Risk and Internal Controls Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk and Internal Controls flashcards as text
Which framework is specifically designed to guide organizations in establishing, implementing, and improving information security management systems (ISMS)?
Answer: ISO 27001
ISO 27001 is the international standard that provides requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System.
When a compliance control is found to be ineffective, the organization implements a temporary measure to reduce risk while the primary control is remediated. This temporary measure is called a:
Answer: Compensating control
A compensating control is an alternative or supplementary measure put in place when a primary control cannot be implemented or has been found ineffective.
Which risk management strategy involves accepting a risk without taking any action to modify it, typically because the cost of mitigation exceeds the potential loss?
Answer: Risk retention
Risk retention (acceptance) means the organization deliberately chooses to bear a risk, often when the cost of mitigation outweighs the expected impact of the risk materializing.
During a compliance audit, the auditor selects 25 transactions out of 5,000 for review. This approach is known as:
Answer: Statistical sampling
Statistical sampling uses probability-based methods to select a representative subset of transactions, allowing auditors to draw conclusions about the entire population.
Which of the following is a primary characteristic of an effective whistleblower hotline as part of an internal controls environment?
Answer: Anonymity and non-retaliation protections for reporters
An effective whistleblower program must guarantee anonymity and protect reporters from retaliation to encourage reporting of potential violations without fear.
In a risk-based compliance approach, resources and testing efforts are allocated based on:
Answer: The level of risk each area poses to the organization
A risk-based approach concentrates compliance resources on higher-risk areas, ensuring that the most significant exposures receive the greatest scrutiny and control investment.
Which of the following scenarios BEST illustrates a 'material weakness' in internal control over financial reporting?
Answer: A significant deficiency in vendor invoice approval that could result in material misstatement
A material weakness is a deficiency where there is a reasonable possibility that a material misstatement in financial statements will not be prevented or detected on a timely basis.