CBA Auditing Risk Management 5

Question 1

An internal auditor discovers that a bank's compliance risk assessment does not include an evaluation of newly enacted consumer protection regulations. This gap most directly reflects a failure in:

Accepted Answer

The regulatory change management process within the compliance risk framework

Answer

A compliance risk assessment must capture regulatory changes through a structured change management process to ensure new requirements are identified and addressed timely.

Question 2

When evaluating a bank's Pillar 2 Internal Capital Adequacy Assessment Process (ICAAP), auditors should assess whether:

Accepted Answer

All material risks, including those not captured in Pillar 1, are identified and capitalized

Answer

ICAAP must capture all material risks including Pillar 2 risks such as concentration risk, IRRBB, and strategic risk that are not fully addressed in Pillar 1.

Question 3

A bank's risk management audit reveals that front-office traders can both execute trades and update the risk system positions without segregation of duties. This creates the highest risk of:

Accepted Answer

Unauthorized trading and concealment of losses similar to rogue trader incidents

Answer

Without segregation between trade execution and position recording, traders can conceal unauthorized or losing positions, as seen in high-profile rogue trader cases.

Question 4

Which of the following is a key indicator that a bank's risk culture may be weak, even if documented policies appear adequate?

Accepted Answer

Employees routinely bypass risk controls citing business pressure, and near-misses are rarely reported

Answer

A weak risk culture is evidenced by behavioral patterns such as control bypass under business pressure and low near-miss reporting, regardless of how strong policies appear on paper.

Question 5

Under the OCC's guidance on risk governance, the Chief Risk Officer (CRO) should have which of the following characteristics to ensure effectiveness?

Accepted Answer

Independence from business lines, direct board access, and authority to escalate risk concerns

Answer

An effective CRO must be independent from revenue-generating units, have direct access to the board, and possess authority to escalate risk concerns without business line interference.

(CBA) Certified Bank Auditor Practice Test

(CBA) Certified Bank Auditor Practice Test

CBA Auditing Risk Management 5