Governance & Internal Controls Flashcards

Enterprise Risk Management (ERM) expands upon traditional internal control frameworks by additionally addressing:

Answer: Strategic and reputational risks across the entire organization

ERM takes a broader, entity-wide view that includes strategic and reputational risks, not just operational and financial controls addressed in traditional frameworks.

An agency's audit committee that includes a majority of non-federal-employee members BEST supports which governance principle?

Answer: Independence of oversight

Having outside members on an audit committee strengthens independence, ensuring oversight is not compromised by internal management relationships.

Under OMB Circular A-123, management's responsibility for internal control includes issuing an annual assurance statement that covers:

Answer: The effectiveness of internal controls over financial reporting and operations

OMB Circular A-123 requires agency heads to provide an annual assurance statement on the effectiveness of internal controls over both financial reporting and operations.

A 'compensating control' is BEST described as:

Answer: An alternative control that mitigates risk when a primary control cannot be implemented

Compensating controls provide alternative risk mitigation when ideal controls (like separation of duties in small offices) are not feasible.

Which scenario BEST illustrates the governance concept of 'tone at the top'?

Answer: The agency head publicly acknowledges and corrects an internal control failure identified by the IG

A leader publicly owning and addressing a control failure demonstrates the transparency and accountability that define a strong ethical tone from the top.

The Inspector General Act of 1978 established OIGs primarily to promote which two governance objectives?

Answer: Economy, efficiency, and effectiveness; and prevention of fraud, waste, and abuse

The IG Act created independent offices to promote economy, efficiency, and effectiveness, while preventing and detecting fraud, waste, and abuse.

When assessing internal controls, an Inspector General should give the HIGHEST priority to controls that address:

Answer: Risks with high likelihood and high potential impact

A risk-based approach prioritizes controls over high-likelihood, high-impact risks to focus limited audit resources where they matter most.