Risk Management and Internal Controls Flashcards

A company decides to stop selling products in a politically unstable country because the risk of asset expropriation is too high. Under the TARA framework, which response is this?

Answer: Avoid

Exiting the activity that gives rise to the risk is risk avoidance.

Which statement best describes residual risk?

Answer: The risk remaining after management has implemented controls and responses

Residual risk is the exposure that remains after risk responses and controls are in place.

An internal auditor reports administratively to the CFO and functionally to the audit committee. What is the main purpose of the functional reporting line to the audit committee?

Answer: To safeguard the independence and objectivity of internal audit

Reporting functionally to the audit committee protects internal audit from management influence.

Under the IIA Three Lines Model, which function is typically part of the second line?

Answer: Risk management and compliance functions

Second-line roles provide expertise, monitoring and challenge on risk-related matters, such as risk management and compliance.

A payroll system rejects any input where hours worked exceed 80 per week. What type of control is this?

Answer: Application input control (range/limit check)

A limit check embedded in an application validates input data and is an application control.

In the fraud triangle, an employee who believes 'the company underpays me, so I deserve this' is displaying which element?

Answer: Rationalization

Rationalization is the justification a fraudster uses to make the act seem acceptable.

Which of the following is the BEST example of a compensating control in a small business where segregation of duties is not possible?

Answer: Owner-manager review of bank reconciliations and supporting documents

Active owner oversight and review compensates for the lack of segregation of duties in small entities.