QFC Internal Controls & Risk Assessment 2 — Questions and Answers
Question 1: Which of the following best describes a 'control deficiency' under PCAOB standards?
- A control that prevents all errors from occurring
- A design or operating shortfall that prevents timely detection or prevention of misstatements (Correct answer)
- A control that has been tested and found effective
- A compensating control that offsets another weak control
Correct answer: A design or operating shortfall that prevents timely detection or prevention of misstatements
A control deficiency exists when the design or operation of a control does not allow management or employees to detect or prevent misstatements on a timely basis.
Question 2: In a quantitative risk assessment, which metric measures the average loss expected from a risk event over a given time horizon?
- Value at Risk (VaR)
- Expected Loss (EL) (Correct answer)
- Conditional VaR (CVaR)
- Loss Given Default (LGD)
Correct answer: Expected Loss (EL)
Expected Loss (EL) is calculated as the product of Probability of Default, Loss Given Default, and Exposure at Default, representing the mean anticipated loss.
Question 3: A firm discovers that its reconciliation controls for derivatives positions are performed monthly rather than daily. This is best classified as a:
- Material weakness
- Significant deficiency (Correct answer)
- Control gap
- Timing control deficiency
Correct answer: Significant deficiency
Because it is less than a material weakness but more than an immaterial deficiency, and warrants attention by those charged with governance, it qualifies as a significant deficiency.
Question 4: The Three Lines of Defense model assigns internal audit to which line?
- First line
- Second line
- Third line (Correct answer)
- Fourth line
Correct answer: Third line
Internal audit constitutes the third line, providing independent assurance over the effectiveness of risk management and controls operated by the first and second lines.
Question 5: Which stress testing approach applies predefined adverse macroeconomic scenarios to a portfolio to estimate potential losses?
- Historical simulation
- Scenario analysis (Correct answer)
- Monte Carlo simulation
- Sensitivity analysis
Correct answer: Scenario analysis
Scenario analysis uses hypothetical or historical adverse scenarios (e.g., a severe recession) to evaluate portfolio losses under specified conditions.
Question 6: Under COSO ERM 2017, which component explicitly addresses the alignment of risk appetite with strategy?
- Control Activities
- Risk Identification
- Strategy & Objective-Setting (Correct answer)
- Performance
Correct answer: Strategy & Objective-Setting
The Strategy & Objective-Setting component of COSO ERM 2017 requires that risk appetite be considered when setting strategy and business objectives.
Question 7: When a model risk control framework requires periodic model validation, what is the primary purpose of challenger models?
- To replace the champion model immediately upon development
- To provide an alternative benchmark that tests the champion model's assumptions (Correct answer)
- To estimate regulatory capital for stress testing
- To automate the backtesting process
Correct answer: To provide an alternative benchmark that tests the champion model's assumptions
Challenger models serve as independent benchmarks that allow validators to assess whether the champion model's assumptions and outputs are reasonable by comparison.
QFC Internal Controls & Risk Assessment 2
Which of the following best describes a 'control deficiency' under PCAOB standards?