Risk Management & Internal Controls Flashcards

What is the primary purpose of a compliance risk register?

Answer: To catalog identified risks along with their likelihood, impact, and control status

A risk register is a centralized record that captures identified risks, their assessed severity, assigned owners, current controls, and remediation status.

Which of the following best describes 'operational risk' in a compliance context?

Answer: The risk arising from inadequate internal processes, people, systems, or external events

Operational risk encompasses losses resulting from failed internal processes, human error, system failures, or external disruptions.

A board's audit committee receives a report showing that corrective actions from an internal audit finding have not been completed on schedule. This situation most directly threatens which risk management principle?

Answer: Risk response accountability

Risk response accountability requires that assigned owners take timely corrective action; failure to do so undermines the entire control remediation process.

An organization decides to exit a particular line of business because the compliance risks are too high to manage cost-effectively. This represents which risk strategy?

Answer: Risk avoidance

Risk avoidance involves eliminating an activity or exposure entirely so the associated risk no longer exists for the organization.

Which of the following is an example of a preventive control designed to reduce compliance risk?

Answer: Requiring management approval before a new vendor is onboarded

Preventive controls act before a risk event occurs; requiring approval before onboarding a vendor stops noncompliant vendors from entering the system.

In risk heat mapping, a risk plotted in the top-right quadrant (high likelihood, high impact) should receive which management response?

Answer: Prioritize for immediate mitigation and senior oversight

High-likelihood, high-impact risks demand prompt, prioritized treatment and should be escalated to senior leadership for oversight and resource allocation.

What role does 'tone at the top' play in effective internal controls?

Answer: It establishes the cultural environment that influences employees' commitment to compliance controls

Tone at the top refers to senior leadership's demonstrated commitment to ethical behavior and compliance, which shapes the organizational culture that underlies all internal controls.