Internal Controls & Risk Management Flashcards

Which COSO framework component addresses how an organization communicates information necessary for employees to carry out their internal control responsibilities?

Answer: Information & Communication

The Information & Communication component ensures relevant information is identified, captured, and communicated in a timely manner to support internal control.

A company discovers that a single employee can both approve purchase orders and authorize payments. This represents a failure in which internal control principle?

Answer: Segregation of duties

Segregation of duties requires that no single employee controls all phases of a transaction to reduce fraud and error risk.

Under the ERM framework, 'residual risk' is best defined as:

Answer: Risk remaining after management has applied controls

Residual risk is the level of risk that remains after management implements risk responses and controls.

Which internal control technique involves comparing recorded amounts with independently determined amounts such as bank statements?

Answer: Reconciliation

Reconciliation is the process of comparing two sets of records to ensure they are consistent and accurate.

A company's board audit committee is primarily responsible for:

Answer: Overseeing financial reporting and internal audit functions

The audit committee oversees financial reporting integrity, internal audit activities, and compliance with regulatory requirements.

Which risk response strategy involves sharing risk exposure with another party, such as through insurance?

Answer: Risk transfer

Risk transfer shifts the financial consequences of risk to another party, most commonly through insurance or contractual arrangements.

The 'three lines of defense' model assigns internal audit to which line?

Answer: Third line

Internal audit serves as the third line of defense, providing independent assurance over the effectiveness of governance, risk management, and control.