Audit Procedures & Risk Mitigation Flashcards

An energy trading firm's audit shows that traders set their own position limits. This violates which fundamental risk control principle?

Answer: Segregation of duties

Segregation of duties requires that risk limit-setting be independent of trading functions; allowing traders to set their own limits eliminates a critical check on risk-taking behavior.

Which method is used to validate that a VaR model accurately predicts losses over time?

Answer: Backtesting

Backtesting compares a model's predicted VaR against actual observed losses to assess whether the model's predictions are accurate and statistically sound.

During an audit of an electricity retailer, the auditor finds the company has no liquidity reserve policy. Why is this a critical gap in risk mitigation?

Answer: Margin calls and collateral demands during price spikes can quickly create a cash crisis without reserves

Without a liquidity reserve, unexpected margin calls triggered by sharp price movements can force distressed asset sales or default, making liquidity risk management essential.

A midstream company transports gas for multiple shippers. What type of risk does the auditor focus on when evaluating exposure to shipper non-payment?

Answer: Counterparty credit risk

Counterparty credit risk is the exposure to financial loss if a shipper fails to fulfill their payment obligations under the transportation agreement.

Which control best mitigates the risk of erroneous trade data entry in an energy trading system?

Answer: Automated straight-through processing with pre-defined validation rules

Automated straight-through processing (STP) with validation rules catches data entry errors at the point of input before they propagate through downstream risk and accounting systems.

An energy auditor reviewing a refinery's environmental risk program finds that spill response procedures have not been updated since a major regulatory change. This represents a failure in:

Answer: Regulatory change management and control update processes

Regulatory change management requires that internal procedures be reviewed and updated when relevant regulations change to maintain compliance and operational effectiveness.

When assessing an energy company's enterprise risk management (ERM) framework, what is the auditor primarily evaluating?

Answer: The integration of risk identification, assessment, response, and monitoring across all business units

ERM framework evaluation focuses on how comprehensively and effectively the organization identifies, measures, responds to, and monitors risks across the entire enterprise.