Risk Management & Internal Control Flashcards
7 cards from real AICPA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Internal Control flashcards as text
Which control environment factor refers to the competence and ethical values demonstrated by top management?
Answer: Tone at the top
Tone at the top reflects the ethical values, integrity, and commitment to competence modeled by senior leadership.
A key risk indicator (KRI) differs from a key performance indicator (KPI) in that a KRI:
Answer: Signals potential future risk exposure
KRIs are forward-looking metrics that provide early warning signals of increasing risk exposure before losses occur.
Under COSO, 'monitoring' activities are designed to:
Answer: Detect and correct control deficiencies over time
Monitoring assesses the quality of internal control performance over time and corrects identified deficiencies.
Which type of audit opinion indicates that one or more material weaknesses in internal control over financial reporting exist?
Answer: Adverse opinion
An adverse opinion on internal controls means management's assessment is materially misstated or material weaknesses exist.
The practice of limiting each employee's computer system access to only the functions needed for their job is known as:
Answer: Least privilege principle
The least privilege principle restricts user access rights to only what is necessary to perform their job functions.
In enterprise risk management, 'inherent risk' is best described as:
Answer: Risk in the absence of any management actions to alter its impact
Inherent risk is the raw risk facing an organization before management applies any controls or risk responses.
A company's disaster recovery plan (DRP) primarily focuses on:
Answer: Restoring IT systems and data after a disruption
A DRP provides documented procedures for recovering IT infrastructure and operations following a disaster or major disruption.