CRA® — Certified Risk Analyst
The global GAFM® certification designed for corporate attorneys, CFOs, controllers, compliance officers, auditors, board members, and consultants who identify, quantify, and mitigate enterprise risk — using COSO ERM, ISO 31000, FAIR model, Monte Carlo, and Legal VaR.
“From Uncertainty to Strategy. The Global Standard for Risk.”
The credential for those who identify, quantify, and report risk
From uncertainty to strategy
The seven modules cover the entire risk analyst decision chain: from event identification and classification to dollar quantification, from defining the Board-approved risk appetite to choosing between avoiding, mitigating, transferring through insurance, or accepting risk.
The Global Consultant Hexalogy
The CRA® is part of the GAFM Six Crown — CRA®, CTS™, CAMC™, CCP™, CFOS™, and CTEP™ — enabling you to stack designations on the same business card.
Dual ISO Standard
GAFM was the first financial certification body in the world to simultaneously achieve ISO 9001 (quality) and ISO 29990 (training and education) certifications. Credentials verifiable online at GAFM.org.
Professionals accountable for risk before executive leadership, the Board, and regulators
The seven modules
- COSO ERM 2017: the five components and twenty principles
- ISO 31000:2021: principles, framework, and process
- Risk Appetite Statement: how to build it with the Board
- Eight-risk taxonomy, Three Lines Model (IIA 2020), and the role of the CRO
- Five-dimension litigation assessment methodology
- Typology of unrecorded liabilities: labor, tax, civil, corporate, environmental, and GDPR
- Risk-generating contract clauses: MAC, earn-out, non-compete, indemnification, and forum selection
- M&A due diligence, IAS 37 / ASC 450, and risk-adjusted valuation
- The 5 Cs of credit and quantitative scoring
- Covenants, collateral, and enforcement hierarchy
- Credit concentration, IFRS 9 / Basel III, and expected credit losses (ECL)
- Liquidity, maturity mismatches, three-scenario stress testing, and hedging
- The seven Basel operational event categories and critical process mapping
- Quantification: LDA, internal and external data, and scenario analysis
- Cyber risk and GDPR: FAIR model, loss components, and fine determination
- 72-hour incident response, BCP, and ISO 22301
- Legal theory, tax assessments, and disputes: from audit to administrative tax tribunal
- Tax planning versus tax evasion and tax liability management
- Sector-specific regulatory risk: banking, capital markets, healthcare, data, and antitrust
- FCPA, UK Bribery Act, Sapin II, DPA, and leniency agreements
- Probability, distributions, and the probability-impact Risk Score
- Monte Carlo simulation and Legal VaR (P50, P90, P95) with CVaR
- Decision trees, expected value, and settlement vs. litigation indifference point
- RAROC, economic capital, and sensitivity analysis
- Heat maps, KRIs, and the one-page Board Risk Report
- The four response strategies: avoid, mitigate, transfer, and accept
- Insurance risk transfer: D&O, E&O, cyber, M&A R&W, and surety bonds
- Professional practice: scoping, three-phase pricing, toolkit, and ethics
Five phases. Merit-based progression.
- Rounds
- 1–10
- Pts/round
- 1
- Phase total
- 10 pts
- Min. to advance
- 5 pts
- Rounds
- 11–20
- Pts/round
- 2
- Phase total
- 20 pts
- Min. to advance
- 10 pts
- Rounds
- 21–30
- Pts/round
- 9
- Phase total
- 90 pts
- Min. to advance
- 45 pts
- Rounds
- 31–40
- Pts/round
- 16
- Phase total
- 160 pts
- Min. to advance
- 80 pts
- Rounds
- 41–50
- Pts/round
- 25
- Phase total
- 250 pts
- Min. to advance
- 125 pts
Five deliverables ready to deploy in any risk engagement.
Technical content, deliberate practice, and direct support from the GAFM® Specialist — along with templates you can take straight into your first signed report after certification.
Risk Assessment Questionnaire
Structured risk identification questionnaire across business areas — legal, financial, operational, cyber, tax, and reputational — forming the foundation of the company's risk register and heat map.
Monte Carlo & VaR Toolkit
Spreadsheet for 10,000-iteration simulation with P50, P90, and P95 percentile readings, Legal VaR and CVaR calculations, and suggested provisioning under IAS 37.
Decision Tree Calculator
Settlement versus litigation decision tree model with expected value, indifference point, and loss probability sensitivity analysis.
Board Risk Report Template
Executive one-page report template featuring a 5x5 Heat Map, top 10 risks, KRIs, mitigation status, and recommendations for the Audit Committee.
Risk Appetite & Policy Pack
Risk Appetite Statement template, enterprise risk management policy, and delegation of authority matrix aligned with COSO ERM 2017, ISO 31000:2021, and the Three Lines Model.
From enrollment to CRA® credential
- 01Enrollment
Program registration with immediate access to the technical handbook, CRA® toolkit, and simulator.
- 02Study · 4 months
Reviewing the official handbook, unlimited practice across 50 simulation scenarios, and Specialist Q&A chat.
- 031:1 Mentorship
30-minute online session with the GAFM® Specialist, with simultaneous translation in over 50 languages.
- 04Certification exam
4-hour official exam featuring 100 questions, Risk Score calculation, VaR, and expected value, plus an applied case study: mapping and quantifying company risks in an M&A due diligence context, with a Board Risk Report. Passing score ≥ 70%.
- 05CRA® Credential
Issuance of credential and verifiable digital badge at GAFM.org.
Three pathways to certification, following the GAFM Elite standard. Mandatory ethics across all.
Pathway A — Experience Fast-Track
Minimum of 3 years of professional experience in risk management, auditing, compliance, corporate litigation, credit, controllership, or consulting, plus a recognized degree from an accredited institution.
Pathway B — Education
Undergraduate degree and completion of the 50-hour GAFM-Approved CRA® course covering the program's seven official curriculum modules.
Pathway C — Certifications (Waiver)
Holders of CWM, CFOS™, CTEP™, CTS™, CPA, Bar admission (OAB/Law Society), CRC, CFA, CIA, or a master's degree in Law, Business, or Finance qualify for streamlined admission — the most common route for professionals already signing risk opinions.
Regardless of the chosen pathway, all candidates sign the GAFM Code of Ethics and undergo mandatory background screening, reviewing criminal records, disciplinary proceedings with professional regulatory boards, and material litigation history.
CRA® (GAFM) vs. standard risk management course
Unlike a generic compliance course or a finance MBA, the CRA® integrates international frameworks, dollar quantification, and the legal-regulatory rigor required by Boards and regulators into a single curriculum.
| Criteria | CRA® (GAFM) | Standard Risk / Compliance Course |
|---|---|---|
| Regulatory foundation | COSO ERM 2017 + ISO 31000:2021 + FAIR + IAS 37, IFRS 9, GDPR, FCPA, and UK Bribery Act | Isolated framework, lacking multijurisdictional regulatory integration |
| Quantification | Monte Carlo, Legal VaR, CVaR, decision trees, RAROC, and economic capital | Qualitative high-medium-low matrix |
| Deliverable templates | 5 ready-to-deploy templates: assessment, Monte Carlo, decision tree, Board Report, and risk appetite | No deliverable templates |
| Commercial practice | Teaches scoping, three-phase pricing, and Board presentation defense | Does not cover selling or executive reporting |
| Professional designation | CRA® designation recognized at GAFM.ORG | No global designation |
20 hours of CPE per year.
Maintaining active CRA® credential status requires completing 20 hours of Continuing Professional Education (CPE) annually, including mandatory updates on COSO and ISO framework revisions and relevant regulatory developments. Non-compliance results in suspension of credential use and possible revocation.
4 hours. 100 questions. One comprehensive case study.
The final step is the official GAFM® exam, scheduled by the candidate within the 4-month window. It features 100 online questions, including Risk Score, expected value, Legal VaR, and provisioning calculations under IAS 37, concluding with a comprehensive case study: identifying and quantifying risks for an acquisition target and delivering a Board Risk Report with response recommendations for each material risk. Passing score is 70% or higher.
Frequently asked questions about the CRA®
Do I need a background in statistics or mathematics to follow the quantitative curriculum?+
No. Module 06 builds all quantitative fundamentals — probability, distributions, Monte Carlo, Legal VaR, CVaR, decision trees, and RAROC — from real-world practical cases, with ready-to-use spreadsheets in the toolkit. The focus is on correctly interpreting results and the decisions they support, not mathematical proofs.
Is the CRA® suitable for attorneys, or is it purely a financial certification?+
It is specifically tailored for corporate attorneys. The program translates the language of risk for legal practitioners handling litigation, contracts, and dispute resolution: five-dimension case analysis, contingency quantification, IAS 37 provisioning, risk allocation clauses, and regulatory defense.
How does the program address GDPR and data incident risks?+
Module 04 covers the FAIR model for cyber risk quantification, loss components in a security incident, data protection authority fining procedures and sentencing criteria, notification timelines, and the 72-hour incident response plan, alongside BCP and ISO 22301.
Who needs the CRA® certification?+
Corporate attorneys, CFOs, controllers, compliance officers, internal auditors, board members, family officers, and consultants who identify, quantify, and report enterprise risk, as well as CFOS™, CTEP™, or CTS™ holders needing to integrate risk analysis into their engagements.
What are the prerequisites for enrollment?+
There are three admission pathways: Pathway A (3 years of experience in risk management, audit, compliance, corporate litigation, credit, controllership, or consulting, plus a degree), Pathway B (undergraduate degree plus the 50-hour GAFM-Approved CRA® course), and Pathway C (waiver for holders of CWM, CFOS™, CTEP™, CTS™, CPA, Bar admission, CRC, CFA, CIA, or a relevant master's degree).
Do I need fluent English to complete the program?+
No. All course materials and platform interfaces are fully available in your enrolled language, with international technical terminology presented alongside standard terms — facilitating direct communication with auditors, underwriters, and international investors.
Your GAFM® Certification in Risk Analysis starts now
Final exam scheduled at the end of four months, with a verifiable digital credential badge for those who pass.