Risk and Internal Controls Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk and Internal Controls flashcards as text
A compliance officer is reviewing an organization's risk register. Which element is LEAST likely to be included in a typical risk register entry?
Answer: Employee compensation details
A risk register typically includes risk description, likelihood, impact, owner, and mitigation actions — not employee compensation, which is unrelated to risk documentation.
Which internal control objective focuses on ensuring that financial and operational reports are accurate and complete?
Answer: Reporting
Under the COSO framework, the Reporting objective specifically addresses the reliability and accuracy of both internal and external financial and non-financial reporting.
An organization implements a control requiring two separate individuals to authorize any wire transfer over $50,000. This is an example of:
Answer: Dual control
Dual control requires two or more authorized individuals to be present or to approve a transaction simultaneously, preventing unilateral action on high-risk activities.
In the context of risk treatment, 'risk transfer' is best exemplified by:
Answer: Purchasing cybersecurity insurance
Risk transfer shifts the financial consequences of a risk to a third party, most commonly through insurance policies or contractual arrangements.
Which approach to internal control testing examines a sample of transactions from start to finish to verify all controls operated effectively throughout?
Answer: End-to-end testing
End-to-end testing traces transactions from initiation through completion, verifying that all controls in the process chain functioned as intended.
A Compliance officer identifies a 'gap' between the current state of controls and the required regulatory standard. The FIRST step should be to:
Answer: Conduct a root cause analysis
Root cause analysis identifies the underlying reason for the control gap, enabling the organization to develop a targeted and effective remediation strategy.
Which risk metric measures the maximum potential loss an organization could suffer over a specific time period at a given confidence level?
Answer: Value at Risk (VaR)
Value at Risk (VaR) is a statistical measure that quantifies the maximum expected loss over a defined period at a specified confidence level (e.g., 99%).