ABA Enterprise Risk Professional (CERP) Certification Sample Questions

02. Which statement BEST distinguishes data governance from data management in a risk-data program?
a) The two terms describe the same function and are used interchangeably in day-to-day practice.
b) Data governance is the technical operation of the data pipelines, while data management is the business function that sets data standards and ownership.
c) Governance applies to externally reported regulatory data, while data management covers internally used operational data.
d) Governance sets ownership, policies, and standards, while management runs the operational activities of capturing, moving, and quality-checking data within them.

03. For the same loan portfolio, the loan-servicing system and the risk data mart report different outstanding balances at month-end.
For risk reporting, what is the most appropriate way to resolve the discrepancy?
a) Report the higher of the two balances so exposure is not understated
b) Report the average of the two figures until the break is investigated and cleared
c) Report the authoritative source's figure and investigate the secondary system's divergence
d) Report the figure from whichever system was most recently refreshed with new activity

04. A bank funds a growing book of long-term fixed-rate mortgages largely with short-term brokered deposits that must be rolled over frequently. Management fears that, under market stress, these deposits may not roll and the bank could be forced to sell assets at a loss to meet outflows.
This funding-rollover concern primarily represents which risk category?
a) Liquidity risk — the risk of being unable to meet obligations as they fall due without incurring unacceptable losses.
b) Credit risk — the risk that the mortgage borrowers default on their contractual repayments.
c) Market risk — the risk that a change in prevailing interest rates reduces the economic value of the bank's fixed-rate mortgage assets over the holding period.
d) Strategic risk — the risk that the chosen business model fails to achieve long-term earnings goals.

05. Each of a bank's business lines reports a market-risk exposure that sits within its own limit. The CRO nonetheless wants an enterprise view before concluding the bank is within appetite.
Why can the individually-compliant standalone figures still misstate the enterprise position?
a) Standalone figures are measured far more frequently than the enterprise figure, which by itself makes them inherently less reliable indicators
b) Aggregating the figures lowers the total because diversification across the lines offsets the individual exposures
c) Correlated exposures across lines can sum to more risk in aggregate than the separate standalone limits imply
d) Enterprise exposure is evaluated against risk capacity whereas each standalone exposure is evaluated against the appetite

06. In a small treasury unit the same employee both initiates outgoing payments and reconciles the bank account those payments clear through, and staffing constraints make full separation of these duties impractical right now.
Which action best mitigates the segregation-of-duties conflict?
a) Rotate the employee to a different desk each quarter so that no single individual holds the combined duties for an extended period.
b) Require the employee to formally attest that the payments were legitimate before each reconciliation is completed.
c) Document the conflict in the risk register and accept it as an inherent limitation of operating a small unit.
d) Add an independent review of the reconciliation by someone who does not initiate payments, compensating for the retained conflict.

07. During a fast-moving liquidity event, ALCO needs a funding-position figure immediately to decide on an action; the fully reconciled figure will not be ready until well after the decision window closes.
Which approach reflects the best risk-reporting judgment?
a) Wait for the fully reconciled figure, since acting on unreconciled data breaches governance
b) Report the rapid estimate as final, because precision is an unaffordable luxury during a crisis
c) Give the best available estimate now, clearly flagged as provisional with its known limitations
d) Escalate to internal audit for sign-off before the unreconciled figure is used in the decision

08. What is the primary purpose of attaching a sunset (expiry) date to an approved limit exception?
a) It forces the exception to lapse and the original limit to reapply unless it is deliberately re-justified and re-approved before the date.
b) It fixes the date on which the temporary exception converts into a permanent amendment of the underlying limit.
c) It marks the point in time after which a further overage against the same limit would be reclassified from a reportable breach into a quietly pre-approved exception.
d) It sets the deadline by which the independent internal audit function is required to finish its review of the granted exception.

09. While rolling operational-risk losses into the firm-wide risk picture, an analyst notices that a large fraud loss has already been captured in the credit-loss figure for the same defaulted borrower.
When aggregating, what is the correct treatment of that loss?
a) Include the loss in both the operational and credit categories, because each risk type must be measured on a fully standalone basis.
b) Attribute the loss to a single primary risk type in the aggregate so the same event is never counted twice.
c) Exclude the loss from both categories until the borrower's file has been fully reconciled.
d) Net the operational loss against the credit provision so the aggregate reflects only the residual difference.

10. When measuring an operational-risk exposure such as processing errors, practitioners separate how often loss events occur from how large each one is.
Why is measuring these two dimensions separately important for sizing the exposure?
a) Because frequent small events and rare severe events aggregate differently into total exposure, so each dimension needs its own estimate
b) Because the frequency dimension by itself sets the capital charge while the severity dimension by itself sets the risk appetite for that process
c) Because severity is a first-line responsibility whereas frequency is owned by the independent second-line function
d) Because separating them lets the bank report the average loss per event as the single exposure figure