OCPS Risk Assessment & Mitigation 2 — Questions and Answers
Question 1: Which control type is BEST suited to prevent unauthorized payroll file modifications before they occur?
- Detective control
- Preventive control (Correct answer)
- Corrective control
- Compensating control
Correct answer: Preventive control
Preventive controls are designed to stop unauthorized actions from occurring in the first place, unlike detective controls which identify issues after the fact.
Question 2: A payroll manager discovers that a terminated employee received two paychecks after their separation date. Which risk category does this PRIMARILY represent?
- Strategic risk
- Operational risk (Correct answer)
- Reputational risk
- Compliance risk
Correct answer: Operational risk
Payments to terminated employees result from failures in internal processes or controls, which classifies them as operational risk.
Question 3: What is the purpose of a payroll reconciliation control?
- To reduce the time it takes to process payroll
- To detect discrepancies between payroll records and bank disbursements (Correct answer)
- To automate payroll tax calculations
- To ensure employees receive direct deposit
Correct answer: To detect discrepancies between payroll records and bank disbursements
Payroll reconciliation compares processed payroll totals against actual bank disbursements to identify errors or unauthorized payments.
Question 4: Under SOX compliance, which payroll risk is addressed by requiring dual authorization for payroll disbursements?
- Tax underpayment risk
- Fraudulent disbursement risk (Correct answer)
- Benefits calculation error risk
- Regulatory reporting risk
Correct answer: Fraudulent disbursement risk
Dual authorization (segregation of duties) directly mitigates fraudulent disbursement risk by requiring two approvers before funds are released.
Question 5: A company processes payroll for employees in 12 states. Which risk escalation factor is MOST relevant to this scenario?
- Currency exchange risk
- Multi-jurisdictional tax compliance risk (Correct answer)
- Workers' compensation fraud risk
- Direct deposit reversal risk
Correct answer: Multi-jurisdictional tax compliance risk
Operating across multiple states multiplies tax withholding, unemployment insurance, and reporting obligations, significantly increasing multi-jurisdictional compliance risk.
Question 6: Which metric is MOST useful for measuring the effectiveness of a payroll error-correction process?
- Average payroll processing time
- Mean time to resolve payroll discrepancies (Correct answer)
- Number of employees on direct deposit
- Total payroll disbursement amount
Correct answer: Mean time to resolve payroll discrepancies
Mean time to resolve discrepancies directly measures how efficiently the correction process works after errors are detected.
Question 7: When assessing payroll vendor risk, which factor carries the GREATEST weight in a risk scoring model?
- Vendor's office location
- Vendor's data breach history and security certifications (Correct answer)
- Number of years the vendor has been in business
- Vendor's pricing structure
Correct answer: Vendor's data breach history and security certifications
Past security incidents and current certifications (like SOC 2 Type II) are the strongest indicators of a vendor's ability to protect sensitive payroll data.
OCPS Risk Assessment & Mitigation 2
Which control type is BEST suited to prevent unauthorized payroll file modifications before they occur?