CPFO RISK ASSESSMENT CERTIFICATION
EVALUATION TEST 2026 PRACTICE
SOLUTION QUESTIONS AND ANSWERS
●● Risk identification
Answer: An essential component in identifying risk by understanding the
sources, types, and likelihood of risk.
●● Specification of objectives, identification of risks, alertness to
potential fraud, and identification and assessment of changes is
considered:
Answer: principles that are always in connection with effective risk
assessment.
●● Risk evaluation:
Answer: monitors the frequency and severity of claims and modifies
them as necessary.
●● Enterprise risk management is:
Answer: A process that is ongoing and flowing throughout an
organization and designed to identify potential events that may
negatively affect the organization.
,●● Risk treatment will include which of the following?
Answer: Loss prevention and control
●● Which of the following describes inherent risk in internal controls?
Answer: Programs involving large amounts of cash receipts.
●● Which of the following has a pervasive effect on the basic
components of a comprehensive framework of internal control?
Answer: Control environment
●● "A finance officer manages public finances transparently" is an
example from which principle in the GFOA Code of Ethics?
Answer: Integrity and Honesty
●● When posting documents to a government website, computerized
tools can be used to find, extract, and analyze data presented in
electronic form. This is called:
Answer: Facilitated analysis
●● When evaluating service delivery alternatives, which of the
following is NOT considered a stakeholder in the process?
Answer: Elected officials
,●● Policies and procedures for disaster related costs should be reviewed
at least once every:
Answer: three years.
●● n disaster recover cost documention, an emergency/disaster clause
should be incorporated into:
Answer: contracts for goods and services.
●● Emphasizing the capacity of infrastructure and operations to respond
to and recover from extreme events is called:
Answer: resiliency.
●● If resiliency funding falls outside the scope of the capital budget,
local jurisdictions can pursue alternative funding mechanisms from:
Answer: state programs.federal programs.
●● Mutual aid is:
Answer: entering into a verbal or written agreement with nearby
governments before or during a disaster response.
●● Examples of business continuity are:
Answer: Data backups and recovery, operational business plans, and
manual work-arounds due to an outage.
, ●● Underwriting is:
Answer: The process insurers use to determine the risks of insuring a
local government.
●● The first step in utilizing the GFOA Ransomware Risk
Quantification Educational Model is:
Answer: baseline risk.
●● When evaluating service delivery alternatives, engaging an external
service provider is an option. This can include:
Answer: outsourcing.
managed competition.
joint service delivery with another government.
●● In cyber insurance, paying the maximum deductible out of multiple
policies is:
Answer: considered a single highest retention policy
●● Pooling of risk is:
Answer: A government entering into an agreement with other
governments to share common risks.
●● Self-insurance is:
EVALUATION TEST 2026 PRACTICE
SOLUTION QUESTIONS AND ANSWERS
●● Risk identification
Answer: An essential component in identifying risk by understanding the
sources, types, and likelihood of risk.
●● Specification of objectives, identification of risks, alertness to
potential fraud, and identification and assessment of changes is
considered:
Answer: principles that are always in connection with effective risk
assessment.
●● Risk evaluation:
Answer: monitors the frequency and severity of claims and modifies
them as necessary.
●● Enterprise risk management is:
Answer: A process that is ongoing and flowing throughout an
organization and designed to identify potential events that may
negatively affect the organization.
,●● Risk treatment will include which of the following?
Answer: Loss prevention and control
●● Which of the following describes inherent risk in internal controls?
Answer: Programs involving large amounts of cash receipts.
●● Which of the following has a pervasive effect on the basic
components of a comprehensive framework of internal control?
Answer: Control environment
●● "A finance officer manages public finances transparently" is an
example from which principle in the GFOA Code of Ethics?
Answer: Integrity and Honesty
●● When posting documents to a government website, computerized
tools can be used to find, extract, and analyze data presented in
electronic form. This is called:
Answer: Facilitated analysis
●● When evaluating service delivery alternatives, which of the
following is NOT considered a stakeholder in the process?
Answer: Elected officials
,●● Policies and procedures for disaster related costs should be reviewed
at least once every:
Answer: three years.
●● n disaster recover cost documention, an emergency/disaster clause
should be incorporated into:
Answer: contracts for goods and services.
●● Emphasizing the capacity of infrastructure and operations to respond
to and recover from extreme events is called:
Answer: resiliency.
●● If resiliency funding falls outside the scope of the capital budget,
local jurisdictions can pursue alternative funding mechanisms from:
Answer: state programs.federal programs.
●● Mutual aid is:
Answer: entering into a verbal or written agreement with nearby
governments before or during a disaster response.
●● Examples of business continuity are:
Answer: Data backups and recovery, operational business plans, and
manual work-arounds due to an outage.
, ●● Underwriting is:
Answer: The process insurers use to determine the risks of insuring a
local government.
●● The first step in utilizing the GFOA Ransomware Risk
Quantification Educational Model is:
Answer: baseline risk.
●● When evaluating service delivery alternatives, engaging an external
service provider is an option. This can include:
Answer: outsourcing.
managed competition.
joint service delivery with another government.
●● In cyber insurance, paying the maximum deductible out of multiple
policies is:
Answer: considered a single highest retention policy
●● Pooling of risk is:
Answer: A government entering into an agreement with other
governments to share common risks.
●● Self-insurance is:
