Risk Management & Internal Control Flashcards

Which of the following scenarios represents a significant deficiency in internal controls?

Answer: A deficiency important enough to merit attention but not rising to the level of a material weakness

A significant deficiency is less severe than a material weakness but important enough that those charged with governance should be aware.

The three lines of defense model assigns the primary responsibility for managing risk to:

Answer: Operational management (first line)

Operational management (first line) owns and manages risks day-to-day as they arise in normal business operations.

Risk velocity, in the context of enterprise risk management, refers to:

Answer: How quickly a risk can impact the organization once it materializes

Risk velocity measures the speed at which a risk can move from its trigger point to its full impact on the organization.

Which COSO component ensures that relevant information is identified, captured, and communicated timely?

Answer: Information and Communication

The Information and Communication component ensures personnel receive and share the information needed to carry out internal control responsibilities.

An entity's audit committee's primary oversight role related to internal controls is to:

Answer: Monitor management's financial reporting and internal control processes

The audit committee oversees the financial reporting process and related internal controls, serving as a check on management.

Which risk assessment technique assigns numerical probabilities and financial values to estimate the expected loss from a risk event?

Answer: Quantitative risk analysis

Quantitative risk analysis uses numerical data to estimate the likelihood and financial impact of risk events.

Segregation of duties is most effective when it separates which three functions?

Answer: Authorization, custody, and recording

Proper segregation separates the functions of authorizing transactions, maintaining custody of assets, and recording transactions.