Internal Controls & Risk Management Flashcards
7 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Risk Management flashcards as text
Which of the following is an example of a preventive control rather than a detective control?
Answer: Password authentication requirements
Preventive controls like password authentication stop errors or fraud before they occur, unlike detective controls that identify issues after the fact.
Enterprise Risk Management (ERM) under COSO 2017 is organized around how many components?
Answer: 8
COSO's 2017 ERM framework is organized around 5 components and 20 principles, with 8 being associated with the older 2004 framework components.
A key risk indicator (KRI) differs from a key performance indicator (KPI) in that a KRI:
Answer: Signals the likelihood of future adverse events
KRIs are forward-looking metrics that provide early warning signals of increasing risk exposure before issues materialize.
Which control environment factor relates to management's demonstrated commitment to competence and ethical values?
Answer: Tone at the top
Tone at the top reflects the ethical values, integrity, and commitment to internal control demonstrated by senior leadership.
When assessing internal control effectiveness, an auditor identifies a deficiency where controls might not prevent or detect a material misstatement. This is classified as a:
Answer: Material weakness
A material weakness is a deficiency or combination of deficiencies in internal control where there is a reasonable possibility that a material misstatement will not be prevented or detected.
Operational risk is best described as the risk of loss resulting from:
Answer: Inadequate internal processes, people, or systems
Operational risk arises from failures in internal processes, human errors, system failures, or external events affecting business operations.
Which approach to risk assessment involves quantifying risk by assigning numerical probabilities and financial impact estimates?
Answer: Quantitative risk assessment
Quantitative risk assessment uses statistical models and numerical data to estimate the probability and financial magnitude of risks.
How this page was made: written with AI tools. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy