Risk and Internal Controls Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk and Internal Controls flashcards as text
Which risk assessment methodology assigns a numerical score to risks based on probability and impact, allowing for quantitative comparison?
Answer: Risk scoring matrix
A risk scoring matrix multiplies probability by impact scores to produce a numerical risk score that enables objective, quantitative comparison across risks.
Under the COSO ERM framework, which component ensures that risk responses are aligned with the entity's risk appetite?
Answer: Risk response
The Risk Response component of COSO ERM involves selecting responses (avoid, reduce, share, accept) that bring residual risk within the entity's risk appetite.
A compliance officer discovers that a key control is being bypassed by senior management. This situation is best described as:
Answer: Management override
Management override occurs when senior leaders circumvent established internal controls, representing one of the most serious internal control risks.
Which type of risk represents the possibility that a compliance program will fail due to inadequate policies, procedures, or controls?
Answer: Control risk
Control risk is the risk that a material misstatement or compliance failure will not be prevented or detected by internal controls.
When performing a Business Impact Analysis (BIA), the primary goal is to:
Answer: Prioritize recovery of business functions by criticality
A BIA identifies and prioritizes critical business functions to determine recovery time objectives and the order in which operations should be restored after a disruption.
The 'three lines of defense' model assigns which primary role to the internal audit function?
Answer: Third line — independent assurance
Internal audit serves as the third line of defense by providing independent, objective assurance to senior management and the board on the effectiveness of governance and controls.
Which control is designed to limit access to sensitive systems only to personnel who require it for their job functions?
Answer: Principle of least privilege
The principle of least privilege restricts user access rights to the minimum permissions needed to perform their authorized tasks, reducing the risk of unauthorized actions.