ERM , IC and Business Processes Flashcards
Master BEC section of the CPA exam
is prioritizing risk a principle of the review and revision component?
No, prioritizing risk is a principle of the performance component.
Is Unstructured data non-flexible?
Yes, it is Non-flexible
Does ERM 2017 address the issue of compliance with laws, rules, and regulations?🤨
No. That was the main objective of 2004 ERM COSO framework😉
Is improving resource deployment among the BOD oversight responsibilities?
No. This is rather one of the benefits of ERM implementation throughout the organization😁
What is ERM according to COSO?
“a process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and
manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”
What are Internal control objectives?
(a) Effectiveness and efficiency of operations
(b) Reliability of financial reporting
(c) Compliance with applicable laws and regulations
What are the types of Control activities?
a. Segregation of duties
b. Authorization
c. Review and verification
d. Information processing controls
e. Retention of records
f. Reconciliation
g. Physical security of assets
h. Education, training, and monitoring
i. IT security
j. Top-level reviews
what are the Internal control Limitations?
1- lack of segregation of duties due to staff size.
2- judgment of employees ( lack of time and pressure to provide a rapid response)
3- Breakdowns in communication
4- Collusion
5- Management Override
what is Control precision as defined by SOX 2002?
Control precision is the alignment between a risk and the control activity designed to mitigate that risk. direct influence —> more precise.
what is Control sufficiency as defined by SOX 2002?
Control sufficiency is a group of controls with a variety of degrees of precision necessary to achieve a control objective.
what is top-down risk assessment (TDRA)?
A TDRA is a set of steps used to identify and assess financial reporting elements, related risks, and internal control procedures meant to limit those risks.
what is The purpose of the TDRA (top-down risk assessment?
The purpose of the TDRA (top-down risk assessment) is for the company to analyze the internal controls currently in place and to assess the effectiveness of those controls to avoid material misstatement in the firm’s financial reporting.
what are the 5 components of Internal Control?
- Control Environment.
- Risk Assessment.
- Control Activities.
- Information and Communication.
- Monitoring.
what are internal control principles under the Control Environment component?
(1) Demonstrates commitment to integrity and ethical values
(2) Exercises oversight responsibility
(3) Establishes structure, authority, and responsibility
(4) Demonstrates commitment to competence
(5) Enforces accountability
what are internal control principles under the Risk Assessment component?
(6) Specifies suitable objectives
(7) Identifies and analyzes risk
(8) Assesses fraud risk
(9) Identifies and analyzes significant change
what are internal control principles under the Control Activities component?
(10) Selects and develops control activities
(11) Selects and develops general controls over technology
(12) Deploys through policies and procedures
what are internal control principles under the Information and Communication component?
(13) Uses relevant information
(14) Communicates internally
(15) Communicates externally
what are internal control principles under the Monitoring component?
(16) Conducts ongoing and/or separate evaluations
(17) Evaluates and communicates deficiencies
What are the elements of Fraud Triangle?
Incentive
Opportunity
Rationalization
what are the types of risk?
. Inherent risk: the risk that exists before management takes any steps to control the likelihood or impact of a risk.
. Residual risk: the risk that remains after management reacts to the risk, such as by implementing internal controls.
what is the difference between Inherent risk and Residual risk?
Inherent risk is the risk that exists before management takes any steps to control the likelihood or impact of a risk.
Residual risk is the risk that remains after management reacts to the risk, such as by implementing internal controls.
What is PCAOB role?
PCAOB is in charge of overseeing , regulating , inspecting and disciplining accounting firms in their roles as auditors of public companies.
How to prioritize risks using statistical risk ranking methodology?
R (Rating) = L( Liklihood) * S (severity)
What are ERM 2017 components?
think; SPRING
S 1- Strategy and objective-setting
P 2- Performance
R 3- Review and revision
IN 4- information, communication and
reporting.
G 5- Governance and culture
