CCT Risk Management & Internal Controls 4 — Questions and Answers
Question 1: What is the primary purpose of a compliance risk register?
- To document employee disciplinary actions
- To catalog identified risks along with their likelihood, impact, and control status (Correct answer)
- To track customer complaints received by the compliance department
- To record regulatory examination findings only
Correct answer: To catalog identified risks along with their likelihood, impact, and control status
A risk register is a centralized record that captures identified risks, their assessed severity, assigned owners, current controls, and remediation status.
Question 2: Which of the following best describes 'operational risk' in a compliance context?
- The risk of loss from fluctuations in market interest rates
- The risk arising from inadequate internal processes, people, systems, or external events (Correct answer)
- The risk that a borrower will default on a loan
- The risk of regulatory changes that affect profitability
Correct answer: The risk arising from inadequate internal processes, people, systems, or external events
Operational risk encompasses losses resulting from failed internal processes, human error, system failures, or external disruptions.
Question 3: A board's audit committee receives a report showing that corrective actions from an internal audit finding have not been completed on schedule. This situation most directly threatens which risk management principle?
- Risk identification
- Risk tolerance definition
- Risk response accountability (Correct answer)
- Risk appetite communication
Correct answer: Risk response accountability
Risk response accountability requires that assigned owners take timely corrective action; failure to do so undermines the entire control remediation process.
Question 4: An organization decides to exit a particular line of business because the compliance risks are too high to manage cost-effectively. This represents which risk strategy?
- Risk transfer
- Risk mitigation
- Risk avoidance (Correct answer)
- Risk acceptance
Correct answer: Risk avoidance
Risk avoidance involves eliminating an activity or exposure entirely so the associated risk no longer exists for the organization.
Question 5: Which of the following is an example of a preventive control designed to reduce compliance risk?
- Reviewing exception reports after transactions are processed
- Requiring management approval before a new vendor is onboarded (Correct answer)
- Conducting post-incident investigations after a policy breach
- Performing quarterly audits of transaction records
Correct answer: Requiring management approval before a new vendor is onboarded
Preventive controls act before a risk event occurs; requiring approval before onboarding a vendor stops noncompliant vendors from entering the system.
Question 6: In risk heat mapping, a risk plotted in the top-right quadrant (high likelihood, high impact) should receive which management response?
- Accept and monitor with no immediate action
- Transfer to insurance carrier immediately
- Prioritize for immediate mitigation and senior oversight (Correct answer)
- Defer to the next annual risk assessment cycle
Correct answer: Prioritize for immediate mitigation and senior oversight
High-likelihood, high-impact risks demand prompt, prioritized treatment and should be escalated to senior leadership for oversight and resource allocation.
Question 7: What role does 'tone at the top' play in effective internal controls?
- It determines the statistical methodology used in risk assessments
- It establishes the cultural environment that influences employees' commitment to compliance controls (Correct answer)
- It sets the dollar thresholds for financial materiality decisions
- It defines the technical specifications of IT security controls
Correct answer: It establishes the cultural environment that influences employees' commitment to compliance controls
Tone at the top refers to senior leadership's demonstrated commitment to ethical behavior and compliance, which shapes the organizational culture that underlies all internal controls.
CCT Risk Management & Internal Controls 4
What is the primary purpose of a compliance risk register?