaluation, the control-measure hierarchy, risk treatment options (reduce, transfer, avoid, accept), business impact analysis, disaster recovery planning, and enterprise risk management frameworks including ISO 31000.
This course contains the use of artificial intelligence.
About the CRMC exam
- Exam fee
- $299.95 USD
- Format
- Online, open-note, timed multiple choice; taken from home or work with no advance scheduling
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Foundations of Corporate Risk Management · 100 questions
- A township board calls every rainy-day delay a "hazard" and every unpaid invoice a "risk" interchangeably. Which clarification should the risk manager give?
- A parks director wants one sentence for council on why the city needs a risk manager at all. Which statement best captures the purpose?
- A new hire asks whether risk management only covers insurance buying. Which response is most accurate?
- A library board wonders if "risk" includes losing patron trust after a data mishap, not just money. What should the risk manager confirm?
- A utilities manager claims hazards and risks are the same because both can hurt people. Which distinction should the risk manager reinforce?
- A city manager asks what "corporate" risk management means for a public agency that is not a stock company. Which answer is correct?
- Staff say risk management is only for after accidents happen. How should the risk manager correct that view?
- A finance chair thinks market stock swings are irrelevant because the city is not publicly traded — yet vendor price shocks still hit the budget. What point should the risk manager make?
- A safety poster defines hazard as "anything that might go wrong someday." What correction belongs on the poster?
- An ops lead asks whether customer and vendor relationship damage counts as a corporate risk. Which answer is correct?
- A department head wants risk management only for OSHA inspections and nothing else. How should the risk manager respond?
- Council asks if quality-management and safety guidelines are part of a risk manager's role. What is the accurate reply?
- A supervisor says every industry has the same top five risks so templates never need localizing. Which correction is needed?
- Internal audit is proposed as unrelated to risk management. Which statement corrects that view?
- A clerk equates "risk" with "we might get sued" only. What broader view should replace that definition?
- A board member asks for the difference between eliminating a wet floor and "managing risk." Which explanation is correct?
- Training slides claim risk management guarantees zero incidents forever. What should replace that claim?
- A mayor asks how risk management supports long-term organizational resilience. Which answer best fits?
- Someone argues only private corporations need CRMC-style skills. Which rebuttal is correct?
- A volunteer coordinator confuses a frayed extension cord (hazard) with the chance of fire during an event (risk). How should the labels be corrected?
- A parks seasonal worker sees a cracked bleacher and emails the mayor directly, skipping the facilities supervisor. What practice should the risk manager reinforce?
- Two departments both think the other owns reporting a recurring HVAC odor near servers. What should the risk manager establish?
- A new org chart removes the safety coordinator box; staff no longer know whom to call about near-misses. What must leadership restore?
- A director insists only C-suite may hear about risks, so supervisors stay silent. Which correction is needed?
- Union stewards and facilities disagree who briefs contractors on site hazards. What should the risk manager ensure?
- A city uses Slack for urgent gas-smell reports and paper forms for routine trip hazards, but nobody has written which channel is for which situation. What should the risk manager do first?
- An intern spots a recurring phishing pattern in city email but only mentions it to a friend who works at another agency. What is the correct next step for information-risk reporting?
- Operations hears that a key supplier will miss deliveries but refuses to tell purchasing because 'that is their problem.' What corporate risk-communication principle is violated?
- A board packet buries a critical structural crack finding in an unread appendix while the cover memo highlights only routine metrics. How should high-severity risks be escalated?
- Night-shift staff discover a serious safety issue but find no on-call risk contact listed for off hours. What gap does this reveal?
- A manager rewrites the escalation SOP verbally every week and never leaves a written path. What should replace that practice?
- Facilities finds mold in a public building and reports it to HR because 'people issues go to HR.' What is the better routing approach?
- A risk committee updates the register with new control requirements, but the department that must implement those controls never hears the decision. What communication step is missing?
- Council members insist every minor spill report appear in the public meeting packet alongside strategic risks. What reporting principle should guide the risk manager?
- A hybrid team works remotely but still shares a civic building; after hours, nobody has a shared channel to report building-access risks. What should leadership design?
- After a water leak, one deputy director orders the gallery kept open while another orders an immediate shutdown, and frontline staff freeze. What should the organization clarify?
- A contractor finds a serious site hazard and reports it only to procurement, which files the note with the contract and never alerts site safety. What routing fix is needed?
- Staff notice elevator near-misses but fear retaliation if they escalate upward. What cultural condition does healthy risk communication require?
- The org chart shows a risk committee box, but the committee has not met in two years. What does this imply for risk communication?
- A bilingual front desk handles many non-English-speaking visitors but has no translated instructions for reporting visitor injuries. What pathway gap should be fixed?
- A supervisor rates a once-in-fifty-year pipe-burst flood the same likelihood as weekly slip incidents because both 'could happen.' What scoring error is this?
- Staff score consequence only by dollar repair cost and ignore whether people could be seriously injured. What does a proper consequence scale include?
- A risk matrix cell is labeled 'medium' but the team has no shared definitions of low, medium, and high impact. What should they establish first?
- An analyst multiplies 'pretty likely' by 'bad' to rank a risk without opening the organization's defined likelihood and consequence scales. What should replace that habit?
- A rare chemical spill scenario with catastrophic community impact is filed as low priority solely because it is rare. What evaluation mistake is this?
- Daily minor paper cuts are escalated as high organizational risk solely because they occur frequently. What correction does the likelihood-consequence view require?
- Two raters score the same elevator failure differently because one focuses only on service downtime and the other only on trapped riders. What should the organization align?
- A team treats the word 'possible' as the middle likelihood band without checking the scale legend. What should they do instead?
- Impact is rated high solely because a council member is angry about a routine maintenance delay. What should drive impact classification instead?
- A flood risk near a seasonal river is scored once in dry season and never revisited when rainy season approaches. What likelihood practice is missing?
- A city parks crew builds a consequence scale that jumps from 'scratch' straight to 'death,' with no bands for serious injury or lost-time harm. What is missing from this scale?
- At a county board workshop, three people mention phishing in the same hour, so the facilitator labels phishing 'high likelihood.' What mistake does this reflect?
- After one near-miss at a municipal garage, staff set likelihood to 'certain' for every future year and refuse to revisit the rating. What should they do instead?
- A cold-site outage and a front-lobby trip hazard are forced onto the same unlabeled 1–5 scale with no written anchors. What does the organization need?
- A library risk workshop applies low/medium/high stickers to sticky notes before anyone discusses likelihood or consequence. What process order should replace that habit?
- A city warehouse rates chemical burns and bruised elbows the same consequence because both are 'injuries.' What should the consequence scale require?
- IT rates a ransomware event as low consequence because 'we have backups,' without verifying restore time or integrity. What rating practice is wrong?
- Public works uses a 3-level impact model while finance invents a 10-level model for the same campus. What enterprise practice should leadership establish?
- A 'medium' rating appears in a transit agency register with no narrative explaining how it maps to the scale. What documentation is required?
- Safety staff raise a boiler-room risk's likelihood because leaks are easy to smell, confusing detection ease with occurrence chance. What should likelihood measure?
- A garage roof leak is debated as 'facilities whining' rather than recognized as exposure to people and property. How should this be classified?
- Unpatched kiosk PCs in a city hall lobby are treated as an IT preference issue. What risk type should leadership recognize?
- A misplaced flash drive holding resident case data is filed only as 'clutter' by a clerk. What risk classification fits?
- Chronic understaffing on night shifts at a 24-hour utility desk is brushed off as 'HR's problem.' What risk type should operations own jointly?
- A chemical store beside a creek is discussed only as a zoning paperwork matter. What risk type is being overlooked?
- A sole-source chemical supplier files for bankruptcy, and the water plant team says 'that's procurement's issue' and leaves it off the register. What should they recognize?
- Bad press causes a sudden tourism drop that cuts a city marina's slip-fee revenue. Which risk framing is most accurate?
- One rater calls server-room humidity an environmental risk; another calls it technology risk. What classification principle should guide the choice?
- Internal cash theft by a cashier is logged as an 'external cyberattack' to avoid HR scrutiny. What distinction should the register enforce?
- A visitor slips in the lobby and staff dismiss it because visitors 'aren't employees.' What risk posture is correct?
- Parking-lot lighting outages at night coincide with rising assault and vehicle-break reports near a civic center. How should risk teams treat the condition?
- Stadium-night traffic pattern changes block ambulance access to a clinic annex. What risk type does this illustrate?
- Smoke from a neighboring wildfire enters HVAC intakes at a county office campus. How should this be classified?
- A phishing kit targeting payroll is filed purely as 'IT' with no personnel-awareness angle. What interplay should the assessment capture?
- Mold in a records basement is labeled only as personnel discomfort, ignoring damage to paper and digital media archives. What consequence should also be recognized?
- Utility staff wave off hobby drones hovering over a drinking-water reservoir as 'not our risk type' because no pipe has burst yet. How should the corporate risk manager classify this exposure?
- A water utility depends on one SCADA technician who alone can restart the control network. Leadership labels the issue 'technology risk only.' What is the more accurate primary classification?
- After a ransomware note hits a city permitting system, several managers insist the event is 'PR risk only' and should skip technical risk registers. What primary risk type should drive the response?
- Contractors at a civic garage routinely share one badge to speed entry. Some leaders call the habit 'security theater' and leave it off the risk list. How should the risk manager treat badge sharing?
- Rising market interest rates push the renewal cost of a city warehouse lease sharply higher and threaten the logistics budget. Which risk framing best fits this pressure?
- Leadership wants risks identified only from last year's incident log and forbids floor walk-arounds. What should the risk manager argue?
- A plant runs only an annual risk review while a construction wing changes weekly. What assessment rhythm should the risk manager recommend?
- During a lobby renovation, nobody asks which patrons, staff, or contractors could be harmed by dust, open floors, and redirected exits. What identification step is missing?
- Wet-floor cones placed years ago are assumed sufficient even though foot-traffic patterns have shifted toward a new café entrance. What should identification include?
- A data-center 'worst case' plan is a sticky note that only says 'call IT.' What does effective worst-case scenario planning require instead?
- A parks department never lists supplier bankruptcy because leaders say 'our vendors are fine forever.' What should source identification include?
- A customer protest blocks the main entrance of a municipal service center. Staff treat it as pure PR and omit it from operational risk sources. How should it be framed for identification?
- Emergency plans for a civic museum never assess whether visitors can find exits during an alarm. What identification gap does this create?
- A county office catalogs only indoor risks and ignores parking-lot assaults and ice sheets. What should the risk manager emphasize?
- Traffic queueing for a vaccine clinic creates pedestrian conflicts that nobody walks down or documents. What does this illustrate about risk sources?
- An indoor facilities checklist never mentions runoff from a vehicle wash bay that drains toward a storm ditch. What source category is missing?
- A week-long festival sharply raises crowd loads in a civic hall, but leaders leave the long-term building assessment unchanged for the event week. What should happen?
- Risk identification workshops exclude frontline custodians who see hazards daily. What practice should the risk manager promote?
- Machine guards and aisle markings installed five years ago are never rechecked after a new equipment layout. What identification question should be asked?
- A hurricane tabletop names only 'bad weather' without specifying facility failure modes or responses. What should worst-case planning add?
- A facilities team writes down only risks with cheap fixes and leaves expensive structural cracks off the list. What identification principle does this violate?
- A facilities manager proposes a drone survey of a warehouse roof, but leadership rejects it because 'walk-arounds must be on foot only.' What is the better view of identification techniques?
- After a near-miss forklift incident, the team blames only the operator and skips reviewing sources and controls. What should identification emphasize instead?
- Planners site a new records trailer without checking seasonal flooding maps for the lot. What identification practice is missing?
- A multi-building campus assesses only headquarters and assumes satellite yards have identical risk profiles. What should the risk manager require?
Operational Risk Controls, Reporting & Business Continuity · 100 questions
- A warehouse crew notices a frayed power cable under a pallet rack. For weeks everyone shrugs and says safety will handle it, yet no one files a report. What principle of risk responsibility is being ignored?
- A municipal fleet garage policy says only managers may file risk reports, and technicians who spot leaking hydraulic lines are told to stay quiet. What change best aligns with sound risk reporting practice?
- A civic utilities plant requires a twelve-page form before anyone may mention a gas smell on the floor. What reporting-design problem does this create?
- After near-misses are logged at a county print shop, coworkers joke about “snitches,” and logging drops. What cultural fix best supports healthy risk reporting?
- Night custodians at a community college notice water intrusion under a server closet door but believe only daytime supervisors may file reports. What guidance should leadership give?
- A parks-department director instructs staff to report only completed injuries and never hazards or near-misses. What should a risk manager correct?
- A city’s responsibility matrix lists “all staff” as the owner for every operational control, with no named individual. What weakness does this create?
- After a hospital facilities reorganization, elevator emergency response ownership is never updated and two former teams assume the other still owns it. What should happen next?
- Contractors renovating a county courthouse have badges and tools but no instruction on how to report a chemical spill. What gap should the risk program close?
- A university’s risk portal crashes when duplicate reports are filed, so staff stop submitting altogether. What does this illustrate about reporting mechanisms?
- A warehouse supervisor quietly alters near-miss forms to hide recurring forklift incidents from leadership. What duty is being violated?
- A nonprofit board insists every minor hazard report be posted publicly with the reporter’s and involved employees’ names for blame. What reporting-system concern should a risk manager raise?
- IT tickets describe a leaking ceiling tile above a server rack while safety reports note the same drip as a slip hazard, yet neither record points to a shared owner. What practice would improve risk response?
- Volunteers staffing a city festival receive shirts and schedules but no briefing on emergency reporting numbers. What should organizers add?
- A risk register lists the “responsible party” for chemical inventory controls as an empty job code with no person currently assigned. What correction is required?
- Staff at a regional clinic file hazard reports only during the week auditors are on site. What cultural shift should leadership drive?
- Two deputy directors both claim exclusive ownership of flood-barrier deployment and block each other’s work orders. What should leadership do?
- A city call-center agent hears language consistent with a bomb threat but has no written escalation card at the desk. What should the risk program provide?
- Remote employees treat repeated VPN outages as merely annoying and never flag service impact to operations. What should risk guidance emphasize?
- Leadership celebrates a quarter with zero hazard reports as proof of perfect safety. What interpretation should a risk manager challenge?
- After metal filings injure eyes in a municipal machine shop, managers first buy darker safety posters and skip removing or redesigning the grinding source. What hierarchy-of-controls mistake is this?
- Management issues only PPE goggles after chip injuries, even though switching to a wet-cut method would largely eliminate flying chips. Which control preference is more appropriate?
- A facilities team keeps a toxic cleaner “because we have always used it,” even though a less hazardous substitute is available and effective. What control action best follows hierarchy principles?
- A loud compressor sits in an open office; leadership hands out earplugs instead of relocating or enclosing the machine. What higher-order control should be considered first?
- Guarding is removed from a table saw “for speed,” and workers are told only to be careful. What control principle does this violate?
- A warehouse keeps logging ladder misuse. Operations sends the same reminder email after each near miss but never refreshes training or updates the procedure. What should a risk manager emphasize about administrative controls?
- A packaging line has sharp edges that cut gloves and nick hands. Leadership mandates thicker gloves but refuses to redesign guards or edge finishing even though redesign is feasible. What is the sound hierarchy critique?
- The night of a civic fundraiser, catering stacks crates and carts across marked accessible exits to clear the lobby for guests. What essential workplace precaution is being violated?
- During a dusty renovation, facilities silences fire alarms as 'annoying' and leaves them off with no fire watch, detection alternative, or compensatory plan. What should the risk manager conclude?
- A municipal fleet shop puts new hires on grinders and lifts on day one, delaying safety training until 'a quiet week.' What precaution expectation is being missed?
- Call-center desks force awkward reaches and elevated shoulders for full eight-hour shifts, and no ergonomic adjustment or alternate furniture is offered. What risk precaution should leadership prioritize?
- A nonprofit HQ lobby has after-hours access with no badge control or camera coverage despite a documented theft history. Which statement best reflects appropriate organizational precautions?
- A facilities chemical storage room has no functioning ventilation, and odor complaints are rising. What essential environmental health precaution is missing?
- A lab supervisor waves off missing first-aid kits and eyewash stations because '911 exists.' What should the risk manager correct?
- A hierarchy-of-controls poster hangs in the break room, yet every hazard fix jumps straight to PPE raffles and giveaways. What does correct application of the hierarchy require?
- To cut noise complaints, maintenance isolates a pump in a closed closet. The closet now meets confined-space conditions, but nobody reassesses the new exposure for entry and maintenance work. What lesson applies?
- Operators repeatedly tape over machine interlocks 'just for today' to clear jams faster. What is the hierarchy impact?
- A yard posts a 5 mph speed policy in the employee handbook, but the yard has no signs, no enforcement, and drivers routinely ignore it. What makes this administrative control ineffective?
- The stockroom shelves only oversized and undersized respirators and gloves, so staff routinely skip required PPE. What condition for PPE effectiveness is failing?
- A renovation permanently removes a stair guardrail (engineered control) and leaves a traffic cone as the standing protection. What is the residual-risk problem?
- During a chemical smell event, facilities texts daycare staff in the same building raw PSI readings and equipment jargon with no plain-language action. What communication principle is missing?
- Leadership debates email templates and social posts for a boil-water notice but has not decided which facts occupants must know. What should come first in the communication strategy?
- An urgent building evacuation is announced only through the monthly all-hands newsletter scheduled to publish tomorrow. What is wrong with this channel choice?
- Facilities sends a single daytime email about a hazardous material delivery route change and never confirms that night-shift teams saw it. What communication effectiveness issue does this create?
- A completed risk analysis recommends procedure changes, but results are withheld from the teams who must rewrite and follow those procedures. What communication duty is unmet?
- During a multi-hour service outage, a spokesperson improvises conflicting restoration timelines across social media replies. What should a communication strategy have provided?
- Routine slip-hazard reminders and rare active-assailant alerts both use identical 'ALL CAPS EMERGENCY' banners every time. What messaging problem does this create?
- A shelter-in-place drill notice goes out only in English even though a large share of the workforce has limited English proficiency. What audience-analysis gap does this show?
- Legal insists on a 48-hour review cycle before any warning can be posted about an icy visitor ramp already in use. What communication priority should override that delay?
- During a multi-hour outage, no owner is named for updating the public status page, so hours pass with stale 'investigating' text. What element was missing from the communication strategy?
- A facilities risk register heat map is pasted into public board minutes without likelihood, consequence, or mitigation context, and tenants panic about red cells. What should the risk communicator do next time?
- During a site evacuation drill, employees hear the assembly-point message, but contractors and visitors never receive it and gather in the wrong zone. What communication gap does this expose?
- After a tabletop exercise, lessons and control changes are filed in a binder, but frontline supervisors never hear what behaviors must change. What closing-the-loop action is missing?
- During an incident, SMS, radio, PA, and email each send contradictory instructions about whether to shelter or evacuate. What multi-channel communication principle was violated?
- Property managers discover a recurring elevator failure that could strand occupants, but they withhold notice from tenants "to avoid worry." What communication judgment is most appropriate?
- An incident notice template is used, but senders leave the "actions required of you" field blank and only describe what failed. What improvement best strengthens the message?
- Board risk packs list only technical residual-risk scores with no plain-language summary of what the scores mean for the organization. What adjustment fits a governance audience?
- An organization publishes an incident hotline number widely, yet nobody staffs the line after 5 p.m. when most after-hours events occur. What channel-capacity lesson applies?
- Rumors spread for hours on employee chat while official channels stay silent after a chemical odor event. What communication strategy response is most appropriate?
- A continuity tabletop drills only technical failover of systems and never rehearses who drafts, approves, or sends stakeholder messages. What gap should leaders close?
- A spill response procedure still lists cleanup steps for a solvent the plant discontinued three years ago, while the current chemical set differs. What maintenance action is required?
- Asked when lockout/tagout procedures were last checked for adequacy, supervisors cannot identify any review date, trigger, or owner. What practice is missing?
- Fire extinguisher types were upgraded site-wide, but ten-year veterans received training only at hire and never refreshed on the new equipment. What training-cycle fix is needed?
- After incidents, supervisors share oral tips in the break room, but controlled documentation never changes to match the new expected practice. What documentation principle is being ignored?
- Annual compliance monitoring consists of managers signing a binder affirming procedures were followed, with no observation of actual work practices. What monitoring improvement is most appropriate?
- The "emergency procedure" is a ninety-page manual that no one can navigate during a live alarm. What adequacy concern should procedure owners address?
- Two conflicting boiler-shutdown SOPs sit on the share drive, and operators cannot tell which version is current. What maintenance control is missing?
- After a near-miss, leadership tells staff to "be careful" but does not evaluate whether a procedure gap contributed. What evaluation trigger is being missed?
- Contractors on site follow an unlabeled printout for confined-space entry while employees use a different controlled PDF. What controlled-document practice should leadership enforce?
- A site faces predictable seasonal flooding, but the flooding annex was never attached to the main emergency procedure staff actually open during alarms. What completeness issue does this create?
- E-learning completion for extinguisher use is 100%, yet spot checks show staff using incorrect technique on the new units. What training-effectiveness adjustment is needed?
- The procedure library has annual review dates on documents, but no named owner is assigned to perform those reviews. What ownership fix is required?
- A new regulatory requirement affecting chemical labeling took effect eighteen months ago, yet related workplace procedures remain unchanged. What external-change practice was neglected?
- Pocket checklists used on the floor differ from the official controlled PDF, and nobody reconciles the two. What alignment action should procedure owners take?
- A new software workflow goes live for vendor access, but the access-revocation procedure still describes only the retired legacy system. What tech-change maintenance step was skipped?
- An internal audit of a city warehouse procedure checklist flags several missing supervisor signatures, then closes the finding without walking the floor. What should the risk manager insist the review also test?
- At a regional call center, the official ticket-escalation procedure takes about forty minutes for a task staff routinely finish in two minutes, so teams invent unofficial shortcuts. What does this pattern most clearly show about procedure adequacy?
- A county facilities team cancels its quarterly emergency-response drills repeatedly, saying it will resume “when things calm down.” What readiness principle is being violated?
- A manufacturing site keeps safety and shutdown procedures only in English, while the night shift is predominantly Spanish-speaking. What procedure-maintenance gap does this create?
- A nonprofit office restored its normal visitor SOP after the pandemic, but a temporary COVID-era screening rule remains posted at the lobby and conflicts with the current procedure. What maintenance action is most needed?
- After a clerk falls from a step ladder in a municipal office, coworkers discuss it as hallway gossip and nobody files an accident report. What should the risk manager reinforce?
- A professional-services firm’s medical-emergency “plan” is a sticky note that says “call someone,” with no assigned roles, AED location, or assembly point. What does a usable response plan need instead?
- A warehouse associate files a strain injury from lifting, the report is completed, and the lifting procedure remains unchanged. What is missing from the risk response?
- A corporate policy excludes near-misses from the incident reporting system so “only real injuries” are tracked. What is the primary risk-management flaw?
- An office manager dismisses trip hazards from power cords as “not real safety” compared with warehouse forklift risks. What should the risk manager emphasize?
- An incident report after a lobby fall blames only the injured visitor’s “carelessness” and omits wet flooring, missing caution signs, and lighting. What investigation quality problem does this illustrate?
- During a cardiac-event drill, AED cabinets are locked and nobody on shift has the key. What readiness failure does this expose?
- A mailroom logs several minor cut injuries over six months, but each case is closed in isolation and leadership never sees a trend. What analytical step is missing?
- After a violent visitor incident in a clinic waiting room, operations files an internal note but never coordinates follow-up with security or HR. What should the risk manager ensure next?
- Supervisors alter first-report timestamps so incidents appear filed within the internal SLA. What reporting integrity issue should the risk manager address?
- A contractor is injured on a host company’s site and is told to report only to the contractor’s employer, leaving the host with no record. What should the host’s risk program require?
- After a chemical spill response in a lab annex, the used spill kit is never restocked. What post-response maintenance step was skipped?
- Staff in an office kitchen never practiced grease-fire response and throw water on a cooking-oil fire. What preparedness gap does this reveal?
- An anonymous safety hotline exists, but submitted reports sit unread for months. What system failure should leadership correct?
- After repeated cuts from a sharp counter edge, corrective action is limited to “retrain everyone forever,” with no engineering look at the edge itself. What does effective corrective action prefer?
- An after-hours security guard does not know the incident escalation tree when a pipe burst floods a records room at night. What planning gap does this expose?
- Ergonomic complaints about poorly adjusted workstations are mocked until a recordable musculoskeletal injury appears. What early-intervention principle was ignored?
- After a flash-flood damages a basement records room, the organization restores operations but skips an after-action on salvage priorities. What learning step should the risk manager require?
- Shared printers with frayed power cords sit in a common area and remain unfixed because “nobody owns them.” What office-hazard governance fix is needed?
- Leadership asks staff to minimize filed incident counts so an upcoming safety award application looks stronger. What integrity principle should the risk manager defend?
Advanced Risk Management Techniques & Enterprise Readiness · 100 questions
- A city keeps running a money-losing ice rink that injures skaters nearly every week, citing "tradition," and refuses to shut it down. Which risk treatment is leadership refusing to apply?
- A plant has a leaky chemical storage tank that staff can repair or replace, but leadership only purchases more pollution liability insurance and leaves the tank as-is. What is the main problem with that approach?
- A department labels a blocked fire exit as "accepted risk" because clearing storage is inconvenient this quarter. Why is that use of acceptance incorrect?
- A facilities contract shifts all liability for high-hazard work onto a one-person vendor with no assets or insurance. What does this illustrate about risk transfer?
- Legal reviews a high-hazard contractor agreement and finds no indemnification clause. Why does that matter for risk treatment?
- An event venue requires food vendors to provide certificates of insurance before serving. One vendor delivers a certificate that expired last month. What should the risk control conclusion be?
- A shop installs machine guarding on a press and then documents the remaining, lower exposure as accepted with an owner and review date. Which treatment path does this describe?
- Festival leadership cancels an optional drone light show planned over a dense crowd because the uncertainty and harm potential are too high. Which treatment did they choose?
- An agency buys a cyber insurance policy but skips phishing training and routine patching. What is the sound risk-treatment critique?
- A manufacturer replaces a high-toxicity chemical cleaning step with a mechanical abrasion method that removes the chemical hazard. What treatment does this primarily illustrate?
- A board minutes note says ransomware risk is "accepted," but there is no rationale, risk owner, residual description, or review date. What is missing for valid acceptance?
- A city inserts lease language that "transfers" river-flood risk to riverside residents, even though residents cannot operate or fund the levees. Why is this transfer inappropriate?
- A warehouse installs a sprinkler system and also buys property insurance for fire loss. Which statement best describes this treatment combination?
- A director proposes avoiding all innovation projects so the organization never takes strategic risk. What is the main flaw in that strategy?
- Procurement collected certificates of insurance from contractors at onboarding three years ago and never rechecks them at policy renewal. What control gap does this create?
- A manager claims that because contractors signed indemnification language, "incidents cannot happen on our sites anymore." What misconception should be corrected?
- An administrative office writes into policy that minor theft of low-value office supplies is accepted, with monitoring thresholds and an owner. When is this approach appropriate?
- Organizers move a festival from a cliffside overlook to a flat city park specifically to cut fall exposure for attendees. What treatment idea does this demonstrate?
- Counsel asserts that liability was "transferred," yet the contract only contains a vague "best efforts to be careful" sentence with no clear allocation of loss. What quality problem exists?
- After phishing controls and a cyber policy are in place, leaders accept a small documented residual cyber exposure and attach an incident playbook with an owner. Which path does this follow?
- A draft business impact analysis lists every department as "equally critical" with no ranking of what must recover first. What core BIA purpose is missing?
- During an outage, IT restores email first because complainers are loudest, while wastewater SCADA dependencies identified in planning are left waiting. What BIA lesson was ignored?
- A BIA "report" is a single slide of clip art with no estimates of how impact grows over time if functions stay down. Why is that inadequate?
- Analysts rank citizen permit-counter services using only the org chart and never interview the clerks who run the counters daily. What BIA research weakness does this show?
- Payroll downtime impact is scored only by counting IT help-desk tickets, ignoring employee hardship and statutory pay deadlines. Which BIA improvement is needed?
- A city IT shop runs three 'critical' applications on one shared vendor platform, but the BIA scores each application as if it could fail alone. What shared-dependency gap should the risk manager flag?
- A county copies another city's BIA wholesale and skips localizing peak tourism and storm-season loads. What correction should the risk manager require?
- IT promises same-day restore for a permit system that has never been restored in a drill, and leadership wants that promise written as the RTO. How should BIA-informed recovery needs be set?
- Facilities staff omit the paper records vault from the BIA because 'we're digital now,' yet several permit workflows still depend on those originals. What should the risk manager insist on?
- Leadership wants to buy a hot site immediately and skip the BIA to 'save time.' What sequencing should the risk manager recommend?
- A mid-year BIA snapshot ranks election support systems as low priority because ballots are months away. What time-varying criticality issue should be corrected?
- A utility's BIA lists only first-hour outage costs for the customer portal and ignores how reputational harm grows over days. What stakeholder-impact improvement is needed?
- Emergency operations and cold-storage both rely on one backup generator, but the BIA never notes contention for that resource. What dependency should be documented?
- In a BIA workshop, managers rank the intranet news blog above emergency dispatch radio because the blog is more popular internally. How should criticality be ranked?
- A public-safety support team's 911-adjacent SaaS tools live in a third-party cloud but never appear on BIA dependency maps. What mapping correction is required?
- Finance wants the BIA to report only dollar loss, while operations needs life-safety impact in the same analysis. How should the risk manager structure impact criteria?
- After a major reorganization merges two departments and moves critical workflows, recovery teams still follow last year's BIA. What should happen next?
- BIA reports bury maximum tolerable downtime in jargon and never state it plainly for executives. What communication fix should the risk manager apply?
- A clinic BIA lists appointment software as critical but never mentions vaccine refrigeration as a process dependency. What hidden-dependency practice should improve the analysis?
- Staff treat the BIA workshop like a floor hazard walk-around looking for wet floors and frayed cords. How should the facilitator clarify BIA purpose?
- A flood destroys the only records room, and leadership then asks for the first disaster recovery plan. What timing lesson should the risk manager reinforce?
- The DR binder still lists 2014 phone trees and contains no restoration priorities or recovery steps. What content upgrade is most needed?
- Leadership labels an empty room with no hardware or connectivity as the organization's 'hot site.' What definition correction is required?
- Budget only funds a cold site, yet staff expect instant failover during the next outage. What expectation should the risk manager reset?
- During drills, the team treats a warm site that has only partial equipment and staged data as if it were a hot site. What readiness distinction should be enforced?
- The DR plan describes vendor phone numbers but never names who may declare a disaster and activate the alternate site. What planning element is missing?
- Nightly backups complete successfully, but restore has never been tested at the recovery site. What DR effectiveness gap should leadership address?
- The DR plan lists application failover steps but omits generator fuel, building access badges, and key vendor contacts. What holistic planning correction is needed?
- A mutual-aid cold site three states away has no staff lodging or travel plan, yet leadership counts it as immediately usable. What practicality issue should be raised?
- The only copy of the DR runbook lives in a cloud folder that requires internet, and the plan assumes the network always works to open it. What accessibility fix should be made?
- A city utility discovers during a substation outage that its hot-site contract expired six months earlier and nobody tracked the renewal. What maintenance lesson should leadership take from the lapse?
- Ransomware encrypts a county’s primary data center and an always-connected hot site that mirrors the same network path in real time. What independence issue does this expose?
- A hospital’s disaster recovery plan runs 200 pages, yet responders cannot find the first actions on page one when an outage starts. What structural improvement is most needed?
- A regional bank picks a cold site solely because rent is cheapest, even though the building sits in the same floodplain as headquarters. What site-selection principle is violated?
- After a successful failover to a warm site, a transit agency has no written criteria for when to fail back to the primary facility. What planning gap does this reveal?
- A nonprofit accepts a SaaS vendor’s “full disaster recovery” marketing claim without reading the contract’s RTO clauses. What third-party planning practice should replace that approach?
- A paper disaster recovery plan sits in a locked cabinet, but after staff turnover nobody knows the combination. What access factor has failed?
- An annual drill walks staff through a hot-site script even though the real contract only provides a cold site. What exercise design problem does this create?
- A city’s emergency radio cache is stored only at the primary facility and never appears on recovery-site packing lists. What planning element is missing?
- Executives call any alternate office with Wi-Fi a “hot site.” How should the risk manager correctly distinguish readiness levels?
- A library adds a mezzanine overlook, but nobody reassesses who might be harmed by the new fall edges. What continuous-improvement step was skipped?
- Machine guards installed last year are assumed forever sufficient even though production throughput has doubled. What monitoring practice is missing?
- A supervisor modifies a machine interlock with tape during a rush order and never enters the change in the log. What control-change expectation was violated?
- A wall poster shows a continuous-improvement cycle, but scheduled risk reviews never actually occur. What should leadership prioritize?
- A port authority revisits only catastrophic risks each year while medium risks sit untouched for several cycles. What monitoring-breadth lesson applies?
- A makerspace adds teen volunteers but does not update its who-is-at-risk analysis. What identification update is required?
- A KPI dashboard shows falling incident rates while supervisors quietly discourage hazard reports to protect the numbers. What monitoring integrity issue should leadership address?
- A temporary crowd barrier at a civic arena becomes permanent without anyone verifying code compliance or sight lines. What validation step was skipped?
- After a peer city suffers a crane collapse, a public-works director dismisses the lessons as “not us.” What continuous-improvement response is more appropriate?
- Operators silence noisy sensor alarms instead of tuning detection thresholds. What continuous-improvement choice does this undermine?
- An annual facility review uses the same checklist every year and never flags new lithium battery storage. What identification refresh is needed?
- Corrective actions for a slippery floor are marked closed in the tracker, yet nobody verifies the floor condition actually changed. What closing step is missing?
- Staff propose a better machine-guard design, but the idea dies because “we already complied once.” What continuous-improvement principle counters that stance?
- A who-might-be-harmed analysis covers daytime office staff but forgets maintenance crews entering after hours. What completeness lesson applies?
- Control ownership rotates so often that sufficiency reviews never stick to a responsible person. What monitoring foundation is missing?
- A city risk dashboard highlights insurance premium totals every month but never shows how many known hazards were closed. What metric problem does this create?
- A parks department automates work-order routing, but the old paper sign-off checklist stays in the binder and operators keep arguing which one is required. What continuous-improvement action is missing?
- A community festival expands into a new plaza that has never been included in hazard walks. What should the risk team do first for identification?
- Near-miss trending is reviewed only once a quarter. A sudden burst of forklift near-misses sits unseen for ten weeks. What cadence lesson applies?
- After one kaizen week, management announces that continuous improvement is complete for the year. What misunderstanding is this?
- Each department keeps a private risk list, and leadership has no consolidated enterprise view. What ERM structural goal is missing?
- A supervisor claims enterprise risk management is simply buying enterprise antivirus. What corrects that claim?
- During an ERM discussion about funding loss reserves, the board asks what actuaries contribute. What awareness-level answer fits CRMC depth?
- A council member says the city will be fined next week for violating ISO 31000 as if it were a local ordinance. What clarification is needed?
- Leadership dismisses OSHA as irrelevant because “we’re not a factory,” even though the organization runs warehouse operations. What is the better risk stance?
- An ERM committee catalogs risks but never connects them to strategic objectives. What goal of ERM is missing?
- A manager treats a simple floor hazard walk-through as identical to financial risk modeling for the enterprise. What distinction should CRMC candidates recognize?
- A manager claims adopting ISO 31000 means the organization no longer needs any local procedures. What is wrong with that claim?
- Leadership posts required OSHA notices and then declares the entire ERM program finished. What correction is needed?
- An enterprise threat analysis covers only physical hazards and skips reputation and regulatory dimensions. What breadth issue should be corrected?
- The organization published risk appetite statements, but ERM reports never reference them when escalating issues. What alignment practice is missing?
- Operations leaders ignore actuarial reports because the documents feel mysterious. What ERM practice should replace that avoidance?
- Managers mock ISO 31000 principles as “too abstract,” and the organization never forms a common risk vocabulary. What value is being discarded?
- The enterprise risk register accepts only occupational hazard entries and excludes strategy and fraud risks. What ERM inclusiveness problem exists?
- A nonprofit assumes enterprise risk management applies only to Fortune 500 manufacturers. What is the accurate view?
- The only enterprise risk metric presented to the board is the OSHA injury log summary. What reporting gap should be fixed?
- Two overlapping risk committees dispute ownership and no charter states an ERM mandate. What governance fix is most needed?
- A colleague claims that passing the CRMC exam means the organization is now ISO 31000 certified. What distinction corrects that claim?
- Financial modelers and safety officers never share a common risk taxonomy, so enterprise rollups fail. What ERM integration practice is needed?
- Staff can name ISO 31000 and OSHA but never explain how either should shape program design. What standards-awareness gap remains?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.