Risk and Internal Controls Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk and Internal Controls flashcards as text
Which of the following best describes 'inherent risk' in a compliance context?
Answer: Risk that exists before any mitigating controls are in place
Inherent risk is the exposure to potential loss that exists naturally in a process or activity before any controls or mitigation measures are applied.
A compliance program uses automated system alerts to flag transactions exceeding a dollar threshold. This is best classified as a:
Answer: Detective control
Detective controls identify problems or policy violations after they occur, and automated threshold alerts notify compliance staff of potentially suspicious transactions after they are processed.
Under SOX Section 404, management must include in its annual report an assessment of the effectiveness of:
Answer: Internal control over financial reporting
SOX Section 404 requires management to assess and report on the effectiveness of internal controls over financial reporting (ICFR), with external auditor attestation.
Which scenario represents a violation of the segregation of duties principle?
Answer: A purchasing agent also has authority to approve payments for their own purchase orders
Segregation of duties is violated when one individual controls multiple phases of a transaction (initiation, approval, recording), creating unchecked opportunity for fraud or error.
An organization's board of directors is responsible for which of the following in the context of risk governance?
Answer: Setting risk appetite and overseeing the risk management framework
The board sets the organization's risk appetite and provides oversight of the enterprise risk management framework, while delegating operational execution to management.
Which type of audit evidence is generally considered most reliable when assessing internal control effectiveness?
Answer: Third-party confirmations
Third-party confirmations obtained directly from external sources are considered highly reliable because they are independent of the organization being audited.
A Key Risk Indicator (KRI) is BEST described as:
Answer: A forward-looking metric that signals increasing risk exposure
KRIs are leading indicators that provide early warning of increasing risk levels, enabling organizations to take proactive action before risks materialize into losses.