Risk Assessment & Internal Controls Flashcards

A compliance officer is asked to evaluate a new product line that may involve BSA/AML obligations not currently covered by existing controls. What is the FIRST step in this process?

Answer: Conduct a risk assessment specific to the new product's BSA/AML exposure

Before designing or updating controls, a targeted risk assessment must identify the specific BSA/AML risks introduced by the new product line.

Which control activity is specifically designed to verify that transactions are accurately captured and completely processed without loss or duplication?

Answer: Reconciliation controls

Reconciliation controls compare two independent sources of data to confirm that all transactions are recorded completely and accurately.

An organization rates a compliance risk as 'accepted' despite it exceeding its stated risk tolerance. Which governance failure does this indicate?

Answer: Misalignment between risk appetite policy and actual risk decisions

Accepting a risk that exceeds stated tolerance without formal exception approval indicates a breakdown between the organization's documented policy and actual management behavior.

Which scenario BEST illustrates an inherent risk that has been partially mitigated to produce a residual risk?

Answer: A bank identifies high fraud potential in wire transfers and installs transaction limits, reducing but not eliminating exposure

Installing transaction limits reduces the inherent fraud risk in wire transfers but does not eliminate it, leaving a residual risk the bank must still manage.

A compliance testing program reveals that 15% of loan files are missing required disclosures. Which type of risk does this finding primarily represent?

Answer: Operational and compliance risk

Missing required disclosures in loan files represent a failure in operational processes and create direct compliance risk under consumer protection regulations.

A company conducts a control self-assessment (CSA). Which statement BEST describes the primary purpose of this exercise?

Answer: To enable business units to evaluate the design and effectiveness of their own controls

CSAs empower process owners to assess whether their controls are properly designed and operating effectively, fostering accountability at the operational level.

Which element distinguishes a material weakness from a significant deficiency in the context of internal control over financial reporting?

Answer: A material weakness creates reasonable possibility of material misstatement; a significant deficiency is less severe

A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected, making it more severe than a significant deficiency.