ACCA Risk Management and Internal Controls 1 — Questions and Answers
Question 1: Which of the following best describes 'inherent risk' in an organizational context?
- The risk remaining after management controls are applied
- The raw or untreated risk before any controls (Correct answer)
- The risk that internal controls will fail
- The risk of material misstatement due to fraud
Correct answer: The raw or untreated risk before any controls
Inherent risk is the level of risk in the absence of any actions management might take to alter either the risk's likelihood or impact.
Question 2: In enterprise risk management (ERM), what is a 'risk appetite'?
- The maximum loss the company can absorb before insolvency
- The amount of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
- The residual risk after all controls are applied
- The probability of a risk event occurring
Correct answer: The amount of risk an organization is willing to accept in pursuit of its objectives
Risk appetite is the broad-based amount of risk an organization is prepared to accept in pursuit of value, acting as a guide for risk-taking decisions.
Question 3: Which framework is most widely referenced for internal control and risk management, comprising five components including the control environment and monitoring?
- COSO ERM Framework (Correct answer)
- ISO 31000
- Basel III
- Sarbanes-Oxley Act
Correct answer: COSO ERM Framework
The COSO Internal Control – Integrated Framework (and its ERM extension) is the most widely used framework, featuring five components: control environment, risk assessment, control activities, information & communication, and monitoring.
Question 4: Which of the following is an example of a detective control?
- Segregation of duties
- Physical locks on server rooms
- Bank reconciliation reviews (Correct answer)
- Requiring dual authorization for payments
Correct answer: Bank reconciliation reviews
Bank reconciliations are detective controls because they identify errors or discrepancies after a transaction has already occurred.
Question 5: A company's board is considering using derivatives to hedge foreign currency exposure. This risk response is best classified as:
- Risk avoidance
- Risk acceptance
- Risk transfer (Correct answer)
- Risk reduction
Correct answer: Risk transfer
Using derivatives to hedge transfers the financial risk of adverse currency movements to the counterparty (e.g., bank), making it a risk transfer strategy.
Question 6: Which of the following statements about the 'three lines of defense' model is correct?
- External auditors form the first line of defense
- Management controls and internal controls form the first line (Correct answer)
- Risk management and compliance functions form the first line
- The board forms the second line of defense
Correct answer: Management controls and internal controls form the first line
In the three lines of defense model, the first line is operational management (owns and manages risk), the second is risk and compliance functions (oversight), and the third is internal audit (independent assurance).
ACCA Risk Management and Internal Controls 1
Which of the following best describes 'inherent risk' in an organizational context?