CORES Process Mapping & Control Assessment 4 — Questions and Answers
Question 1: In a process risk assessment, 'inherent complexity' of a process step is considered because higher complexity typically:
- Reduces the cost of control implementation
- Increases the likelihood of human error and the need for stronger controls (Correct answer)
- Automatically triggers regulatory reporting requirements
- Decreases the frequency of control testing needed
Correct answer: Increases the likelihood of human error and the need for stronger controls
Complex process steps have more decision points and dependencies, increasing error probability and requiring correspondingly robust controls.
Question 2: Which process mapping symbol conventionally represents a decision point where alternative process paths diverge?
- Rectangle
- Diamond (Correct answer)
- Oval
- Parallelogram
Correct answer: Diamond
The diamond shape in standard flowcharting conventions denotes a decision point with branching outcomes (yes/no or alternative conditions).
Question 3: A firm maps its loan origination process and finds that the same employee approves and books a loan. This represents which fundamental control weakness?
- Inadequate audit trail documentation
- Lack of segregation of duties (SoD) (Correct answer)
- Insufficient management override authority
- Absence of a whistleblower reporting mechanism
Correct answer: Lack of segregation of duties (SoD)
Having one person perform both the approval and booking functions eliminates the check inherent in segregation of duties, enabling undetected fraud or errors.
Question 4: When assessing control sustainability, which factor is MOST important to evaluate for manual controls?
- The date the control was first implemented
- Staff turnover in roles responsible for control execution (Correct answer)
- The number of systems the control interfaces with
- The regulatory framework that mandated the control
Correct answer: Staff turnover in roles responsible for control execution
High staff turnover in control-owner roles directly threatens control sustainability because knowledge and execution quality degrade with frequent personnel changes.
Question 5: A 'bottleneck' identified in a process map creates operational risk primarily because it:
- Requires board-level approval for each transaction processed
- Concentrates throughput through a single constrained resource, creating delay and failure risk (Correct answer)
- Triggers automatic regulatory reporting when volumes exceed thresholds
- Reduces the number of controls needed in the process
Correct answer: Concentrates throughput through a single constrained resource, creating delay and failure risk
Bottlenecks create single-point concentration risk where backlog, errors, and processing failures accumulate under volume or stress conditions.
Question 6: In control testing, 'attribute sampling' is used to assess:
- The monetary value of errors found in financial transactions
- Whether controls were performed or not performed (pass/fail) across a sample (Correct answer)
- The correlation between control frequency and loss event frequency
- The statistical confidence interval for residual risk estimates
Correct answer: Whether controls were performed or not performed (pass/fail) across a sample
Attribute sampling tests whether a control attribute (performed/not performed, compliant/non-compliant) exists in each sample item, yielding a deviation rate.
Question 7: When a process map is used to prioritize control investment, which process attribute should receive the HIGHEST weighting?
- Steps with the longest average processing time
- Steps with the highest combination of likelihood and impact of failure (Correct answer)
- Steps most frequently audited in prior assessment cycles
- Steps performed exclusively by senior management personnel
Correct answer: Steps with the highest combination of likelihood and impact of failure
Risk-based prioritization directs resources to steps where both the probability of failure and the resulting impact are greatest, maximizing risk reduction per dollar invested.
CORES Process Mapping & Control Assessment 4
In a process risk assessment, 'inherent complexity' of a process step is considered because higher complexity typically: