CAT Internal Controls & Risk Assessment 3 — Questions and Answers
Question 1: Which risk response strategy involves shifting the financial consequence of a risk to a third party?
- Risk avoidance
- Risk reduction
- Risk transfer (Correct answer)
- Risk acceptance
Correct answer: Risk transfer
Risk transfer, such as purchasing insurance, moves the financial impact of a risk event to another party.
Question 2: A monthly bank reconciliation prepared by an employee who does not handle cash receipts is an example of:
- Preventive control
- Corrective control
- Independent reconciliation (Correct answer)
- Risk avoidance
Correct answer: Independent reconciliation
Independent reconciliation ensures objectivity because the person performing the check has no involvement in the transactions being reviewed.
Question 3: Inherent risk in internal control refers to:
- Risk that controls will fail to prevent errors
- The susceptibility of an assertion to a material misstatement assuming no controls (Correct answer)
- Risk arising from external economic factors
- The risk of management override of controls
Correct answer: The susceptibility of an assertion to a material misstatement assuming no controls
Inherent risk is the natural exposure to error or fraud in a process before any controls are considered.
Question 4: Which of the following BEST describes a 'key risk indicator' (KRI)?
- A measure of financial performance against budget
- A metric that signals increasing exposure to a specific risk (Correct answer)
- A report of all completed audit findings
- A listing of every control in an organization
Correct answer: A metric that signals increasing exposure to a specific risk
KRIs are forward-looking metrics that alert management when risk levels are escalating beyond acceptable thresholds.
Question 5: Physical controls over assets include all of the following EXCEPT:
- Locked storage rooms
- Security cameras
- Password-protected computer systems
- Periodic reconciliation of physical inventory to records (Correct answer)
Correct answer: Periodic reconciliation of physical inventory to records
Periodic reconciliation is a detective control that compares records to physical counts, not a physical safeguard of the asset itself.
Question 6: The likelihood and potential impact of a risk event are used together to:
- Define the control environment
- Prioritize risks on a risk register (Correct answer)
- Establish segregation of duties
- Determine audit sample sizes only
Correct answer: Prioritize risks on a risk register
Combining probability and impact allows organizations to rank risks so resources are focused on the most significant exposures.
Question 7: Which internal control principle states that employees in key roles should periodically rotate to different positions?
- Mandatory vacation
- Job rotation (Correct answer)
- Dual custody
- Performance review
Correct answer: Job rotation
Job rotation reduces the risk of long-term fraud by ensuring no single employee has exclusive control over a process for extended periods.
CAT Internal Controls & Risk Assessment 3
Which risk response strategy involves shifting the financial consequence of a risk to a third party?