Internal Controls & Risk Management Flashcards

Under SOX Section 302, corporate officers must certify that they have:

Answer: Disclosed any significant deficiencies in internal controls to the audit committee

SOX Section 302 requires CEO and CFO to certify that they have disclosed all significant deficiencies and material weaknesses in internal controls to the audit committee.

Which internal control activity is MOST effective at reducing the risk of asset misappropriation in a cash handling environment?

Answer: Mandatory vacation policies combined with cross-training

Mandatory vacation policies force employees to step away from their duties, allowing others to detect any misappropriation schemes during their absence.

A risk heat map is used primarily to:

Answer: Visually prioritize risks by likelihood and impact

A risk heat map plots risks on a matrix of likelihood versus impact to help management visually prioritize which risks require the most attention.

The concept of 'control consciousness' within an organization's control environment refers to:

Answer: The extent to which employees understand and value internal controls

Control consciousness reflects the overall culture and attitude of employees toward the importance of internal controls throughout the organization.

Which fraud triangle element refers to the perceived opportunity to commit fraud without detection?

Answer: Opportunity

Opportunity in the fraud triangle represents the circumstances that allow fraud to occur, typically created by weak internal controls.

A company implements automated system controls that prevent transactions exceeding preset dollar limits from processing without additional approval. This is an example of:

Answer: An IT application control

IT application controls are automated controls built into specific software applications to enforce business rules and transaction limits.

Risk appetite differs from risk tolerance in that risk appetite:

Answer: Expresses the broad amount of risk an entity is willing to accept in pursuit of strategy

Risk appetite is a high-level strategic statement about the overall amount of risk an organization is willing to accept, while tolerance defines specific acceptable variation around objectives.