RIMS • CRMP-FED
The RIMS-CRMP-FED validates risk management competencies specifically within the United States Federal Government environment, covering enterprise risk management implementation, reporting, and alignment with OMB, GAO, and NIST standards. It is developed in cooperation with the Association for Federal Enterprise Risk Management (AFERM) and builds upon the core RIMS-CRMP credential.
Questions
850
Duration
180 minutes
Passing Score
Pass/Fail
Difficulty
SpecialtyLast Updated
Feb 2026
The RIMS-Certified Risk Management Professional—Federal (CRMP-FED) is a specialized credential developed by RIMS in cooperation with the Association for Federal Enterprise Risk Management (AFERM) that validates risk management competencies specifically within the United States Federal Government environment. It is the only credential of its kind designed to confirm expertise in enterprise risk management (ERM) as practiced under federal frameworks, including alignment with OMB Circular A-123, OMB Circular A-11 Part 6, GAO standards, and NIST guidance. The RIMS-CRMP holds ANSI National Accreditation Board (ANAB) accreditation under ISO/IEC 17024:2012, making it the only risk management certification in the world with this accredited status.
The CRMP-FED is structured as an add-on to the core RIMS-CRMP credential and cannot be earned independently. Candidates take a single three-hour combined exam that tests both core risk management competencies and federal-government-specific knowledge—covering areas such as ERM implementation within federal agencies, internal controls integration, stakeholder engagement, and ERM reporting requirements. The credential is valid for two years and requires ongoing recertification to maintain.
This certification is designed for risk management professionals working within or directly supporting United States Federal Government agencies who wish to validate their specialized knowledge of federal ERM frameworks and practices. Typical candidates include agency risk officers, enterprise risk managers, internal auditors, compliance officers, and program managers embedded in civilian or defense federal organizations.
The credential is also well-suited for contractors, consultants, and advisors who regularly support federal agencies on ERM implementation, reporting, and governance. RIMS membership is not required to pursue the CRMP-FED, and RIMS-CRMP holders seeking to differentiate themselves in a government-focused career path will find it a natural and recognized next step.
Candidates must first earn or simultaneously qualify for the core RIMS-CRMP credential before sitting for the FED portion of the exam. This means satisfying one of three eligibility pathways: (1) a bachelor's degree or global equivalent in risk management plus one year of full-time risk management work experience; (2) a bachelor's degree or global equivalent in any non-risk management field plus three years of full-time risk management work experience; or (3) six years of full-time risk management experience with no degree requirement. All degrees must be from accredited institutions.
Applicants must submit a formal application with supporting documentation (official transcripts or registrar letters, employment verification), pay the applicable fee, and receive an authorization-to-test email from the RIMS-CRMP Certification Department before scheduling the exam. If a candidate has already passed the core RIMS-CRMP, they need only demonstrate eligibility for and pass the FED portion. The six-month testing window must be honored, or the examination fee is forfeited.
The CRMP-FED is delivered as a single combined, computer-based exam totaling three hours. The full exam consists of 170 items: 100 scored RIMS-CRMP core questions, 20 unscored pretest (pilot) questions embedded in the core section, and 50 scored FED-specific questions answered in a dedicated one-hour block. The exam is available year-round and administered either at a Pearson VUE testing center (in the US, Canada, and internationally) or via remote proctoring through Pearson VUE's OnVUE platform from a candidate's home or office. Candidates choosing remote proctoring must check in 30 minutes before their scheduled start time.
A passing score requires achieving 71% or higher on the overall exam. Results are provided as pass/fail. Candidates who do not pass must reapply within the guidelines set by the RIMS-CRMP Certification Department. The CRMP-FED credential, once earned, is valid for two years, after which recertification is required.
Earning the CRMP-FED signals to federal hiring managers, Inspector General offices, and agency leadership that a professional has validated expertise in the specific risk management frameworks, regulations, and reporting obligations unique to the federal government. It is recognized by the Navy, Army, and Marine Corps COOL programs, making it eligible for military tuition assistance funding and a valued credential for transitioning service members entering federal civilian risk roles. According to RIMS data, full-time risk professionals holding the RIMS-CRMP credential earn approximately $16,000 more annually than non-certified peers—a premium that the specialized CRMP-FED designation is positioned to reinforce within the federal pay and hiring ecosystem.
The credential is relevant to positions such as Agency Risk Officer, Senior Advisor for Enterprise Risk, ERM Program Manager, Internal Controls Officer, and strategic planning roles across civilian and defense agencies. As OMB continues to enforce ERM requirements under Circular A-123 and federal agencies mature their risk programs, demand for credentialed professionals who can demonstrate knowledge of federal-specific standards—rather than general private-sector ERM—continues to grow. The ANAB accreditation under ISO/IEC 17024:2012 adds a layer of independent validation that supports portability and credibility of the credential across agencies.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 850 questions.
1. Northwind Federal Agency is establishing quality information standards as required by GAO Green Book Principle 13. The agency's data governance team needs to define the characteristics that information must possess to support the internal control system. Which characteristic of quality information ensures that data has a logical connection to requirements and is reasonably free from error and bias? (Select one!)
Explanation
Under GAO Green Book Principle 13, relevance is the characteristic ensuring that data has a logical connection to informational requirements and is reasonably free from error and bias. This dual quality of being both connected to the purpose and free from distortion is specific to the relevance attribute. Accessibility refers to the ability of authorized users to obtain needed information. Completeness addresses whether all required data elements exist. Currency addresses whether information reflects the latest conditions. While all are quality information characteristics, only relevance specifically addresses both the logical connection to requirements and freedom from error and bias.
2. Tailspin Federal Agency is evaluating its ERM program maturity using the Federal ERM Maturity Model from the ERM Playbook. The agency has documented risk management processes, some integration exists between risk management and operational decision-making, but comprehensive risk profiles are not yet actively informing budget and strategy decisions. At which maturity level is the agency operating? (Select one!)
Explanation
Level 3 (Defined/Repeatable) is characterized by documented risk management processes with some integration into organizational operations, but without comprehensive risk profiles actively informing budget and strategy decisions. Level 1 (Ad Hoc) has no formal structure and is purely reactive. Level 2 (Initial/Emerging) has only basic risk identification in silos with minimum A-123 requirements. Level 4 (Managed) features comprehensive risk profiles with an active Risk Management Council that informs budget and strategy decisions—which Tailspin has not yet achieved. The key differentiator between Level 3 and Level 4 is the active use of risk profiles to inform budget formulation and strategic planning.
3. Adatum Federal Agency is preparing for its annual strategic review submission to OMB. The Performance Improvement Officer is coordinating the timeline for risk profile updates. According to federal guidance, by when must agencies submit their strategic reviews coordinated with risk profiles to OMB? (Select one!)
Explanation
Federal agencies must update their risk profiles annually and coordinate them with Strategic Reviews submitted to OMB by June. This timeline ensures that risk information is current and integrated into the strategic planning process well before the next fiscal year begins. The strategic reviews are then discussed in FedSTAT sessions. September 30 marks the end of the fiscal year and is associated with the annual assurance statement and financial reporting, not the strategic review submission. December and March deadlines are not aligned with the strategic review submission cycle established by OMB.
4. Adatum Federal Agency is establishing its governance structure for enterprise risk management. The agency needs to determine the correct reporting relationship for the Chief Risk Officer as defined by federal guidance. To whom should the CRO serve as a strategic advisor? (Select one!)
Explanation
According to OMB Circular A-123, the Chief Risk Officer serves as a strategic advisor to the Chief Operating Officer (COO) or Deputy Secretary. The CRO champions agency-wide risk management, establishes the ERM framework, guides integration with agency planning activities, promotes risk awareness, and represents the agency in the Treasury ERM Council and Federal Interagency ERM Council. The Risk Management Council is chaired by the COO or Deputy Secretary, making this the appropriate reporting relationship. While the CRO works with the IG, CFO, and CIO, the strategic advisory role is specifically directed to the COO.
5. Litware Federal Agency is conducting its annual strategic review and needs to update its risk profile. According to OMB Circular A-123, which seven components must be included in the agency's risk profile? (Select three!)
Multiple correct answersExplanation
OMB Circular A-123 requires federal agency risk profiles to contain seven mandatory components: (1) Identification of Objectives across SORC categories, (2) Identification of Risk from mission and mission-support operations, (3) Inherent Risk Assessment measuring impact and likelihood using High/Medium/Low scales before controls, (4) Current Risk Response categorized as Accept, Avoid, Reduce, or Share, (5) Residual Risk Assessment showing remaining exposure after controls, (6) Proposed Risk Response for additional planned mitigation, and (7) Proposed Risk Response Category classified as Strategic Review, Budget Formulation, or Internal Control. A complete IT system inventory is a FISMA requirement, not a risk profile component. Five-year budget projections are part of strategic planning, not risk profiles. Inspector General audit findings inform risk identification but are not a required risk profile component.
One-time access to this exam