CRMA - Certification in Risk Management Assurance Internal Audit's Assurance Role Questions and Answers

Question 1

According to IIA Standards, which of the following is the most fundamental role of the internal audit activity in providing risk management assurance?

Accepted Answer

Providing independent and objective assurance on the effectiveness of risk management processes.

Answer

The core assurance role of internal audit regarding ERM is to provide independent and objective assurance to the board and management on the effectiveness of the organization's risk management processes. [1, 3, 4] Developing the framework, assuming management responsibilities, and setting the risk appetite are management's roles; internal audit's involvement in these areas would impair their independence and objectivity. [5]

Question 2

A Chief Audit Executive (CAE) is planning the annual audit plan. Management has requested that the internal audit team design and implement a new control system for a recently identified high-risk area. How should the CAE respond to this request to maintain the integrity of internal audit's assurance role?

Accepted Answer

Decline the engagement, explaining that designing and implementing controls would impair internal audit's independence for future audits of that area.

Answer

Internal auditors should not design, implement, or take responsibility for controls, as this is a management function. [2] Doing so would create a self-review threat and impair the internal audit activity's independence and objectivity when later providing assurance on those same controls. The appropriate response is to decline the implementation role but offer to provide advice or assess the implemented controls afterward. [4]

Question 3

When providing assurance on the effectiveness of risk management processes, an internal auditor's assessment should primarily focus on determining that:

Accepted Answer

Significant risks are identified and assessed, and risk responses align with the organization's risk appetite.

Answer

IIA Standard 2120 states that determining whether risk management processes are effective is a judgment based on the assessment that significant risks are identified and assessed, and appropriate risk responses are selected that align risks with the organization's risk appetite. [7, 8] It is not about eliminating all risks or having the most advanced or cheapest controls.

Question 4

Which of the following activities falls squarely within internal audit's assurance role, as opposed to a consulting role?

Accepted Answer

Providing an independent assessment on the design and operating effectiveness of the risk management framework.

Answer

Assurance services involve an objective examination of evidence to provide an independent assessment. [10, 17] Evaluating the risk management framework is a classic assurance activity. [4] Facilitating workshops, championing ERM adoption, and advising on control design are considered consulting services, where internal audit provides advice and insight without assuming management responsibility. [4, 10]

Question 5

An organization's internal audit activity is evaluating the risk management process. Which of the following would provide the best evidence that the process is effective and mature?

Accepted Answer

Risk information is actively used to inform strategic and operational decision-making across the organization.

Answer

A mature and effective risk management process is one that is integrated into the organization's key activities, enabling risk-based decision-making and strategy-setting. [8, 19] The mere existence of a risk department or a risk list is not sufficient. Having internal audit take responsibility for risk assessment is inappropriate and impairs independence. The key is how risk information is used to guide the business.

(CRMA) Certification in Risk Management Assurance Practice Test

(CRMA) Certification in Risk Management Assurance Practice Test

CRMA - Certification in Risk Management Assurance Internal Audit's Assurance Role Questions and Answers