Risk and Internal Controls Flashcards

A compliance manager discovers that a subsidiary's internal audit function reports directly to the CFO rather than to the audit committee. Under COSO's Internal Control — Integrated Framework, which specific control environment principle is most directly compromised by this reporting structure?

Answer: The board of directors demonstrates independence from management and exercises oversight of internal controls.

When internal audit reports to the CFO, the independence of the audit function from executive management is compromised. COSO's principle 2 requires the board (via the audit committee) to maintain oversight independent of management. An internal audit function reporting to the CFO creates a self-review threat and undermines the board's ability to obtain unfiltered information about control deficiencies — especially any involving financial management.

During a risk assessment, a compliance manager calculates that an operational risk has an inherent risk score of 20 (high likelihood × high impact) but a residual risk score of 4 after controls. The business unit argues the controls are so effective that no further action is needed. What is the most critical flaw in accepting this conclusion without further analysis?

Answer: Effective controls reduce residual risk but do not address control risk — the possibility that controls themselves may fail.

Even highly effective controls carry control risk — the probability that the control itself will fail due to human error, circumvention, system failure, or changing conditions. A residual risk score of 4 is meaningless without understanding the reliability, frequency of operation, and ongoing monitoring of those controls. Accepting low residual risk based solely on a score ignores whether controls are continuously operating as designed, a concept central to control sustainability under COSO.

A financial institution's three lines of defense model has the compliance function (second line) directly co-authoring policies with business units (first line) and then independently auditing those same policies. Which risk management failure does this arrangement most precisely represent?

Answer: Collapse of the second line's independence, creating a self-review threat that impairs objective assurance.

The three lines model depends on the second line (compliance/risk) maintaining independence from first-line operations to provide objective oversight. When compliance co-authors policies alongside business units and then audits those same policies, it becomes a judge of its own work — a classic self-review threat. This structurally eliminates the second line's ability to provide credible challenge, because any deficiency in those policies reflects on compliance itself. The IIA's Three Lines Model (2020) explicitly warns against blurring these boundaries.

An organization uses a Key Risk Indicator (KRI) threshold of 15% policy exception rate to trigger escalation. The rate reaches 14.8% for three consecutive quarters but is never escalated because it technically falls below the threshold. Which internal control weakness does this scenario most precisely illustrate?

Answer: A design deficiency in the KRI framework — threshold gaming — where precise limits create perverse incentives to manage to the metric rather than the underlying risk.

This is a threshold-gaming design deficiency. When a single hard threshold exists without trend analysis, tolerance bands, or consecutive-period rules, it creates an incentive (intentional or not) to manage the indicator rather than the risk. Three consecutive quarters at 14.8% signals a persistent near-breach that a well-designed KRI framework would capture through trend escalation triggers or tolerance corridors. This is a design flaw — the control exists but is structured in a way that allows meaningful risk signals to be systematically suppressed.

Under the COSO ERM Framework (2017), an organization identifies a risk event that simultaneously reduces the likelihood of a separate, previously identified risk. In formal risk taxonomy, this relationship is best described as which of the following?

Answer: A risk interdependency where one risk functions as a natural hedge or offsetting factor against another.

COSO ERM 2017 explicitly addresses risk interdependencies — situations where risks are not independent but influence each other's likelihood or impact. When one risk event reduces the probability of another, it functions as a natural hedge (an offsetting interdependency). This is distinct from correlation (which describes risks that move together, not in opposition), residual risk (which results from applying controls), and velocity (which describes the speed of risk onset). Compliance managers must map these interdependencies to avoid both over-mitigation and blind spots in the portfolio view.

A compliance manager is evaluating a compensating control implemented because a primary preventive control cannot be feasibly deployed. The compensating control detects violations within 48 hours on average but cannot prevent them. Under a layered control framework, which condition is MOST critical to validate before accepting the compensating control as adequate?

Answer: The 48-hour detection window must not exceed the organization's maximum tolerable period of disruption for the underlying risk.

A detective compensating control is acceptable only when the harm that can occur during the detection lag is within the organization's risk tolerance. The 48-hour window means violations can occur and persist for up to two days before remediation begins. If the maximum tolerable exposure during that window exceeds risk appetite — whether measured in financial loss, regulatory exposure, or reputational damage — the compensating control is inadequate regardless of its other characteristics. Automation, audit frequency, and board approval are governance factors but are secondary to whether the control's inherent detection lag is compatible with tolerable risk.