Certified Internal Auditor Risk Assessment & Management 4 — Questions and Answers
Question 1: Which of the following is the MOST important factor in determining audit universe prioritization during risk-based audit planning?
- Availability of audit staff
- Results of the organization's risk assessment (Correct answer)
- Requests from senior management
- Prior year audit findings
Correct answer: Results of the organization's risk assessment
Risk-based audit planning aligns audit resources with areas of highest risk as identified through the organization's risk assessment process.
Question 2: A company's board of directors has set a risk appetite of 'moderate.' A business unit is operating with a residual risk level assessed as 'high.' This situation is called:
- Risk avoidance
- Risk acceptance
- Risk tolerance breach (Correct answer)
- Inherent risk alignment
Correct answer: Risk tolerance breach
When residual risk exceeds the stated risk appetite, the organization is experiencing a risk tolerance breach that requires escalation and corrective action.
Question 3: Which risk assessment approach involves assigning numerical probabilities and financial values to risk scenarios?
- Qualitative risk assessment
- Quantitative risk assessment (Correct answer)
- Semi-quantitative risk assessment
- Descriptive risk mapping
Correct answer: Quantitative risk assessment
Quantitative risk assessment uses mathematical models, probabilities, and monetary values to express risk exposure numerically.
Question 4: An internal auditor notices that management's risk register has not been updated for 18 months. This finding most directly indicates a weakness in:
- Risk identification
- Risk monitoring and review (Correct answer)
- Control design
- Risk appetite setting
Correct answer: Risk monitoring and review
A stale risk register signals that the organization's risk monitoring and review processes are not functioning effectively.
Question 5: Concentration risk in financial institutions refers to:
- Over-reliance on a single risk assessment methodology
- Excessive exposure to a single borrower, sector, or geography (Correct answer)
- The tendency of auditors to focus on the same areas each year
- Clustering of similar controls to address one risk
Correct answer: Excessive exposure to a single borrower, sector, or geography
Concentration risk arises when a portfolio is heavily exposed to a single counterparty, industry, or region, amplifying potential losses.
Question 6: When performing a root cause analysis as part of risk assessment, the '5 Whys' technique is designed to:
- Quantify the financial impact of a risk event
- Trace a problem back to its fundamental underlying cause (Correct answer)
- Rank risks by likelihood and severity
- Identify who is responsible for a control failure
Correct answer: Trace a problem back to its fundamental underlying cause
The 5 Whys technique repeatedly asks 'why' to peel back symptoms and identify the true root cause of a problem or risk event.
Question 7: Which of the following scenarios best represents an 'emerging risk'?
- Fraud risk in accounts payable identified in a prior audit
- Cybersecurity exposure from a newly adopted cloud platform (Correct answer)
- Regulatory risk from a law in effect for five years
- Inventory shrinkage trending at the historical average
Correct answer: Cybersecurity exposure from a newly adopted cloud platform
Emerging risks arise from new technologies, markets, or environmental changes that have not yet been fully assessed or addressed by the organization.
Certified Internal Auditor Risk Assessment & Management 4
Which of the following is the MOST important factor in determining audit universe prioritization during risk-based audit planning?