Risk-Control Frameworks Flashcards

In the COSO ERM framework, which component ensures that risk responses are identified and selected to bring residual risk within desired tolerance?

Answer: Risk Response

Risk Response is the COSO ERM component where management selects risk responses—avoiding, accepting, reducing, or sharing risk—to align residual risk with risk tolerance.

A government agency uses a heat map to display risks. What two dimensions are typically plotted on a risk heat map?

Answer: Likelihood and impact

Risk heat maps plot likelihood (probability) on one axis and impact (consequence) on the other to visually prioritize risks.

Which NIST SP 800-39 tier addresses risk at the mission/business process level in a government organization?

Answer: Tier 2 – Mission/Business Process

NIST SP 800-39 defines Tier 2 as the mission/business process level, which addresses risk from the perspective of core organizational functions.

Under the GAO Green Book (Standards for Internal Control in the Federal Government), which principle requires management to define objectives with sufficient clarity to identify associated risks?

Answer: CC3.01 – Specify Suitable Objectives

Green Book principle CC3.01 requires management to specify objectives clearly so that risks to achieving them can be identified and assessed.

An auditor discovers that a public sector entity has no documented process for monitoring changes in the external environment that could introduce new risks. Which COSO ERM component is deficient?

Answer: Monitoring

Monitoring involves reviewing the ERM process over time, including changes in the external environment that could alter the risk profile; its absence indicates a monitoring deficiency.

Residual risk differs from inherent risk in that residual risk is measured:

Answer: After management's risk response and controls are applied

Residual risk is the risk remaining after management has implemented controls and other risk responses, whereas inherent risk exists before any controls.

Which key risk indicator (KRI) characteristic makes it most useful for proactive risk management in a government audit context?

Answer: It provides a leading signal before a risk event materializes

A KRI serves as a leading indicator, warning management that risk levels are changing before an adverse event occurs, enabling proactive action.