CRMA Internal Audit's Assurance Role 3

Question 1

Which COSO ERM component is MOST directly evaluated when internal audit assesses whether the organization has correctly identified its key risks?

Accepted Answer

Event Identification

Answer

Event Identification within COSO ERM addresses the process of recognizing potential events that could affect the achievement of objectives, which aligns directly with risk identification assessment.

Question 2

An organization's risk appetite statement is vague and unmeasurable. Internal audit's BEST course of action is to:

Accepted Answer

Report it as a significant deficiency and recommend management develop measurable thresholds

Answer

A vague risk appetite statement is a control deficiency that should be reported with a recommendation for management to develop measurable criteria; internal audit should not own that task.

Question 3

When communicating ERM assurance results to the board, internal audit should PRIMARILY:

Accepted Answer

Provide an overall opinion on the adequacy and effectiveness of ERM processes

Answer

Board-level communication should convey a synthesized opinion on ERM effectiveness rather than granular transaction-level findings.

Question 4

Internal audit discovers that a critical risk has been accepted by management at a level exceeding board-approved risk appetite. The CORRECT action is to:

Accepted Answer

Escalate to the board or audit committee because this exceeds delegated authority

Answer

When risk acceptance exceeds board-approved appetite, the matter must be escalated to the board because management lacks authority to approve exceptions above that level.

Question 5

How does internal audit's assurance role differ from the risk management function's role?

Accepted Answer

Internal audit independently evaluates risk management; the risk management function operates and maintains ERM processes

Answer

The risk management function (second line) operates and maintains ERM processes, while internal audit (third line) independently evaluates whether those processes are adequate and effective.

(CRMA) Certification in Risk Management Assurance Practice Test

(CRMA) Certification in Risk Management Assurance Practice Test

CRMA Internal Audit's Assurance Role 3