Risk Management & Internal Controls Flashcards
7 cards from real CCT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Internal Controls flashcards as text
Which risk assessment technique assigns numerical probabilities and financial values to potential losses to calculate an expected monetary outcome?
Answer: Quantitative risk analysis
Quantitative risk analysis uses numerical data—likelihood percentages and monetary impact—to compute expected loss values such as Annual Loss Expectancy (ALE).
A 'three lines of defense' model assigns the primary ownership of risk management to which line?
Answer: Business unit management
The first line of defense consists of business unit management, who own and manage risks in day-to-day operations.
When a company purchases cyber liability insurance to handle the financial impact of a data breach, it is employing which risk response strategy?
Answer: Risk transfer
Risk transfer shifts the financial consequence of a risk to a third party, such as an insurer, without eliminating the underlying risk.
Which internal control activity involves comparing financial data against prior periods or industry benchmarks to detect anomalies?
Answer: Analytical procedures
Analytical procedures use comparisons and ratio analyses to identify unexpected variances that may indicate errors or fraud.
A company identifies that a risk's likelihood is low but its potential impact is catastrophic. How should this risk typically be prioritized?
Answer: Escalated and monitored closely due to high impact
High-impact risks require attention regardless of low probability because the potential harm to the organization can be severe or irreversible.
What does 'inherent risk' refer to in the context of compliance risk management?
Answer: The gross risk before any controls are in place
Inherent risk is the raw level of risk exposure that exists before any mitigating controls or risk responses are implemented.
Which of the following is an example of a detective control?
Answer: Monthly bank reconciliations to identify discrepancies
Detective controls identify errors or irregularities after they have occurred; bank reconciliations catch discrepancies post-transaction.