Risk Mitigation and Controls Flashcards
7 cards from real CRA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Mitigation and Controls flashcards as text
A company implements dual authorization for all transactions above $50,000. This control is best classified as which type?
Answer: Preventive control
Dual authorization prevents unauthorized transactions from occurring by requiring two approvals before execution, making it a preventive control.
Which risk treatment option involves purchasing insurance against potential losses?
Answer: Risk transfer
Insurance transfers the financial consequence of a risk to a third party (the insurer), making it a classic risk transfer mechanism.
An organization discovers its residual risk exceeds its risk appetite after implementing controls. What should happen next?
Answer: Implement additional or stronger controls
When residual risk exceeds risk appetite, additional or enhanced controls must be implemented to bring the risk within acceptable thresholds.
The COSO framework's control activities component includes which of the following?
Answer: Physical controls and IT general controls
COSO's control activities encompass both physical controls (locks, access badges) and IT general controls (access management, change control) that help ensure risk responses are carried out.
A risk architect recommends segregation of duties (SoD) for a financial process. What risk does SoD primarily mitigate?
Answer: Fraud and error through collusion or mistake
Segregation of duties mitigates fraud and error by ensuring no single individual controls all aspects of a critical transaction.
Which metric best measures the effectiveness of a risk control over time?
Answer: Key Risk Indicator (KRI) trend analysis
KRI trend analysis tracks whether control performance is improving, stable, or deteriorating, making it the best measure of control effectiveness over time.
A compensating control is most appropriate when:
Answer: A primary control cannot be implemented due to technical or business constraints
Compensating controls are substitutes used when the ideal primary control cannot be implemented due to technical limitations, cost, or operational constraints.