Internal Controls & Risk Management Flashcards
7 cards from real CAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Internal Controls & Risk Management flashcards as text
How is a 'significant deficiency' in internal controls distinguished from a 'material weakness'?
Answer: A significant deficiency is less severe than a material weakness but still warrants attention from those charged with governance
A significant deficiency is a control deficiency that is less severe than a material weakness but important enough to merit the attention of those responsible for financial oversight.
What is residual risk in risk management?
Answer: The risk that remains after all controls and mitigation strategies have been applied
Residual risk is the level of risk that remains after management has implemented controls and other risk responses to reduce the inherent risk.
What does the concept of 'tone at the top' refer to in internal control?
Answer: Management's ethical values, integrity, and commitment to internal controls that set the organizational culture
'Tone at the top' refers to the ethical environment established by senior leadership and the board, which strongly influences the behavior and culture of the entire organization.
Which type of risk primarily involves the potential for employees or external parties to steal or misappropriate company assets?
Answer: Fraud risk
Fraud risk encompasses the potential for theft, misappropriation of assets, and intentional misstatement of financial information by employees or external parties.
What is the purpose of a corrective control in an internal control system?
Answer: To fix errors or irregularities after they have been detected
Corrective controls are designed to remediate or fix problems that have been identified by detective controls, restoring the system to its intended state.
What is the primary function of a whistleblower policy in an organization's internal control environment?
Answer: To encourage reporting of suspected fraud or misconduct without fear of retaliation
Whistleblower policies create a safe channel for employees to report suspected fraud, ethical violations, or internal control weaknesses without fear of retaliation, strengthening the control environment.
What does an organization's 'risk appetite' refer to?
Answer: The maximum level of risk the organization is willing to accept in pursuit of its objectives
Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its strategic objectives, guiding risk-taking decisions across the enterprise.