Risk Management & Mitigation Flashcards
7 cards from real CB practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Mitigation flashcards as text
A company discovers that a single employee can both approve purchase orders and issue checks. Which type of internal control weakness does this represent?
Answer: Inadequate segregation of duties
When one person can both approve transactions and handle related assets, it eliminates the checks-and-balances that segregation of duties provides.
Which risk mitigation strategy involves purchasing insurance to cover potential losses from a specific business risk?
Answer: Risk transfer
Risk transfer shifts the financial consequences of a loss to a third party, such as an insurance company, rather than bearing the risk internally.
A bookkeeper notices that bank reconciliations have not been performed for three months. Which risk does this create?
Answer: Undetected errors and fraud
Timely bank reconciliations are a key detective control that catches discrepancies between bank records and company books, including fraudulent transactions.
Under the COSO framework, which component focuses on the company's overall attitude and awareness toward risk?
Answer: Control Environment
The Control Environment is the foundation of all internal controls and reflects management's tone, ethical values, and commitment to integrity.
A company requires two signatures on checks exceeding $10,000. This is an example of which type of control?
Answer: Preventive control
Dual-signature requirements prevent unauthorized disbursements before they occur, making this a preventive control.
Which document formally identifies, assesses, and prioritizes risks within an organization?
Answer: Risk register
A risk register is a tool used to document identified risks, their likelihood, potential impact, and planned responses.
A bookkeeper learns that the company's key financial data is stored only on local hard drives with no backups. Which risk category does this primarily represent?
Answer: Operational risk
Operational risk arises from failures in internal processes, people, systems, or external events — including data loss from inadequate backup procedures.