CCCP Risk Management & Internal Controls 4 — Questions and Answers
Question 1: When conducting a risk assessment, 'velocity' refers to:
- The frequency with which a risk is reviewed
- The speed at which a risk can impact the organization once triggered (Correct answer)
- The rate at which new risks are identified
- The pace of implementing risk controls
Correct answer: The speed at which a risk can impact the organization once triggered
Risk velocity measures how quickly a risk event will affect the organization after it occurs, which influences the urgency of the required response.
Question 2: A compliance program conducts periodic testing of controls to verify they are operating as designed. This activity is best described as:
- Risk identification
- Control design assessment
- Control operating effectiveness testing (Correct answer)
- Gap analysis
Correct answer: Control operating effectiveness testing
Control operating effectiveness testing evaluates whether controls are actually functioning as intended in practice, not just whether they are well-designed on paper.
Question 3: Which COSO internal control component addresses the policies and procedures that help ensure management directives are carried out?
- Control environment
- Risk assessment
- Control activities (Correct answer)
- Monitoring activities
Correct answer: Control activities
Control activities are the specific policies and procedures that operationalize management's risk responses and ensure its directives are executed throughout the organization.
Question 4: A company implements job rotation for employees in sensitive financial roles. The PRIMARY compliance benefit of this practice is:
- Improving employee skill development
- Detecting or deterring fraud by limiting prolonged control of one area (Correct answer)
- Reducing operational costs through cross-training
- Satisfying mandatory regulatory staffing requirements
Correct answer: Detecting or deterring fraud by limiting prolonged control of one area
Mandatory job rotation reduces the opportunity for fraud by preventing any single employee from maintaining long-term, unchecked control over a sensitive function.
Question 5: Which term describes the process of ranking risks by their significance to prioritize compliance resources?
- Risk mapping
- Risk scoring
- Risk prioritization (Correct answer)
- Risk stratification
Correct answer: Risk prioritization
Risk prioritization is the process of ranking identified risks by their relative significance (likelihood × impact) to focus limited compliance resources on the most critical areas.
Question 6: An organization's compliance function identifies a new regulatory requirement with a 90-day implementation deadline. Which risk response is MOST appropriate?
- Risk avoidance
- Risk acceptance
- Risk reduction (Correct answer)
- Risk transfer
Correct answer: Risk reduction
Risk reduction involves taking action to lower the likelihood or impact of a risk, and implementing controls to meet the new regulatory requirement is a textbook risk reduction response.
Question 7: A material weakness in internal controls is BEST defined as:
- A minor error in a non-critical business process
- A significant deficiency that does not rise to the level of a material weakness
- A deficiency or combination of deficiencies that could result in a material misstatement not being prevented or detected (Correct answer)
- Any control that has failed to operate for more than 30 days
Correct answer: A deficiency or combination of deficiencies that could result in a material misstatement not being prevented or detected
A material weakness is a severe internal control deficiency where there is a reasonable possibility that a material misstatement of financial statements would not be prevented or timely detected.
CCCP Risk Management & Internal Controls 4
When conducting a risk assessment, 'velocity' refers to: