Internal Controls & Risk Management Flashcards

Which of the following BEST describes a corrective control?

Answer: A control that fixes errors or irregularities after detection

Corrective controls are designed to remedy problems or irregularities that have been detected by detective controls.

Under the COSO Internal Control framework, 'monitoring activities' include which of the following?

Answer: Ongoing evaluations and separate evaluations of internal controls

Monitoring activities involve ongoing evaluations, separate evaluations, or a combination of both to determine whether internal control components are present and functioning.

A company's risk register is BEST described as:

Answer: A documented inventory of identified risks including their likelihood, impact, and controls

A risk register is a structured document that captures identified risks, their assessed probability and impact, current controls, and assigned risk owners.

Which internal control principle requires that financial records be supported by source documents such as invoices, receipts, and contracts?

Answer: Documentation

Documentation controls ensure that all transactions are supported by adequate source documents that provide evidence the transaction occurred and was properly authorized.

IT general controls (ITGCs) are best described as controls that:

Answer: Apply broadly to the IT environment and support the reliability of application controls

IT general controls include access management, change management, and computer operations controls that create a stable environment for application controls to function reliably.

When an organization chooses to accept a risk because the cost of controlling it exceeds the potential benefit, this is called:

Answer: Risk acceptance

Risk acceptance is the deliberate decision to tolerate a risk, typically because the cost-benefit analysis shows that controls would cost more than the risk's expected impact.

Whistleblower protection provisions under SOX are designed to:

Answer: Protect employees from retaliation for reporting suspected securities law violations

SOX whistleblower provisions protect employees of publicly traded companies from retaliation when they report suspected fraud or securities law violations.