CGAP Risk-Control Frameworks 5

Question 1

Which COSO ERM 2017 component includes 'Performance' as a key area where risk is identified, assessed, and prioritized in relation to risk appetite?

Accepted Answer

Performance

Answer

In COSO ERM 2017, the Performance component is where risks are identified, assessed, prioritized, and responded to in relation to the entity's risk appetite.

Question 2

A government auditor assesses control effectiveness by reviewing whether controls operate consistently over time. This type of evaluation is best described as:

Accepted Answer

Operating effectiveness testing

Answer

Operating effectiveness testing determines whether a control has functioned consistently as designed throughout the period under review, not just whether the design is sound.

Question 3

In risk management, 'risk velocity' refers to:

Accepted Answer

The speed at which a risk can impact the organization once triggered

Answer

Risk velocity measures how quickly a risk could impact the organization after it materializes, influencing how much response time management has.

Question 4

Under FISMA, federal agencies must implement an information security program that includes which of the following risk management activities?

Accepted Answer

Categorization, selection, implementation, and assessment of security controls using NIST guidelines

Answer

FISMA requires agencies to categorize information and systems, select and implement appropriate NIST-based security controls, and regularly assess their effectiveness.

Question 5

A control that prevents a risk event from occurring is classified as:

Accepted Answer

Preventive

Answer

Preventive controls are designed to deter or prevent error, fraud, or other undesirable events before they occur.

CGAP - Certified Government Auditing Professional Practice Test

CGAP - Certified Government Auditing Professional Practice Test

CGAP Risk-Control Frameworks 5