CRA Risk Mitigation and Controls 2

Question 1

A company implements dual authorization for all transactions above $50,000. This control is best classified as which type?

Accepted Answer

Preventive control

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 2

Which risk treatment option involves purchasing insurance against potential losses?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk reduction

Answer

Risk acceptance

Question 3

An organization discovers its residual risk exceeds its risk appetite after implementing controls. What should happen next?

Accepted Answer

Implement additional or stronger controls

Answer

Accept the residual risk unconditionally

Answer

Remove existing controls and start over

Answer

Transfer all risk to a third party immediately

Question 4

The COSO framework's control activities component includes which of the following?

Accepted Answer

Physical controls and IT general controls

Answer

Risk appetite statements

Answer

Entity-level objectives

Answer

Stakeholder communication plans

Question 5

A risk architect recommends segregation of duties (SoD) for a financial process. What risk does SoD primarily mitigate?

Accepted Answer

Fraud and error through collusion or mistake

Answer

Market risk from price fluctuations

Answer

Reputational risk from public disclosure

Answer

Liquidity risk from cash shortfalls

Question 6

Which metric best measures the effectiveness of a risk control over time?

Accepted Answer

Key Risk Indicator (KRI) trend analysis

Answer

Gross risk rating before controls

Answer

Number of controls documented

Answer

Inherent risk score

Question 7

A compensating control is most appropriate when:

Accepted Answer

A primary control cannot be implemented due to technical or business constraints

Answer

The primary control is too expensive to implement

Answer

The organization wants to eliminate all residual risk

Answer

Residual risk is below the risk appetite threshold