RIMS-Certified Risk Management Professional—Federal (CRMP-FED) Practice Test — Free Questions

Exam Details

Questions

850

Duration

180 minutes

Passing Score

Pass/Fail

Difficulty

Specialty

Last Updated

Feb 2026

Topics Covered

Understanding the Federal Government ERM EnvironmentERM Implementation in the Federal GovernmentERM Reporting in the Federal GovernmentOMB, GAO, and NIST Standards AlignmentFederal Stakeholder Engagement and CommunicationInternal Controls and Risk IntegrationCore Risk Management Principles (RIMS-CRMP)

Exam Overview

The RIMS-Certified Risk Management Professional—Federal (CRMP-FED) is a specialized credential developed by RIMS in cooperation with the Association for Federal Enterprise Risk Management (AFERM) that validates risk management competencies specifically within the United States Federal Government environment. It is the only credential of its kind designed to confirm expertise in enterprise risk management (ERM) as practiced under federal frameworks, including alignment with OMB Circular A-123, OMB Circular A-11 Part 6, GAO standards, and NIST guidance. The RIMS-CRMP holds ANSI National Accreditation Board (ANAB) accreditation under ISO/IEC 17024:2012, making it the only risk management certification in the world with this accredited status.

The CRMP-FED is structured as an add-on to the core RIMS-CRMP credential and cannot be earned independently. Candidates take a single three-hour combined exam that tests both core risk management competencies and federal-government-specific knowledge—covering areas such as ERM implementation within federal agencies, internal controls integration, stakeholder engagement, and ERM reporting requirements. The credential is valid for two years and requires ongoing recertification to maintain.

Official exam page

Who Should Take This Exam

This certification is designed for risk management professionals working within or directly supporting United States Federal Government agencies who wish to validate their specialized knowledge of federal ERM frameworks and practices. Typical candidates include agency risk officers, enterprise risk managers, internal auditors, compliance officers, and program managers embedded in civilian or defense federal organizations.

The credential is also well-suited for contractors, consultants, and advisors who regularly support federal agencies on ERM implementation, reporting, and governance. RIMS membership is not required to pursue the CRMP-FED, and RIMS-CRMP holders seeking to differentiate themselves in a government-focused career path will find it a natural and recognized next step.

Prerequisites

Candidates must first earn or simultaneously qualify for the core RIMS-CRMP credential before sitting for the FED portion of the exam. This means satisfying one of three eligibility pathways: (1) a bachelor's degree or global equivalent in risk management plus one year of full-time risk management work experience; (2) a bachelor's degree or global equivalent in any non-risk management field plus three years of full-time risk management work experience; or (3) six years of full-time risk management experience with no degree requirement. All degrees must be from accredited institutions.

Applicants must submit a formal application with supporting documentation (official transcripts or registrar letters, employment verification), pay the applicable fee, and receive an authorization-to-test email from the RIMS-CRMP Certification Department before scheduling the exam. If a candidate has already passed the core RIMS-CRMP, they need only demonstrate eligibility for and pass the FED portion. The six-month testing window must be honored, or the examination fee is forfeited.

Exam Format

The CRMP-FED is delivered as a single combined, computer-based exam totaling three hours. The full exam consists of 170 items: 100 scored RIMS-CRMP core questions, 20 unscored pretest (pilot) questions embedded in the core section, and 50 scored FED-specific questions answered in a dedicated one-hour block. The exam is available year-round and administered either at a Pearson VUE testing center (in the US, Canada, and internationally) or via remote proctoring through Pearson VUE's OnVUE platform from a candidate's home or office. Candidates choosing remote proctoring must check in 30 minutes before their scheduled start time.

A passing score requires achieving 71% or higher on the overall exam. Results are provided as pass/fail. Candidates who do not pass must reapply within the guidelines set by the RIMS-CRMP Certification Department. The CRMP-FED credential, once earned, is valid for two years, after which recertification is required.

Skills Measured

1.Understanding the Federal ERM Environment (~40% of FED portion): Knowledge of the federal government's unique organizational structures, culture, oversight bodies, and the regulatory landscape governing ERM, including the roles of OMB, GAO, NIST, and AFERM guidance documents such as the CFO/PIC Playbook.
2.ERM Implementation in the Federal Government (~50% of FED portion): Practical application of ERM frameworks within federal agencies, including program design, risk identification and assessment, integration with strategic planning, stakeholder engagement, internal controls, and alignment with OMB Circular A-123 and the COSO ERM framework.
3.ERM Reporting Requirements (~10% of FED portion): Federal ERM reporting obligations, including agency risk profiles, reporting to OMB and Congress, performance integration under OMB Circular A-11 Part 6, and communicating risk information to senior leaders and oversight bodies.
4.Core Risk Management Principles (RIMS-CRMP portion): Foundational ERM concepts, risk governance and culture, risk appetite and tolerance, risk identification and analysis, risk response strategies, and monitoring—consistent with the RIMS-CRMP exam content outline.

Study Tips

Download and thoroughly review the official RIMS-CRMP-FED Study Guide, which covers general exam-taking strategies, how to analyze exam questions, and what to expect at the testing center or via OnVUE remote proctoring.
Read all five priority reference documents identified by RIMS: the CFO/PIC Playbook on Federal ERM, GAO Report GAO-17-63, OMB Circular A-123 (Management's Responsibility for ERM), OMB Circular A-11 Part 6, and the AFERM Federal ERM Areas of Practice Guidance—these are the most heavily tested sources.
Enroll in the official two-day live virtual workshop offered by RIMS, which is specifically designed to prepare candidates for the combined RIMS-CRMP-FED exam and covers both the core and federal-specific sections.
Use RIMS's self-paced online preparatory courses to reinforce knowledge at your own pace, particularly for the core RIMS-CRMP content (100 scored questions) which comprises the majority of the combined exam's question pool.
Supplement study with supplemental federal guidance documents including NIST cybersecurity and risk management publications, Treasury's Orange Book on internal controls, and COSO's ERM Integrated Framework, as these are referenced in federal agency ERM practice.
Practice applying concepts to scenario-based federal contexts—understand how a GS-level risk officer would implement an ERM program for a civilian agency under A-123 requirements, as the FED exam questions are grounded in practical federal application rather than pure theory.
Listen to the RIMS-hosted podcast episode and webinar specifically explaining the CRMP-FED credential, as these resources provide examiners' perspectives on what competencies are most valued and commonly tested.

Career Benefits

Earning the CRMP-FED signals to federal hiring managers, Inspector General offices, and agency leadership that a professional has validated expertise in the specific risk management frameworks, regulations, and reporting obligations unique to the federal government. It is recognized by the Navy, Army, and Marine Corps COOL programs, making it eligible for military tuition assistance funding and a valued credential for transitioning service members entering federal civilian risk roles. According to RIMS data, full-time risk professionals holding the RIMS-CRMP credential earn approximately $16,000 more annually than non-certified peers—a premium that the specialized CRMP-FED designation is positioned to reinforce within the federal pay and hiring ecosystem.

The credential is relevant to positions such as Agency Risk Officer, Senior Advisor for Enterprise Risk, ERM Program Manager, Internal Controls Officer, and strategic planning roles across civilian and defense agencies. As OMB continues to enforce ERM requirements under Circular A-123 and federal agencies mature their risk programs, demand for credentialed professionals who can demonstrate knowledge of federal-specific standards—rather than general private-sector ERM—continues to grow. The ANAB accreditation under ISO/IEC 17024:2012 adds a layer of independent validation that supports portability and credibility of the credential across agencies.

Sample Questions

1. Fabrikam Federal Agency is assessing its cybersecurity maturity using the NIST CSF 2.0 Framework Tiers. The agency has approved risk management practices, but they are not consistently applied across the entire organization. Some departments have formalized processes while others rely on informal approaches. Individual awareness of cybersecurity risk exists but organization-wide policy implementation is uneven. At which Framework Tier is Fabrikam Federal Agency operating? (Select one!)

2. Fabrikam Federal Agency is building its cybersecurity risk management program and wants to integrate cybersecurity risks into the agency's enterprise risk portfolio. The CISO is reviewing the NISTIR 8286 series to understand how cybersecurity risk information should flow through the organization. According to NISTIR 8286, what is the primary organizing construct used to integrate cybersecurity risks with enterprise risk management? (Select one!)

3. Northwind Federal Agency is preparing its annual assurance statement under OMB Circular A-123. The agency has identified two material weaknesses: one in its grants management internal controls and another in its information security program. No corrective actions have been fully implemented for either weakness. What type of assurance statement should the Agency Head provide? (Select one!)

4. Woodgrove Federal Agency is implementing monitoring activities under Component 5 of the GAO Green Book. The agency wants to establish both ongoing monitoring and separate evaluations for its grants management program. Which two approaches correctly distinguish between ongoing monitoring and separate evaluations? (Select two!)

Select all that apply

5. Tailspin Federal Agency is developing a scenario analysis for a potential government shutdown that could affect mission-critical operations. The risk management team wants to use this technique effectively as part of their risk identification process. Which characteristic BEST describes the purpose of scenario analysis as a risk identification technique? (Select one!)