CCT Risk Management & Internal Controls 2

Question 1

Which risk assessment technique assigns numerical probabilities and financial values to potential losses to calculate an expected monetary outcome?

Accepted Answer

Quantitative risk analysis

Answer

Quantitative risk analysis uses numerical data—likelihood percentages and monetary impact—to compute expected loss values such as Annual Loss Expectancy (ALE).

Question 2

A 'three lines of defense' model assigns the primary ownership of risk management to which line?

Accepted Answer

Business unit management

Answer

The first line of defense consists of business unit management, who own and manage risks in day-to-day operations.

Question 3

When a company purchases cyber liability insurance to handle the financial impact of a data breach, it is employing which risk response strategy?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial consequence of a risk to a third party, such as an insurer, without eliminating the underlying risk.

Question 4

Which internal control activity involves comparing financial data against prior periods or industry benchmarks to detect anomalies?

Accepted Answer

Analytical procedures

Answer

Analytical procedures use comparisons and ratio analyses to identify unexpected variances that may indicate errors or fraud.

Question 5

A company identifies that a risk's likelihood is low but its potential impact is catastrophic. How should this risk typically be prioritized?

Accepted Answer

Escalated and monitored closely due to high impact

Answer

High-impact risks require attention regardless of low probability because the potential harm to the organization can be severe or irreversible.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT Risk Management & Internal Controls 2