CIG Risk Management & Compliance 3 â Questions and Answers
Question 1: Which federal statute requires agency heads to report annually on the effectiveness of internal controls and financial systems?
- Federal Information Security Modernization Act (FISMA)
- Federal Managers Financial Integrity Act (FMFIA) (Correct answer)
- Government Performance and Results Act (GPRA)
- Inspector General Act of 1978
Correct answer: Federal Managers Financial Integrity Act (FMFIA)
FMFIA requires agency heads to evaluate and report on the adequacy of internal controls and financial management systems each year.
Question 2: A heat map used in risk management typically plots risks on axes representing which two dimensions?
- Cost and schedule
- Likelihood and impact (Correct answer)
- Detection difficulty and control strength
- Frequency and duration
Correct answer: Likelihood and impact
A risk heat map visualizes risks by plotting the probability (likelihood) of occurrence against the potential consequence (impact), helping prioritize mitigation efforts.
Question 3: Under the False Claims Act, what is the role of the qui tam provision?
- It authorizes the IG to issue civil subpoenas
- It allows private citizens to file suits on behalf of the government and share in any recovery (Correct answer)
- It requires contractors to self-disclose fraud within 30 days
- It mandates suspension of payments pending fraud investigation
Correct answer: It allows private citizens to file suits on behalf of the government and share in any recovery
The qui tam provision of the False Claims Act (31 U.S.C. § 3730) enables whistleblowers (relators) to sue on the government's behalf and receive a share of recovered funds.
Question 4: What is a 'tone at the top' indicator that an inspector general might review to assess an organization's compliance culture?
- Number of vendor invoices processed monthly
- Whether senior leaders publicly endorse ethics policies and hold violators accountable (Correct answer)
- The ratio of auditors to program staff
- Annual travel expense totals
Correct answer: Whether senior leaders publicly endorse ethics policies and hold violators accountable
Tone at the top is demonstrated by leadership's visible commitment to ethicsâincluding communications, accountability actions, and consistency between stated values and behavior.
Question 5: Which risk response strategy involves accepting the potential consequences of a risk without taking action to reduce it?
- Risk transfer
- Risk avoidance
- Risk acceptance (Correct answer)
- Risk mitigation
Correct answer: Risk acceptance
Risk acceptance means management consciously decides not to act on a risk, either because the cost of control exceeds the benefit or the risk falls within tolerance.
Question 6: An IG finds that program managers are not documenting decisions because they fear audits. This behavior is an example of what compliance risk?
- Regulatory capture
- Risk aversion causing operational opacity (Correct answer)
- Conflict of interest
- Segregation of duties failure
Correct answer: Risk aversion causing operational opacity
When fear of oversight causes employees to avoid documentation, it creates opacity and undermines accountabilityâa compliance risk tied to culture and control environment.
Question 7: In enterprise risk management, what does 'risk aggregation' refer to?
- Combining multiple low-level risks to assess their cumulative enterprise-wide effect (Correct answer)
- Delegating risk ownership to a single risk officer
- Transferring all risk to an insurance provider
- Documenting risks in a single register
Correct answer: Combining multiple low-level risks to assess their cumulative enterprise-wide effect
Risk aggregation examines how individually manageable risks combine across the organization to create a total exposure that may be significantly larger than any single risk.
CIG Risk Management & Compliance 3
Which federal statute requires agency heads to report annually on the effectiveness of internal controls and financial systems?