CCT Risk Management & Internal Controls 5

Question 1

Which of the following scenarios exemplifies a 'residual risk' determination?

Accepted Answer

Calculating remaining risk exposure after existing controls have been applied

Answer

Residual risk is the risk that remains after the organization has implemented its controls and risk responses.

Question 2

A compliance team discovers that a control designed to prevent unauthorized system access has not been functioning for three months. The compliance officer should first:

Accepted Answer

Implement an interim compensating control and escalate to senior management

Answer

When a primary control fails, deploying a compensating control immediately limits ongoing exposure while escalation ensures appropriate oversight and remediation.

Question 3

Under the COSO framework, the 'control environment' component is best described as:

Accepted Answer

The foundation of internal control, shaped by management's integrity, ethics, and governance structure

Answer

The control environment sets the overall tone of the organization and is the foundation upon which all other components of internal control rest.

Question 4

Which metric is commonly used in quantitative risk analysis to express the expected financial loss from a specific risk over a one-year period?

Accepted Answer

Annual Loss Expectancy (ALE)

Answer

Annual Loss Expectancy (ALE) is calculated as Asset Value × Exposure Factor × Annualized Rate of Occurrence and represents the expected yearly financial impact of a risk.

Question 5

A compliance manager notices that a key internal control is effective but is costing far more to maintain than the risk it mitigates. Which principle should guide the decision?

Accepted Answer

The cost of a control should be proportionate to the risk it addresses

Answer

The cost-benefit principle holds that the cost of implementing and maintaining a control should not exceed the benefit derived from reduced risk exposure.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT Risk Management & Internal Controls 5