Risk and Internal Controls Flashcards

A compliance manager discovers that a business unit has implemented a compensating control because the primary control is too costly to maintain. During an internal audit, the compensating control is found to reduce—but not eliminate—the residual risk. Under COSO ERM 2017 principles, what is the MOST appropriate next step?

Answer: Accept the remaining residual risk if it falls within the organization's documented risk appetite and obtain formal management sign-off

Under COSO ERM 2017, residual risk after controls is evaluated against the organization's risk appetite—not a zero-risk standard. If the remaining residual risk is within the accepted risk appetite and management formally acknowledges and approves the gap, the compensating control arrangement is appropriate. Automatic escalation to the board or mandatory replacement of controls regardless of cost-benefit is not required; the framework allows risk acceptance with proper authorization.

An organization's internal audit reveals that segregation of duties (SoD) conflicts exist in the accounts payable module for a team of only three employees. Implementing full SoD would require hiring two additional staff, which management deems cost-prohibitive. Which control response BEST addresses this situation while maintaining an effective internal control environment?

Answer: Implement enhanced mitigating controls such as supervisory review of all transactions and monthly reconciliation by an independent party, and document the exception with risk acceptance

When full SoD is not feasible—a common reality in small teams—the accepted approach is to implement mitigating (compensating) controls such as independent supervisory review, exception reporting, and periodic reconciliations, combined with a formally documented risk exception approved by management. There is no blanket small-team exemption under COSO or SOX; outsourcing the function may not be practical or proportionate; and monthly rotation does not actually prevent a single employee from having incompatible access at the same time.

A Certified Compliance Manager is evaluating a control that produces a high volume of exceptions daily but has never triggered a formal escalation. Investigations show that the control owner routinely marks all exceptions as 'reviewed and resolved' within minutes without substantive follow-up. This pattern MOST likely indicates which of the following internal control failures?

Answer: Control operating effectiveness failure — the control exists on paper but is not functioning as designed

When a control is formally documented and seemingly operated (exceptions are 'reviewed') but the operation is perfunctory and produces no substantive outcome, this is a classic operating effectiveness failure—the control exists in design but fails in practice. A design deficiency would mean the control's threshold or logic is flawed, not that substantive review is skipped. A control environment or tone-at-the-top issue may be a contributing root cause but the direct observable failure is in operating effectiveness. Inherent risk misclassification would be a separate assessment issue.

During a third-party risk assessment, a compliance manager determines that a critical vendor processes sensitive personal data but has only SOC 2 Type I certification, not Type II. The vendor contract renews in 45 days. What is the MOST risk-aware course of action?

Answer: Renew the contract with a contractual obligation for the vendor to obtain SOC 2 Type II within a defined timeframe, supplemented by enhanced due diligence measures in the interim

SOC 2 Type I attests to the design of controls at a point in time, while SOC 2 Type II attests to the operating effectiveness of those controls over a period—the latter is materially more meaningful for ongoing risk assurance. Requiring full Type II certification in 45 days is operationally unrealistic (a Type II audit typically covers 6–12 months of operation). The risk-aware approach is to renew with a contractual commitment to achieve Type II within a defined window, while implementing interim compensating measures such as more frequent questionnaires, on-site visits, or additional contractual data protection clauses. A self-attestation questionnaire provides far weaker assurance than SOC 2.

An organization implements a new automated transaction monitoring system that flags suspicious activity. After six months, analysis shows the system has a 92% true-positive rate and an 8% false-negative rate. A compliance manager is asked whether the control is effective. Which additional metric is MOST critical to evaluate before concluding the control is adequate?

Answer: The false-positive rate and the capacity of the compliance team to investigate all alerts generated

A high true-positive detection rate is only part of the picture. If the false-positive rate is very high, compliance staff will face alert fatigue, leading to superficial reviews that allow genuine suspicious activity to be dismissed. The operational capacity of the team to meaningfully investigate every alert is therefore a critical effectiveness factor—a theoretically excellent detection system becomes ineffective if investigators cannot keep up. Transaction volume, vendor certifications, and algorithm age are secondary considerations that do not directly assess whether the control is operationally sound in practice.

A compliance manager conducting a root cause analysis discovers that a significant control failure occurred because the control was re-scoped during a system migration project without updating the corresponding risk register entry or notifying the control owner's second-line function. Under a mature Three Lines of Defense model, which systemic failure PRIMARILY enabled this breakdown?

Answer: The first line failed to self-identify and report the control re-scoping to the second line during the project

Under the Three Lines of Defense model, the first line (business operations/process owners) is accountable for identifying, owning, and communicating changes to controls within their domain to the second line (risk and compliance). A system migration that re-scopes a control without the first line notifying the second line is a failure of first-line ownership and communication—the most proximate cause of the breakdown. While the third line (internal audit) may independently detect such gaps, it is not the primary control mechanism for real-time change management. Board approval and external audit are not designed as controls for operational change management of individual controls.