AssociatePI Study Guide
ARM™ 400 Study Guide
How to use this guide:
Use this guide as you go through the Associate course by filling in the corresponding content
underneath the section heading. NOT every section will be included. Only the most important
subjects will be required in this guide.
For instance, under the “Risk Overview” section, write in information about risk that you find
relevant to your studying.
DO NOT write every single word of the online course. This should be used for note-taking purposes.
Notes should be quick bullet points or shorthand for your future reference after you complete this
course.
Come back to this study guide once you complete the course for quicker and easier studying.
Two “fill-in-the-blank” options
Option 1: Print
Print this study guide and use a pen or pencil to handwrite your notes.
Option 2: Type
Type your notes into the PDF. Go to Tools > Content > Edit Text & Objects > Edit Document Text. This
will allow you to edit the PDF and type in your own notes. Make sure to SAVE your work!
Disclaimer
CPCU®, ARM™, AINS™, and API™ are trademarks of the American Institute for Chartered Property
Casualty Underwriters (“The Institutes”). AssociatePI LLC is not affiliated with, associated with,
endorsed by or otherwise supported or recognized by The Institutes in any way. AssociatePI LLC is
not authorized by The Institutes to offer courses, practice examinations, or any other resources
related to the Institutes' designations or other programs.
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section I: Risk Concepts
Risk Management
Risk
Risk management
Enterprise-Wide Risk Management (ERM)
Traditional risk management
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Benefits of Enterprise-Wide Risk Management
Enterprise-Wide Risk Management (ERM)
ERM Benefits
Continued Growth and Profit
ERM aligns with the company goal of continued growth and profit in the following
ways:
•
•
•
Legal Obligations
There are three primary legal obligations:
•
•
•
Reduced Cost of Risk
The following expenses make up the cost of risk:
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Reduce Effects of Risk
This reduced effect of risk results in the following benefits to a company or
organization:
•
•
•
Risk Tolerance
Tolerable Uncertainty
Continued Operations
Downside Risk Management
Emerging Risk Management
Measuring Risk
Stable Earnings
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Social Responsibility
Big Data
Big Data Introduction
Big Data – Analyzing Data
Data Analytics
Innovative Products
New Data Sources
New Discoveries
Organization
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Big Data – Capturing Data
Capturing Data
Four advances in technology allow risk management and insurance companies to
capture and retrieve data:
•
•
•
•
Big Data – Storing Data
Storing Data
Blockchain
Cloud Storage
Risk-Management Process
The Risk Management Process
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Step 1: Scan the Environment for Risks (Scan, review, and analyze the risk
environment)
Step 2: Identify the Risks (Identify any exposures or risks)
Step 3: Analyze the Risks (Analyze exposures and risks)
Step 4: Treat the Risks (Apply risk treatment)
Step 5: Monitor the Risks
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Measures of Risk
When managing risk under a holistic risk-management strategy, the riskmanagement professional must understand the following measures of risk:
Consequence
Correlation
Exposure
Likelihood
Time Horizon
Volatility
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Classifying Risk
Risk Classification
Risk is classified into four categories to help better identify, understand, and
manage risk:
•
•
•
•
Diversifiable vs. Nondiversifiable Risk
Diversifiable
Nondiversifiable
Pure and Speculative Risks
Pure Risk
Speculative Risk
There are two types of speculative business risk:
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Quadrants of Risk
There are four quadrants of risk:
•
•
•
•
Financial Risk
These are four types of financial risk:
•
•
•
•
Hazard Risk
Operational Risk
Strategic Risk
Subjective and Objective Risk
Subjective Risk
Objective Risk
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Difference
Three elements affect the subjective and objective viewpoints:
•
•
•
Communication Process
The Communication Process
The following steps outline a process for effective communication by focusing on
clarity and impact.
•
•
•
•
•
Difficult Messages
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Communication Skills – Active Listening
There are three steps to being an active listener:
•
•
•
Communication skills – Two-way Communication
Diverse Group Communication
Risk Communication
Step 1: Review and analyze the environment.
Step 2: Identify exposures.
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Step 3: Analyze exposures.
Step 4: Risk treatment application.
Step 5: Monitor.
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section II: Risk Management
Technology
Risk Management Technologies
Risk Management
With emerging technologies, risktech and insurtech are commonly applied in the
risk management and insurance industries:
•
•
Technology in Risk Management
Artificial Intelligence (AI)
Computer Vision
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Drones
Internet of Things (IoT)
Robotics
Sensors
There are four categories of sensors:
•
•
•
•
Examples of a sensor include the following:
•
•
•
•
•
•
Smartphones
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Smart Product Application
Catastrophe Management Industry
Employee Safety
The following smart products are commonly used to improve employee safety:
•
•
•
Property Management
Supply Chain
There are a few common smart technologies used in managing the supply chain:
•
•
•
Transpiration Industry
The shipping and transportation industries are using the following technologies to
address risk management:
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section III: Risk Environment
Risk Environments
SWOT is an acronym:
•
•
•
•
Internal Environment: Strengths and Weaknesses
•
•
•
•
External Environment: Opportunities and Threats
External environments have several components:
•
•
•
•
Stakeholders
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Risk Ownership
Risk Center
Risk Center Advantages
•
•
•
Risk Owners
Risk Ownership
Risk Owner Interview
Managers should ask about the following basic topics:
•
•
•
•
•
Risk Ownership - External Stakeholders
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Organizational Culture
This culture guides decision-making within the organization and therefore shapes
attitudes toward risk.
•
•
•
Corporate Culture
Types of Corporate Culture
Risk Attitudes
The Risk Continuum
Cultural Factors Shaping Attitudes Towards Risk
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Stakeholder Communication
Management Style
There are three main management styles.
•
•
•
Communication Ethics
Effective Communication in Risk Management
Effective risk management communication has several characteristics.
•
•
•
•
•
•
•
Beyond these characteristics, which refer to individual communications, effective
communication about risk management has two other systemic qualities.
•
•
Communication Channels
Internal Communications
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
External Communications
Stakeholder Communication
•
•
•
Social Responsibility
Code of Ethics
Social Responsibility Versus Governance
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section IV: Business Risk Management
Key Performance Indicators (KPIs)
Types of KPIs
•
•
KPI Acceptance Level
Risk Tolerance
Primary KPIs
Organizations set KPIs in the following areas:
•
•
•
Financial KPIs
There are three financial KPIs:
•
•
•
Operational KPIs
There are two operational KPIs:
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Staffing KPIs
There are two staffing KPIs:
•
•
Critical Success Factor (CSF)
KPIs and CSFs
Key Risk Indicator (KRIs)
KRIs and KPIs
The Purpose of KRIs
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Measuring KRIs
Common KRIs include:
•
•
•
•
KRIs Sources
There are eight places to look for risks and possible KRI metrics:
•
•
•
•
•
•
•
•
Effective KRI
An effective KRI is defined by the following characteristics:
•
•
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
KRI Uses
There are seven common uses for KRIs:
•
•
•
•
•
•
•
Business Process Management (BPM)
BPM improves processes in the following ways:
•
•
•
Benefits of BPM
There are four primary benefits of BPM
•
•
•
•
BPM Risk Indicatory
BPM Lifecycle
There are five steps in the BPM lifecycle:
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Business Process Risk
Internal risks
There are two primary internal risks:
•
•
External risks
There are three primary external risks:
•
•
•
.
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section V: Corporate Risk Governance
Corporate Governance
Corporate Governance Codes
Major corporate governance codes include the following:
•
•
•
•
•
Corporate governance codes require that the organization must:
•
•
•
•
•
Corporate Governance - Ownership and Control
Separating control from ownership brings economic benefits.
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Corporate Governance - Agency Costs
Categories of Agency Cost
There are three categories of agency costs:
•
•
•
Aligning Agency Interests
Four mechanisms align manager and shareholder interests:
•
•
•
•
Corporate Governance - Environmental, Social, and Governance (ESG)
ESG Criteria
You can break down ESG factors into distinct criteria.
•
•
•
Corporate Risk Governance Roles
There are six major positions in this framework.
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Risk Leadership Team
Chief Risk Officer (CRO)
Risk Champion
Risk Committees
•
•
Board of Directors
Types of Board Members
There are two major categories of board members.
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Boards of Director Responsibilities
The boards of directors have nine major responsibilities:
•
•
•
•
•
•
•
•
•
Primary Board Committees
The three most important corporate board committees:
•
•
•
Factors Influencing Corporate Governance
There are three main factors that impact corporate governance and risk oversight.
•
•
•
For the board to exercise this oversight effectively, directors must understand
several aspects of the organization.
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section VI: Risk Data Management
Data Management
Data management has five primary functions:
•
•
•
•
•
Big Data - Characteristics
Big data differs from traditional data in the following ways:
•
•
•
•
•
Data Management - Benefits
There are three main benefits to a comprehensive data management program.
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Data Management Threats
•
•
•
•
Risk Management Framework (RMF)
RMF requires that a company complete six essential tasks:
•
•
•
•
•
•
Effective Data Security Program
To do so, an effective data security program completes four tasks.
•
•
•
•
Improving Data Security
There are eight essential recommended practices to improve data security:
•
•
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Data Governance
Four goals for data governance:
•
•
•
•
Five core processes for data governance:
•
•
•
•
•
Data Governance Committee (DGC)
Data governance committees usually include the following:
•
•
Four Main DGC Responsibilities:
•
•
•
•
Tools of Data Governance
There are four major categories of data governance tools.
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
There are six core principles of data quality.
•
•
•
•
•
•
Data Quality
Quality data has five defining characteristics.
•
•
•
•
•
Stored Data Quality - Dimensions
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Data Privacy
Data Protection Laws – European Union
General Data Protection Regulation (GDPR)
GDPR Requirements
•
•
•
•
•
•
United States Company
Managing Data Privacy Risks
Under the GDPR, a data controller has three essential tasks.
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section VII: Internal Controls
Internal Controls
The internal control process has several functions, including:
•
•
•
Internal Control – Levels
There are three levels of internal control:
•
•
•
Entity-level Controls
•
•
•
•
Direct Controls
•
•
•
Management Controls
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Internal Control - Activities
These systems have two general categories:
•
•
Detective Controls
There are two main types of detective controls.
•
•
Preventive Controls
These controls are designed to keep errors and inconsistencies from happening.
They take several forms.
•
•
•
Fraud
Internal Control - Risk Management
Three Lines of Defense
As the name suggests, there are three layers in the Three Lines of Defense Model.
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Internal Control Frameworks
There are eight internal control frameworks and standards:
•
•
•
•
•
•
•
•
Basel Committee on Banking Supervision’s Framework for Internal Control
Systems
This framework provides control guidance for the following:
•
•
•
•
•
Canadian Institute of Chartered Accountants’ (CICA’s) Criteria of Control
Framework (CoCo)
Committee of Sponsoring Organizations (COSO) Internal Control-Integrated
Framework
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
These are the five essential components of internal control.
•
•
•
•
•
These are the three types of objectives.
•
•
•
Institute for Internal Auditors (IIA) Standards
ISO 9000 Series
ISO/IEC 27000 Series
Standards for Internal Control in the United States Federal Government
UK Corporate Governance Code
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Internal Auditing
Risk-Based Auditing
Risk-based auditing has three core principles
•
•
•
Risk Assessment
Financial Reporting Risk
SOX gives the PCAOB authority to do four key tasks related to financial reporting.
•
•
•
•
Accounting Standards
PCAOB has two auditing standards.
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Auditing Standard No. 5
AS 5 supports a risk-based audit approach through four objectives.
•
•
•
•
Therefore, the AS 5 standard requires a specific fraud risk assessment that includes
five distinct controls.
•
•
•
•
•
Internal Auditing - Collaboration
A key element in this communication is understanding their roles and functions.
•
•
•
•
•
Internal Auditing - Technology
Auditors can use emerging technology for four key tasks.
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section VIII: Compliance
Compliance
Compliance can be internal or external.
•
•
Compliance can be voluntary or mandatory.
•
•
Compliance Drivers.
•
•
•
Chief Compliance Officer
The CCO has four major responsibilities.
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Regulatory Compliance
Dodd-Frank Act
Regulatory Compliance Types
There are two major types of regulatory compliance:
•
•
Principles-based Regulation
Advantages of Principles-Based Regulation
There are four main advantages to principles-based regulation.
•
•
•
•
Disadvantages of Principles-Based Regulation
There are two main disadvantages to principles-based regulation
•
•
Rules-based Regulation
Advantages of Rules-Based Regulation
There are three main advantages to rules-based regulation.
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Disadvantages of Rules-Based Regulation
There are three main disadvantages to rules-based regulation.
•
•
•
•
Differences
•
•
•
•
•
•
•
Regulatory Compliance – Other Types
There are two other types of regulation, evidence-based regulation, and risk-based
regulation. Evidence-based and risk-based regulation are both related to principlesbased regulation.
•
•
Risk-Based Regulation Steps
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Basel
Basel I
Basel II
Basel III
Basel III establishes six risk management processes.
•
•
•
•
•
•
Basel III risk management standard articulates eleven principles.
•
•
•
•
•
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Solvency II
Solvency II Pillars
Solvency II has three pillars.
•
•
•
Solvency II requires five things of insurers.
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Compliance Programs
Compliance Programs Have Four Major Objectives
•
•
•
•
Compliance Program - Components
An effective compliance program has two fundamental components.
•
•
The Federal Sentencing Guidelines manual says an effective compliance and ethics
program should contain at least nine components.
•
•
•
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Compliance Program - Implementation
Senior managers responsible for overseeing the compliance program should record
the following items:
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Section IX: Resiliency
Organizational Resiliency
Organizational Resiliency has five defining traits.
•
•
•
•
•
Organizational Adaptability
In particular, six practices create organizational adaptability.
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Business Continuity Management (BCM)
Business continuity management has three core elements.
•
•
•
BCM - Evolution
A BCM plan addresses four main areas.
•
•
•
•
BCM - Risk Management Alignment
These two areas have both similarities and differences.
•
•
Business Continuity Certification
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Business Continuity Plan
Seven steps to creating a business continuity plan:
•
•
•
•
•
•
•
Step 1: Analyze the Business
Analyze the business
Step 2: Risk Evaluation
Risk evaluation
When evaluating risk, the company should consider these three levels of the
organization and how a given risk affects each level:
•
•
•
Step 3: Business Impact Analysis (BIA)
Business Impact Analysis
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Step 4: Create Business Continuity Plan
Business continuity plan
Business strategies
There are four common business strategies used in a business continuity plan to
reduce or prevent interruption:
•
•
•
•
Risk management strategies
In addition to the available business strategies, a company can also implement the
following risk management strategies to prevent and reduce the effect of business
interruption:
•
•
•
•
•
Step 5: Apply Business Continuity Plan
Apply business continuity plan
Departmental business continuity plan
Each department should create a continuity plan that includes:
•
•
•
•
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Step 6: Implement Culture
Business continuity culture
Step 7: Revise Periodically
Revised plan
Strategic Redeployment Plan (SRP)
SRP - Stages
There are four stages of a strategic redeployment plan:
•
•
•
•
Emergency Stage
There are four objectives of a company during the emergency stage:
•
•
•
•
Marketing Stage
Production Stage
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Communication Stage
The company should address the following concerns:
•
•
•
•
AssociatePI | https://www.associatepi.com/| contact@associatepi.com
Next Steps
You have completed the study guide!
You should review your notes in this guide for a better understanding of the
concepts and make sure you have mastered each section recap.
Your next step is to complete the practice exams. Use this guide as a study sheet, and
return back to any section of the text in which you need more practice after your
practice exam.
AssociatePI | https://www.associatepi.com/| contact@associatepi.com