Risk Management & Internal Controls Flashcards
7 cards from real CCCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Internal Controls flashcards as text
When conducting a risk assessment, 'velocity' refers to:
Answer: The speed at which a risk can impact the organization once triggered
Risk velocity measures how quickly a risk event will affect the organization after it occurs, which influences the urgency of the required response.
A compliance program conducts periodic testing of controls to verify they are operating as designed. This activity is best described as:
Answer: Control operating effectiveness testing
Control operating effectiveness testing evaluates whether controls are actually functioning as intended in practice, not just whether they are well-designed on paper.
Which COSO internal control component addresses the policies and procedures that help ensure management directives are carried out?
Answer: Control activities
Control activities are the specific policies and procedures that operationalize management's risk responses and ensure its directives are executed throughout the organization.
A company implements job rotation for employees in sensitive financial roles. The PRIMARY compliance benefit of this practice is:
Answer: Detecting or deterring fraud by limiting prolonged control of one area
Mandatory job rotation reduces the opportunity for fraud by preventing any single employee from maintaining long-term, unchecked control over a sensitive function.
Which term describes the process of ranking risks by their significance to prioritize compliance resources?
Answer: Risk prioritization
Risk prioritization is the process of ranking identified risks by their relative significance (likelihood × impact) to focus limited compliance resources on the most critical areas.
An organization's compliance function identifies a new regulatory requirement with a 90-day implementation deadline. Which risk response is MOST appropriate?
Answer: Risk reduction
Risk reduction involves taking action to lower the likelihood or impact of a risk, and implementing controls to meet the new regulatory requirement is a textbook risk reduction response.
A material weakness in internal controls is BEST defined as:
Answer: A deficiency or combination of deficiencies that could result in a material misstatement not being prevented or detected
A material weakness is a severe internal control deficiency where there is a reasonable possibility that a material misstatement of financial statements would not be prevented or timely detected.