Risk Assessment & Management Flashcards
7 cards from real Certified Internal Auditor practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Management flashcards as text
Which of the following is the MOST important factor in determining audit universe prioritization during risk-based audit planning?
Answer: Results of the organization's risk assessment
Risk-based audit planning aligns audit resources with areas of highest risk as identified through the organization's risk assessment process.
A company's board of directors has set a risk appetite of 'moderate.' A business unit is operating with a residual risk level assessed as 'high.' This situation is called:
Answer: Risk tolerance breach
When residual risk exceeds the stated risk appetite, the organization is experiencing a risk tolerance breach that requires escalation and corrective action.
Which risk assessment approach involves assigning numerical probabilities and financial values to risk scenarios?
Answer: Quantitative risk assessment
Quantitative risk assessment uses mathematical models, probabilities, and monetary values to express risk exposure numerically.
An internal auditor notices that management's risk register has not been updated for 18 months. This finding most directly indicates a weakness in:
Answer: Risk monitoring and review
A stale risk register signals that the organization's risk monitoring and review processes are not functioning effectively.
Concentration risk in financial institutions refers to:
Answer: Excessive exposure to a single borrower, sector, or geography
Concentration risk arises when a portfolio is heavily exposed to a single counterparty, industry, or region, amplifying potential losses.
When performing a root cause analysis as part of risk assessment, the '5 Whys' technique is designed to:
Answer: Trace a problem back to its fundamental underlying cause
The 5 Whys technique repeatedly asks 'why' to peel back symptoms and identify the true root cause of a problem or risk event.
Which of the following scenarios best represents an 'emerging risk'?
Answer: Cybersecurity exposure from a newly adopted cloud platform
Emerging risks arise from new technologies, markets, or environmental changes that have not yet been fully assessed or addressed by the organization.