Risk and Internal Controls Flashcards
6 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk and Internal Controls flashcards as text
What is the primary purpose of internal controls?
Answer: To prevent fraud and ensure compliance
Internal controls are processes implemented by an organization to safeguard assets, ensure the accuracy of financial records, and promote adherence to policies, laws, and regulations. Their primary purpose is to mitigate risks, prevent fraud, and ensure compliance with legal and ethical requirements, thereby protecting the organization's integrity and resources.
Which component is part of the COSO framework for internal control?
Answer: Control environment
The COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework identifies five interrelated components of internal control. The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundational component for all other aspects of effective internal control.
Why is segregation of duties a critical internal control?
Answer: It helps prevent fraud and errors
Segregation of duties is a fundamental internal control principle that divides responsibilities for a single transaction or process among different individuals. By preventing any one person from having complete control over a transaction, it significantly reduces the opportunity for fraud, errors, and unauthorized actions, thereby enhancing accountability and security.
Which activity is considered a risk mitigation strategy?
Answer: Transferring risk through insurance
Risk mitigation strategies aim to reduce the impact or likelihood of a negative event. Transferring risk, such as purchasing insurance, is a common mitigation strategy. It shifts the financial burden of potential losses to a third party, thereby reducing the organization's direct exposure to that risk and protecting its assets.
Which type of control is used to detect errors or irregularities after they occur?
Answer: Detective controls
Detective controls are designed to identify errors, irregularities, or unauthorized activities that have already occurred. Unlike preventive controls, which aim to stop issues before they happen, detective controls like reconciliations, audits, and reviews bring issues to light. This allows for timely corrective action and helps maintain accuracy and compliance.
What is the role of a risk register in compliance management?
Answer: Document and track organizational risks
A risk register is a crucial tool in compliance management used to systematically identify, assess, document, and track potential risks that could impact an organization's objectives. It provides a centralized record of risks, their potential impact, likelihood, mitigation strategies, and ownership. This enables proactive risk management and informed decision-making.