Risk and Internal Controls Flashcards

A compliance officer discovers that a business unit has implemented a compensating control to address a gap in a primary internal control. Under COSO ERM, which condition must be met for the compensating control to be considered fully effective?

Answer: The compensating control must reduce residual risk to the same level the primary control would have achieved, and must be formally documented in the risk register

Under COSO ERM, a compensating control is only considered fully effective when it achieves the same risk-reduction outcome as the primary control it replaces — bringing residual risk to the same acceptable level — and when it is formally documented so it can be tested, monitored, and communicated to stakeholders. Simply reducing inherent risk, obtaining management attestation, or awaiting external auditor sign-off are insufficient substitutes for meeting the original control objective with equivalent rigor.

During a risk assessment, an organization identifies a control that has been operating effectively for three years with zero exceptions. The risk owner proposes eliminating the control to reduce overhead costs. Which of the following responses reflects the most rigorous compliance governance position?

Answer: Approve removal only after conducting a formal risk re-assessment confirming that the underlying risk has been permanently mitigated or that acceptable alternative controls exist

A zero-exception record may indicate the control is working perfectly — not that the underlying risk has disappeared. The rigorous governance position is to re-assess whether the risk it mitigates still exists at an unacceptable level and whether alternative controls adequately cover it. Automatic removal without re-assessment conflates control effectiveness with risk elimination. Blanket rejection ignores the legitimate cost-benefit analysis embedded in COSO and ISO 31000. Deferring to external auditors oversteps their advisory role.

An organization's compliance function uses a heat map that plots inherent risk on both likelihood and impact axes. A regulator questions whether the heat map adequately reflects control quality. Which conceptual flaw does the regulator most likely identify?

Answer: A pure inherent-risk heat map omits residual risk, making it impossible to determine whether existing controls are adequate without a separate control-effectiveness overlay

A heat map that shows only inherent risk tells management and regulators how bad things could be without any controls, but gives no visibility into how effective current controls are at reducing that exposure. Regulators examining internal-control adequacy need to see residual risk — the risk remaining after controls are applied — which requires an additional layer showing control effectiveness ratings. The other options contain misconceptions: regulators do accept qualitative heat maps; likelihood subjectivity is a known limitation but not a disqualifier; and dual-axis plotting does not cause mathematical double-counting.

A financial services firm identifies a key risk indicator (KRI) that has breached its amber threshold for four consecutive months but has not yet reached the red threshold. Senior management decides to take no action, citing the absence of a red-level breach. Under sound risk governance, this decision is most problematic because:

Answer: Persistent amber-level breaches signal a deteriorating control environment and should trigger an escalation review even without a red breach, as trends matter as much as point-in-time thresholds

Threshold-based risk governance is designed to detect deterioration before a crisis occurs. A KRI that stays in amber for four consecutive months reveals a sustained directional trend, not a one-time anomaly. Mature risk frameworks — including those aligned with Basel Committee guidance for financial firms — require trend analysis alongside point-in-time readings, and persistent sub-red breaches should trigger investigation and possible control enhancement. Treating the amber/red boundary as the sole trigger ignores the early-warning function that KRIs are designed to serve.

An organization implements segregation of duties (SoD) in its procure-to-pay process. A post-implementation review finds that the SoD control is operating as designed, yet a fraudulent payment still occurred. The root-cause analysis reveals the fraud was perpetrated through collusion between two individuals whose roles are properly segregated. Which internal control concept does this scenario best illustrate?

Answer: The inherent limitation of preventive controls against collusion, which is a recognized residual risk that SoD alone cannot eliminate

COSO and most internal control frameworks explicitly acknowledge that no system of internal controls can provide absolute assurance. Collusion is a recognized inherent limitation of SoD: the control is designed on the assumption that two independent individuals would not conspire, but when they do, the preventive control is circumvented by design — not by a flaw in the control itself. The scenario is not a design deficiency (the control worked as intended), not purely a monitoring failure (monitoring may detect after the fact but does not eliminate SoD's collusion limitation), and not solely a tone-at-the-top issue (culture matters but is not the direct mechanism).

Under the Three Lines of Defense model, a compliance function (second line) identifies a systemic control gap in a business unit (first line) and proceeds to remediate the gap directly by redesigning the business unit's workflow. Which governance problem does this action create?

Answer: It blurs the independence of the second line by assuming ownership of first-line operational controls, undermining the second line's ability to objectively oversee the same controls it designed

The Three Lines of Defense model — as articulated by IIA and embedded in most regulatory guidance for financial institutions — separates control ownership (first line) from oversight and challenge (second line) to preserve objectivity. When the second line takes over designing or operating first-line controls, it can no longer independently evaluate those same controls without conflict of interest. The internal audit function (third line) would also face independence complications when auditing controls the second line designed. The model does not prohibit the second line from advising or recommending — but direct remediation crosses into first-line territory.