4-Risk Management

Question 1

Define risk management.

Answer 1

Risk management is a process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives.

Question 2

List the five processes of risk management.

Answer 2

Identification of context
Risk identification
Risk assessment and prioritization (i.e., risk analysis)
Risk response
Risk monitoring

Question 3

What are the three levels at which risk identification should be performed?

Answer 3

Entity level
Division level
Business level

Question 4

Give examples of methods used for risk identification.

Answer 4

Event inventories
Questionnaires and surveys
Leading event indicators and escalation triggers
Facilitated workshops and interviews
Process flow analysis
Loss event data methodologies
Brainstorming
SWOT analysis
Scenario analysis

Question 5

List the three risk assessment processes.

Answer 5

Assessing the significance of an event
Assessing the event’s likelihood
Considering the means of managing the risk

Question 6

Give examples of qualitative and quantitative risk assessment methods.

Answer 6

Qualitative Quantitative
Risk listing Probabilistic models
Risk ranking
Risk map (e.g., heat map, risk matrix)

Question 7

List the four risk monitoring processes.

Answer 7

Tracking identified risks
Evaluating current risk response plans
Monitoring residual risks
Identifying new risks

Question 8

What are the risk management responsibilities of (1) the board, (2) management, and (3) the internal audit activity?

Answer 8

Party Responsibility
The board Overseeing and determining that risk management processes are in place, adequate, and effective
Management Ensuring that sound risk management processes are functioning
Internal audit activity Assurance: Examining, evaluating, reporting, or recommending improvements Consulting:
Identifying, evaluating, and implementing risk management methods and controls

Question 9

_____________________ determine the internal audit activity’s role in risk management.

Answer 9

Senior management and the board

Question 10

Define (1) culture, (2) capabilities, and (3) practices in the context of Enterprise Risk Management.

Answer 10

Culture
The attitudes, behaviors, and understanding about risk, both positive and negative, that influence the decisions of management and personnel and reflect the mission, vision, and core values of the organization
Capabilities
The skills needed to carry out the entity’s mission and vision
Practices
The collective methods used to manage risk

Question 11

Define (1) mission, (2) vision, and (3) core values in the context of the culture component of Enterprise Risk Management.

Answer 11

Term Definition
Mission The organization’s core purpose
Vision The organization’s aspirations for what it intends to achieve over time
Core values The organization’s essential beliefs about what is acceptable or unacceptable

Question 12

Define (1) strategy and (2) business objectives in the context of Enterprise Risk Management.

Answer 12

Strategy
How the organization will achieve its mission and vision and apply its core values

Business objectives
Steps taken to achieve the strategy

Question 13

Define (1) risk inventory, (2) risk capacity, and (3) risk appetite in the context of Enterprise Risk Management.

Answer 13

Risk inventory
All identified risks that affect strategy and business objectives
Risk capacity
The maximum amount of risk the organization can assume
Risk appetite
The amount and types of risk the organization is willing to accept in pursuit of value

Question 14

When is value (1) created, (2) preserved, (3) realized, and (4) eroded?

Answer 14

Value is:
Created when the benefits obtained from the resources used exceed their costs.
Preserved when the value of resources used is sustained.
Realized when benefits are transferred to stakeholders.
Eroded when management’s strategy does not produce expected results or management does not perform day-to-day tasks.

Question 15

What are the responsibilities of (1) the board and (2) management regarding Enterprise Risk Management (ERM)?

Answer 15

Party Responsibility
The board Oversight of ERM culture, capabilities, and practices
Management Day-to-day managing of risk (the CEO has ultimate responsibility for ERM)

Question 16

What are the three lines in the Three Line Model?

Answer 16

First line Principal owners of risk
Second line Supporting (business-enabling) functions
Third line Assurance function

Question 17

Categorize the five components of the COSO ERM framework into (1) the supporting aspect and (2) the common process.

Answer 17

Supporting Aspect Common Process
Governance and culture Strategy and objective-setting
Information, communication, and reporting Performance
Review and revision

Question 18

What are the five principles of the Governance and Culture component of the COSO ERM framework?

Answer 18

The board exercises risk oversight.
The organization establishes operating structures.
The organization defines the desired culture.
The organization demonstrates commitment to core values.
The organization attracts, develops, and retains capable individuals.

Question 19

What are the four principles of the Strategy and Objective Setting component of the COSO ERM framework?

Answer 19

The organization analyzes business context and its effect on the risk profile.
The organization defines risk appetite.
The organization evaluates alternative strategies and their effects on the risk profile.
The organization establishes business objectives that align with and support strategy.

Question 20

List and define the three types of business contexts.

Answer 20

Dynamic
New, emerging, and changing risks can appear at any time
Complex
A context may have many interdependencies and interconnections
Unpredictable
Change occurs rapidly and in unanticipated ways

Question 21

What are the four criteria for business objectives?

Answer 21

Specific
Measurable
Observable
Obtainable

Question 22

What are the five principles of the Performance component of the COSO ERM framework?

Answer 22

The organization identifies risks that affect the performance of strategy and business objectives.
The organization assesses the severity of risk.
The organization prioritizes risks at all levels.
The organization identifies and selects risk responses, recognizing that risk may be managed but not eliminated.
The organization develops and evaluates its portfolio view of risk.

Question 23

What are the two measurements of the severity of risk?

Answer 23

Impact

Likelihood

Question 24

List the five categories of risk responses.

Answer 24

Acceptance (retention)
Avoidance
Pursuit
Reduction (mitigation)
Sharing (transfer)

Question 25

What are the four levels of risk views?

Answer 25

``` Risk view (minimal integration) Risk category view (limited integration) Risk profile view (partial integration) Portfolio view (full integration) ```

Question 26

What are the three principles of the Review and Revision component of the COSO ERM framework?

Answer 26

The organization identifies and assesses changes that may substantially affect strategy and business objectives. The organization reviews entity performance results and considers risk. The organization pursues improvement of ERM.

Question 27

What are the three principles of the Information, Communication, and reporting component of the COSO ERM framework?

Answer 27

The organization leverages its information systems to support ERM. The organization uses communication channels to support ERM. The organization reports on risk, culture, and performance at multiple levels and across the entity.

Question 28

Give examples of the limitations of ERM.

Answer 28

``` Faulty human judgment Cost-benefit considerations Simple errors or mistakes Collusion Management override of ERM practices ```

Question 29

List the eight principles of the ISO 31000 Risk Management Framework.

Answer 29

``` Integrated Structured and comprehensive Customized Inclusive Dynamic Best available information Human and cultural factors Continual improvement ```

Question 30

List the six components of the ISO 31000 Risk Management Framework.

Answer 30

``` Leadership and commitment Integration Design Implementation Evaluation Improvement ```

Question 31

List the six risk management processes in the ISO Risk Management Framework.

Answer 31

``` Communication and consultation Scope, context, criteria Risk assessment Risk treatment Monitoring and review Recording and reporting ```

Question 32

What are the responsibilities of (1) the board, (2) management, and (3) the internal audit activity defined in the ISO 31000 Risk Management Framework?

Answer 32

Party Responsibility The board Overseeing risk management Ensuring that risks are managed and the risk management system is effective Management Setting the organization’s risk attitude Identifying and managing risks Internal audit activity Providing assurance regarding the entire risk management system

Question 33

The ISO Risk Management Framework describes what three approaches to providing assurance on the risk management process?

Answer 33

The key principles approach The process element approach The maturity model

Question 34

What are the five maturity levels defined by the capability maturity model (CMM)?

Answer 34

Level 1 Initial: Few processes are defined. Level 2 Repeatable: Basic processes are established. Level 3 Defined: Standards are developed. Level 4 Managed: Performance measures are defined. Level 5 Optimizing: Continuous improvement is enabled.

Question 35

What are the five maturity levels defined by the Capability Maturity Model Integration (CMMI) Development V2.0?

Answer 35

Level 0 Incomplete: Whether work can be completed is not known. Level 1 Initial: Work can be completed, but not on time or within the budget. Level 2 Managed: Projects are planned, implemented, managed, and monitored. Level 3 Defined: Standards for projects are defined throughout the organization. Level 4 Quantitatively managed: The organization quantifies performance improvement goals to meet stakeholder needs. Level 5 Optimizing: The organization pursues continuous improvement, responds to change, and innovates.

Question 36

ERM is expected to manage risks effectively and to help create, preserve, and realize value when

Answer 36

The components, principles, and supporting controls are present and functioning.

Question 37

How is risk defined in the Glossary?

Answer 37

“The possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.”

Question 38

What are the fourbroad categories of risk?

Answer 38

Strategic risks Operational risks Financial risks Hazard risks

Question 39

What is risk capacity?

Answer 39

Risk capacity is the maximum amount of risk that an organization can tolerate without irreparably damaging the company.

Question 40

What is risk appetite?

Answer 40

Risk appetite is defined in the IIA Glossary as “the level of risk that an organization is willing to accept.” Risk appetite is shaped by the expectations of stakeholders, regulatory and contractual requirements, and the influence of technology, capital, and human resources.

Question 41

What is risk tolerance?

Answer 41

Risk tolerance is the amount of variance in the returns from an activity that a company is willing to tolerate. The higher the risk tolerance, the greater the range of outcomes a company is willing to accept.

Question 42

What are some factorsthat influence a company’srisk appetite?

Answer 42

Their position in the business-development cycle. The viewpoints of the major stakeholders. Accounting factors. The opportunity for fraud. Entity-level factors – the personnel, changes in the organization’s structure, and changes in key personnel. External factors – changes in the economy, industry, or technology. Governmental restrictions.

Question 43

What are the five steps in the risk management process?

Answer 43

``` Risk identification Risk assessment Risk prioritization Response planning Risk monitoring ```

Question 44

What are some eventidentification techniques?

Answer 44

``` Brainstorming sessions Event inventories and loss event data Interviews and self-assessment Facilitated workshops SWOT analysis Risk questionnaires and risk surveys Scenario analysis Technology ```

Question 45

What is inherent risk?

Answer 45

SMA:ERMF defines inherent risk as “the level of risk that resides with an event or process prior to management taking a mitigation action.” It is the amount of risk that occurs naturally in the activities of the company. Management cannot do anything about the existence of inherent risk; however, it can take steps to address and, where appropriate, mitigate its effects.

Question 46

What is residual risk?

Answer 46

SMA: ERMF defines residual risk as: “The level of risk that remains after management has taken action to mitigate the risk.” Inherent risk − Activities of management to mitigate/address the risk = Residual risk

Question 47

What two factors are used to assess the exposure to risk?

Answer 47

Loss frequency or probability | Loss severity

Question 48

What is a risk map?

Answer 48

A visual depiction of relative risks based on their expected frequency and expected loss.

Question 49

What are the fourmeasures of potential loss?

Answer 49

Expected loss Unexpected loss Maximum probable loss Maximum possible loss (also called extreme or catastrophic loss)

Question 50

What is the expected loss?

Answer 50

The amount that management expects to lose to a given risk per year on average over a period of several years. Because the loss is expected, it should be included in the budget.

Question 51

What is the unexpected loss?

Answer 51

The amount that could likely be lost to the risk event in a very bad year, in excess of the amount budgeted for the expected loss, up to the maximum probable loss. The business should reserve the unexpected loss amount as capital.

Question 52

What is the maximumprobable loss?

Answer 52

The largest loss that can occur under foreseeable circumstances. Damage greater than the maximum probable loss could occur, but, in the judgment of management, it is very unlikely to occur.

Question 53

What is the maximumpossible loss?

Answer 53

The worst-case scenario. It represents the greatest possible loss from a specific risk or event.

Question 54

What are the fiveresponses to risk?

Answer 54

``` Avoiding or eliminating the risk Reducing or mitigating the risk Transferring or sharing the risk Retaining the risk Exploiting or accepting the risk ```

Question 55

What is Enterprise Risk Management?

Answer 55

“[Enterprise risk management] is the culture, capabilities, and practices that organizations integrate with strategy-setting and apply when they carry out that strategy, with a purpose of managing risk in creating, preserving, and realizing value.” Definition from COSO

Question 56

What are the five components of the COSO ERM Framework?

Answer 56

``` Governance and culture Strategy and objective-setting Performance Review and revision Information, communication, and reporting ```

Question 57

What are the principles of the “governance and culture” component of ERM?

Answer 57

``` Exercises board risk oversight. Establishes operating structures. Defines desired culture. Demonstrates commitment to core values. Attracts, develops, and retains capable individuals. ```

Question 58

What are the principles of the “strategy and objective setting” component of ERM?

Answer 58

Analyzes business context Defines risk appetite Evaluates alternative strategies Formulates business objectives

Question 59

What are the principles of the “performance”component of ERM?

Answer 59

``` Identifies risk Assesses severity of risk Prioritizes risks Implements risk responses Develops portfolio view ```

Question 60

What are the principles of the “review and revision”component of ERM?

Answer 60

Assesses substantial change Reviews risk and performance Pursues improvement in enterprise risk management

Question 61

What are the principles of the “information, communication and reporting” component of ERM?

Answer 61

Leverages information systems Communicates risk information Reports on risk, culture, and performance

Question 62

What are the three areas of principles and guidance in ISO 31000?

Answer 62

Principles. The interrelated values that are foundational to the risk-management process. Framework. The ways in which the risk-management plan should be integrated into “significant activities and functions.” Process. A step-by-step list of procedures to design and execute risk management.

Question 63

What are the eight principles that ISO 31000 sets forth to guide risk-management procedures?

Answer 63

``` Integrated Structured and comprehensive Customized Inclusive Dynamic Best available information Human and cultural factors Continual improvement ```

Question 64

What are the six steps of therisk-management processin ISO 31000?

Answer 64

``` Communication and consultation Scope, context, and criteria Risk assessment Risk treatment Monitoring and review Recording and reporting ```

Question 65

What is the role of the IAA in the risk-management process?

Answer 65

The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. Standard 2120

Question 66

What must an assessmentof the risk-managementprocess address?

Answer 66

The internal auditor must be satisfied that the organization’s risk management processes addresses: Risks that arise from business strategies and activities are identified and prioritized. Management and the board set the level of risk acceptable to the organization (assess risk appetite). Risk mitigation or reduction activities are designed and implemented to reduce or otherwise manage risk at acceptable levels. Risk are periodically reassessed on an ongoing basis. Reports are given periodically to the board and management on the risk assessment process.

Question 67

How is evidence forrisk-managementassessments gathered?

Answer 67

Evidence to support the risk assessment is usually obtained from engagements throughout the year. Because there is no formula to follow, the successful assessment of risk often rests with the professional judgment and experience of the internal auditors and the CAE.

Question 68

What should the IAA do when there is no risk-management process?

Answer 68

The CAE must convince the board and senior management to establish one, even if it just an informal set of procedures.

Question 69

In what three areas should the IAA provide assurance about the effectiveness of risk management?

Answer 69

The design and implementation of the risk management processes. Identification of key risks and the effectiveness of their controls. Assessment and reporting of risk and controls.

Question 70

What are consulting engagements connected to risk management that are core roles of the IAA?

Answer 70

Giving assurance on the risk management process Giving assurance that risks are correctly evaluated Evaluating risk management processes Evaluating the reporting of key risks Reviewing the management of key risks

Question 71

What are consulting engagements connected to risk management that are legitimate roles of the IAA?

Answer 71

Facilitating identification and evaluating risks Coaching management in responding to risks Coordinating ERM activities Consolidated reporting on risks Maintaining and developing the ERM framework Championing the establishment of ERM Developing the ERM strategy for board approval

Question 72

What are consulting engagements connected to risk management that the IAA should not undertake?

Answer 72

``` Setting the risk appetite Imposing risk management processes Management assurance on risks Taking decisions on risk responses Implementing responses on management’s behalf Accountability for risk management ```

Question 73

How does the IIA Glossary define control?

Answer 73

“Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.”

Question 74

Internal control provides reasonable assurance about the achievement of objectives in what three areas?

Answer 74

Operations Reporting Compliance

Question 75

What are five types of controls?

Answer 75

``` Directive Preventive Detective Corrective Compensating ```

Question 76

What are the threetimings of controls?

Answer 76

Feedforward controls Concurrent controls Feedback controls

Question 77

What are characteristics of effective controls?

Answer 77

``` Economical Meaningful Appropriate Congruent Timely Simple Operational ```

Question 78

What are the limitations of internal controls?

Answer 78

Internal controls can provide only reasonable assurance that objectives can be achieved. Internal controls should never be promoted as a guarantee. Human error, faulty judgment, collusion, and fraud can all limit the effectiveness of controls. Excessive or unreasonable controls can increase bureaucracy and reduce productivity. Controls must be evaluated in terms of their cost and benefit to avoid wasting resources.

Question 79

Who is responsible forinternal controls?

Answer 79

The board of directors oversees the control system. The CEO is responsible for the “tone at the top.” Senior managers delegate responsibility for establishing specific internal control policies and procedures. Financial officers and their staffs are central to the exercise of control. Internal auditors play a monitoring role. Virtually all employees are involved in internal control. External parties such as independent auditors often provide information useful to effective internal control.

Question 80

What are the three main elements of the control process?

Answer 80

Setting the objectives. Measuring performance against a standard. Evaluating the results then correcting or regulating the performance.

Question 81

What are input controls in an automated control system?

Answer 81

``` Edit checks Key verifications Redundancy checks Echo checks Completeness checks ```

Question 82

What are processing controls in an automated control system?

Answer 82

``` Posting checks Cross-footing Zero balance checks Run-to-run control totals Internal header and trailer labels Concurrency controls Key integrity checks ```

Question 83

What are output controls in an automated control system?

Answer 83

Output distribution controls Output retention controls Forms controls Error logs

Question 84

What four duties shouldalways be segregated?

Answer 84

1) Authorizing a transaction. 2) Recording the transaction, preparing source documents, and maintaining journals. 3) Keeping physical custody of the related asset. For example, receiving checks in the mail. 4) The periodic reconciliation of the physical assets to the recorded amounts for those assets.

Question 85

What is collusion?

Answer 85

Collusion is when two or more people work together to get around the controls that are in place.

Question 86

What are the five components of internal control?

Answer 86

``` Control environment Risk assessment Control activities Information and communication Monitoring activities ```

Question 87

What is the control environmentin the COSO Model?

Answer 87

The control environment sets the tone for the organization, influencing the control consciousness of its people. The control environment is the foundation for the other components of internal control.

Question 88

What is risk assessmentin the COSO Model?

Answer 88

Risk assessment is the identification and analysis of relevant risks to the achievement of objectives and forms a basis for how risks should be managed.

Question 89

What are control activitiesin the COSO Model?

Answer 89

Control activities ensure that management directives are carried out. These policies and procedures also outline the necessary steps to address risks to the organization’s objectives.

Question 90

What is information and communicationin the COSO Model?

Answer 90

These are the systems or processes that support the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities.

Question 91

What is monitoringin the COSO Model?

Answer 91

These are processes used to assess the quality of internal control performance over time. This objective is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two.

Question 92

What are the five principles of the control environment under the COSO Model?

Answer 92

The organization demonstrates a commitment to integrity and ethical values. The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives. The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Question 93

What are the four principles ofrisk assessment under theCOSO Model?

Answer 93

The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. The organization considers the potential for fraud in assessing risks to the achievement of objectives. The organization identifies and assesses changes that could significantly impact the system of internal control.

Question 94

What are the three principles ofthe control activities under the COSO Model?

Answer 94

The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. The organization selects and develops general control activities over technology to support the achievement of objectives. The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

Question 95

What are the three principles of information and communication under the COSO Model?

Answer 95

The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. The organization communicates with external parties regarding matters affecting the functioning of internal control.

Question 96

What are the two principles of monitoring activitiesunder the COSO Model?

Answer 96

The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Question 97

What type of controls do both COSO and CoCo emphasize?

Answer 97

Soft controls, which emphasize ideas and expectations (for example, shared values, expectations, commitment, competence, and trust) rather than specific tasks (for example, policies and procedures).

Question 98

What are the key tenets of the Turnbull Report?

Answer 98

Board’s responsibility for internal controls Management’s responsibility for internal controls Employees’ responsibility for internal controls Adopting a risk-based approach Ongoing monitoring of risks and controls

Question 99

What is the role of the IAA in the company’s control system?

Answer 99

The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement. Standard 2130

Question 100

What are the steps inthe evaluation of theeffectiveness of controls?

Answer 100

Identify objectives and any associated risks. Determine the significance of any risks. Make note of the responses to these risks. Identify the “key controls.” Assess how well a given control is designed. Test the control to ascertain the effectiveness of the design.

Question 101

What three criteria can help the IAA measure the effectiveness of a specific control?

Answer 101

The level of control must be “appropriate for the risk it addresses.” For example, petty cash does not need as many controls as cash received from customers. The costs of the control must not exceed the benefits it provides. For example, the office supply cabinet does not need 24/7 surveillance and a biometric scanner for access, but a server room certainly would. No control should “create significant business concerns.” For example, regardless of how efficiently a control manages a particular risk, if the control breaks the law, it puts the company in significant legal jeopardy.