CGAP Risk-Control Frameworks 2

Question 1

In the COSO ERM framework, which component ensures that risk responses are identified and selected to bring residual risk within desired tolerance?

Accepted Answer

Risk Response

Answer

Risk Response is the COSO ERM component where management selects risk responses—avoiding, accepting, reducing, or sharing risk—to align residual risk with risk tolerance.

Question 2

A government agency uses a heat map to display risks. What two dimensions are typically plotted on a risk heat map?

Accepted Answer

Likelihood and impact

Answer

Risk heat maps plot likelihood (probability) on one axis and impact (consequence) on the other to visually prioritize risks.

Question 3

Which NIST SP 800-39 tier addresses risk at the mission/business process level in a government organization?

Accepted Answer

Tier 2 – Mission/Business Process

Answer

NIST SP 800-39 defines Tier 2 as the mission/business process level, which addresses risk from the perspective of core organizational functions.

Question 4

Under the GAO Green Book (Standards for Internal Control in the Federal Government), which principle requires management to define objectives with sufficient clarity to identify associated risks?

Accepted Answer

CC3.01 – Specify Suitable Objectives

Answer

Green Book principle CC3.01 requires management to specify objectives clearly so that risks to achieving them can be identified and assessed.

Question 5

An auditor discovers that a public sector entity has no documented process for monitoring changes in the external environment that could introduce new risks. Which COSO ERM component is deficient?

Accepted Answer

Monitoring

Answer

Monitoring involves reviewing the ERM process over time, including changes in the external environment that could alter the risk profile; its absence indicates a monitoring deficiency.

CGAP - Certified Government Auditing Professional Practice Test

CGAP - Certified Government Auditing Professional Practice Test

CGAP Risk-Control Frameworks 2