Risk Management and Internal Controls Flashcards
7 cards from real RCC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management and Internal Controls flashcards as text
Which risk management concept requires that controls be proportionate to the significance of the risks they address?
Answer: Risk-based approach
A risk-based approach allocates control resources and rigor in proportion to the magnitude of the risks identified, avoiding both over-control of low risks and under-control of high risks.
An internal auditor discovers that employees have been bypassing a required approval step because it slows their workflow. This is an example of:
Answer: Control override
Control override occurs when individuals circumvent established controls, undermining their effectiveness regardless of how well the control was designed.
The 'tone at the top' principle in compliance primarily refers to:
Answer: The commitment of senior leadership to ethical conduct and compliance
Tone at the top reflects the attitudes and behaviors of senior leadership, which set the ethical culture and compliance standards that employees throughout the organization tend to follow.
A company conducts a Business Impact Analysis (BIA). What is the primary output of this exercise?
Answer: The identification of critical processes and the maximum tolerable downtime for each
A BIA identifies which business processes are critical to operations and determines how long each can be interrupted before causing unacceptable harm, supporting continuity planning.
Which of the following best describes 'inherent risk' in the context of internal controls?
Answer: The level of risk existing before any controls are applied
Inherent risk is the exposure to risk in the absence of any actions management takes to alter its likelihood or impact.
A corrective control is best illustrated by which of the following examples?
Answer: Restoring data from backup after a system failure
Restoring from backup corrects the damage caused by a failure event, making it a corrective control designed to fix problems after they occur.
Which scenario demonstrates an effective use of a compensating control?
Answer: A small firm cannot segregate duties due to headcount, so the owner reviews all bank reconciliations personally
When ideal controls like segregation of duties are impractical, compensating controls—such as owner review—mitigate the same risks through alternative means.