CIG Risk Management & Compliance 5 — Questions and Answers
Question 1: When an IG identifies a 'significant deficiency' in internal controls, how does it differ from a 'material weakness'?
- A significant deficiency always involves fraud; a material weakness involves only error
- A significant deficiency is less severe and less likely to result in a material misstatement than a material weakness (Correct answer)
- A material weakness applies only to IT systems; a significant deficiency applies to financial processes
- They are equivalent terms used in different federal standards
Correct answer: A significant deficiency is less severe and less likely to result in a material misstatement than a material weakness
A significant deficiency is a control deficiency important enough to merit attention but less severe than a material weakness, which poses a reasonable possibility of a material misstatement.
Question 2: Which federal watchdog body coordinates the activities of all federal inspectors general and promotes IG independence?
- Government Accountability Office (GAO)
- Council of the Inspectors General on Integrity and Efficiency (CIGIE) (Correct answer)
- Office of Special Counsel (OSC)
- Congressional Budget Office (CBO)
Correct answer: Council of the Inspectors General on Integrity and Efficiency (CIGIE)
CIGIE is the coordinating body that fosters collaboration among federal IGs, establishes standards, and advocates for IG independence and resources.
Question 3: A contractor discloses a potential overpayment to the agency before an audit begins. Under the Federal Acquisition Regulation, how should the agency treat this self-disclosure?
- Immediately suspend the contractor pending investigation
- Consider it a mitigating factor and investigate promptly to determine the correct amount owed (Correct answer)
- Dismiss it because no audit was triggered
- Forward it directly to the Department of Justice
Correct answer: Consider it a mitigating factor and investigate promptly to determine the correct amount owed
Voluntary self-disclosure is treated as a mitigating factor under FAR and should prompt a prompt agency review to resolve the overpayment accurately.
Question 4: In risk-based auditing, how does the IG determine where to focus audit resources?
- By rotating through all programs on a fixed schedule regardless of risk
- By targeting programs with the highest inherent risk and weakest controls (Correct answer)
- By prioritizing programs with the largest budgets
- By deferring to agency management's suggested audit topics
Correct answer: By targeting programs with the highest inherent risk and weakest controls
Risk-based auditing directs resources toward areas where the combination of high inherent risk and inadequate controls creates the greatest potential for harm or loss.
Question 5: Which compliance risk is MOST directly associated with rapidly changing regulations in a heavily regulated program area?
- Corruption risk
- Regulatory change risk (Correct answer)
- Reputational risk
- Operational risk
Correct answer: Regulatory change risk
Regulatory change risk arises when the pace of rule changes outstrips an organization's ability to update policies, training, and controls to stay compliant.
Question 6: An IG recommends that an agency 'implement compensating controls.' What does this mean?
- Pay employees overtime to manually review all transactions
- Establish alternative controls that reduce risk when the primary control cannot be implemented (Correct answer)
- Transfer risk through an insurance policy
- Hire additional auditors to expand the monitoring function
Correct answer: Establish alternative controls that reduce risk when the primary control cannot be implemented
Compensating controls are substitute measures deployed when an ideal primary control is not feasible, providing an alternative means to achieve the same control objective.
Question 7: What is the primary purpose of a 'whistleblower reprisal' investigation conducted by an IG?
- To determine whether the whistleblower's allegations are factually correct
- To determine whether an employee suffered adverse action because of a protected disclosure (Correct answer)
- To discipline the whistleblower for bypassing the chain of command
- To assess the financial impact of the disclosed wrongdoing
Correct answer: To determine whether an employee suffered adverse action because of a protected disclosure
A reprisal investigation focuses on whether protected whistleblower activity caused management to take a prohibited personnel action, independent of whether the underlying allegation was substantiated.
CIG Risk Management & Compliance 5
When an IG identifies a 'significant deficiency' in internal controls, how does it differ from a 'material weakness'?