GOVERNANCE, RISK MANAGEMENT AND CONTROL Flashcards

Question

What are the five main aspects of CSR in ISO 26000?

Answer 1

1) A company should operate ethically and with integrity. 2) A company should treat its employees fairly and with respect. 3) A company should demonstrate respect for human rights. 4) A company should be a responsible citizen in its community. 5) A company should do what it can to sustain the environment for future generations.

Answer 2

1) Philanthropic responsibilities 2) Ethical responsibilities 3) Legal responsibilities 4) Economic responsibilities

Answer 3

• By element. • By stakeholder or stakeholder group. • By subject. For example, by workplace, marketplace, environment, and community. • By department/function. Audit CSR separately for each department within the organization. • By third party. Audit third parties for compliance with CSR terms and conditions.

Answer 4

* Governance * Ethics * Environment * Transparency * Healthy, Safety, and Security * Human Rights and Work Conditions

Answer 5

1) Set priorities and policies for areas such as ethics, labor, the environment, charity, and any other relevant CSR areas. 2) Set specific objectives and strategies to achieve the policies set by management. 3) Communicate and embed CSR into controls and decision making. 4) Track the activities related to CSR so that the results of the CSR policies and objectives can be measured, analyzed, and benchmarked. 5) Engage stakeholders to resolve any complaints and receive feedback on the CSR issues affecting them. 6) Audit results including controls related to CSR and any public disclosures. 7) Report results.

Answer 6

* Employees and their families * Environmental organizations * Customers * Suppliers * Communities * Shareholders

Answer 7

“The possibility of an event occurring that will have an | impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.”

Answer 8

1) Strategic risks 2) Operational risks 3) Financial risks 4) Hazard risks

Answer 9

Risk capacity is the maximum amount of risk that an | organization can tolerate without irreparably damaging the company.

Answer 10

Risk appetite is defined in the IIA Glossary as “the level of risk that an organization is willing to accept.” Risk appetite is shaped by the expectations of stakeholders, regulatory and contractual requirements, and the influence of technology, capital, and human resources.

Answer 11

Risk tolerance is the amount of variance in the returns from an activity that a company is willing to tolerate. The higher the risk tolerance, the greater the range of outcomes a company is willing to accept.

Answer 12

* Their position in the business-development cycle. * The viewpoints of the major stakeholders. * Accounting factors. * The opportunity for fraud. * Entity-level factors – the personnel, changes in the organization’s structure, and changes in key personnel. * External factors – changes in the economy, industry, or technology. * Governmental restrictions.

Answer 13

1) Risk identification 2) Risk assessment 3) Risk prioritization 4) Response planning 5) Risk monitoring

Answer 14

* Brainstorming sessions * Event inventories and loss event data * Interviews and self-assessment * Facilitated workshops * SWOT analysis * Risk questionnaires and risk surveys * Scenario analysis * Technology

Answer 15

Inherent risk is defined as “the level of risk that resides with an event or process prior to management taking a mitigation action.” It is the amount of risk that occurs naturally in the activities of the company. Management cannot do anything about the existence of inherent risk; however, it can take steps to address and, where appropriate, mitigate its effects.

Answer 16

Residual risk is defined as: “The level of risk that remains after management has taken action to mitigate the risk.” Inherent risk − Activities of management to mitigate/address the risk = Residual risk

Answer 17

1) Loss frequency or probability | 2) Loss severity

Answer 18

A visual depiction of relative risks based on their expected frequency and expected loss.

Answer 19

1) Expected loss 2) Unexpected loss 3) Maximum probable loss 4) Maximum possible loss (also called extreme or catastrophic loss)

Answer 20

The amount that management expects to lose to a given risk per year on average over a period of several years. Because the loss is expected, it should be included in the budget.

Answer 21

The amount that could likely be lost to the risk event in a very bad year, in excess of the amount budgeted for the expected loss, up to the maximum probable loss. The business should reserve the unexpected loss amount as capital.

Answer 22

The largest loss that can occur under foreseeable circumstances. Damage greater than the maximum probable loss could occur, but, in the judgment of management, it is very unlikely to occur.

Answer 23

The worst-case scenario. It represents the greatest possible loss from a specific risk or event.

Answer 24

1) Avoiding or eliminating the risk 2) Reducing or mitigating the risk 3) Transferring or sharing the risk 4) Retaining the risk 5) Exploiting or accepting the risk

Answer 25

“[Enterprise risk management] is the culture, capabilities, and practices that organizations integrate with strategy- setting and apply when they carry out that strategy, with a purpose of managing risk in creating, preserving, and realizing value.”

Answer 26

1) Governance and culture 2) Strategy and objective-setting 3) Performance 4) Review and revision 5) Information, communication, and reporting

Answer 27

1) Analyzes business context 2) Defines risk appetite 3) Evaluates alternative strategies 4) Formulates business objectives

Answer 28

1) Identifies risk 2) Assesses severity of risk 3) Prioritizes risks 4) Implements risk responses 5) Develops portfolio view

Answer 29

1) Assesses substantial change 2) Reviews risk and performance 3) Pursues improvement in enterprise risk management

Answer 30

1) Leverages information systems 2) Communicates risk information 3) Reports on risk, culture, and performance

Answer 31

1) Principles. The interrelated values that are foundational to the risk-management process. 2) Framework. The ways in which the risk-management plan should be integrated into “significant activities and functions.” 3) Process. A step-by-step list of procedures to design and execute risk management.

Answer 32

1) Integrated 2) Structured and comprehensive 3) Customized 4) Inclusive 5) Dynamic 6) Best available information 7) Human and cultural factors 8) Continual improvement

Answer 33

1) Communication and consultation 2) Scope, context, and criteria 3) Risk assessment 4) Risk treatment 5) Monitoring and review 6) Recording and reporting

Answer 34

The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes.

Answer 35

The internal auditor must be satisfied that the organization’s risk management processes addresses: 1) Risks that arise from business strategies and activities are identified and prioritized. 2) Management and the board set the level of risk acceptable to the organization (assess risk appetite). 3) Risk mitigation or reduction activities are designed and implemented to reduce or otherwise manage risk at acceptable levels. 4) Risk are periodically reassessed on an ongoing basis. 5) Reports are given periodically to the board and management on the risk assessment process.

Answer 36

Evidence to support the risk assessment is usually obtained from engagements throughout the year. Because there is no formula to follow, the successful assessment of risk often rests with the professional judgment and experience of the internal auditors and the CAE.

Answer 37

The CAE must convince the board and senior management to establish one, even if it just an informal set of procedures.

Answer 38

1) The design and implementation of the risk management processes. 2) Identification of key risks and the effectiveness of their controls. 3) Assessment and reporting of risk and controls.

Answer 39

* Giving assurance on the risk management process * Giving assurance that risks are correctly evaluated * Evaluating risk management processes * Evaluating the reporting of key risks * Reviewing the management of key risks

Answer 40

* Facilitating identification and evaluating risks * Coaching management in responding to risks * Coordinating ERM activities * Consolidated reporting on risks * Maintaining and developing the ERM framework * Championing the establishment of ERM * Developing the ERM strategy for board approval

Answer 41

* Setting the risk appetite * Imposing risk management processes * Management assurance on risks * Taking decisions on risk responses * Implementing responses on management’s behalf * Accountability for risk management

Answer 42

“Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.”

Answer 43

1) Operations 2) Reporting 3) Compliance

Answer 44

1) Directive 2) Preventive 3) Detective 4) Corrective 5) Compensating

Answer 45

1) Feedforward controls 2) Concurrent controls 3) Feedback controls

Answer 46

* Economical * Meaningful * Appropriate * Congruent * Timely * Simple * Operational

Answer 47

1) Internal controls can provide only reasonable assurance that objectives can be achieved. Internal controls should never be promoted as a guarantee. 2) Human error, faulty judgment, collusion, and fraud can all limit the effectiveness of controls. 3) Excessive or unreasonable controls can increase bureaucracy and reduce productivity. Controls must be evaluated in terms of their cost and benefit to avoid wasting resources.

Answer 48

The board of directors oversees the control system. The CEO is responsible for the “tone at the top.” Senior managers delegate responsibility for establishing specific internal control policies and procedures. Financial officers and their staffs are central to the exercise of control. Internal auditors play a monitoring role. Virtually all employees are involved in internal control. External parties such as independent auditors often provide information useful to effective internal control.

Answer 49

1) Setting the objectives. 2) Measuring performance against a standard. 3) Evaluating the results then correcting or regulating the performance.

Answer 50

1) Edit checks 2) Key verifications 3) Redundancy checks 4) Echo checks 5) Completeness checks

Answer 51

1) Posting checks 2) Cross-footing 3) Zero balance checks 4) Run-to-run control totals 5) Internal header and trailer labels 6) Concurrency controls 7) Key integrity checks

Answer 52

1) Output distribution controls 2) Output retention controls 3) Forms controls 4) Error logs

Answer 53

1) Authorizing a transaction. 2) Recording the transaction, preparing source documents, and maintaining journals. 3) Keeping physical custody of the related asset. For example, receiving checks in the mail. 4) The periodic reconciliation of the physical assets to the recorded amounts for those assets.

Answer 54

Collusion is when two or more people work together to get around the controls that are in place.

Answer 55

1) Control environment 2) Risk assessment 3) Control activities 4) Information and communication 5) Monitoring activities

Answer 56

The control environment sets the tone for the organization, influencing the control consciousness of its people. The control environment is the foundation for the other components of internal control.

Answer 57

Risk assessment is the identification and analysis of | relevant risks to the achievement of objectives and forms a basis for how risks should be managed.

Answer 58

Control activities ensure that management directives are carried out. These policies and procedures also outline the necessary steps to address risks to the organization’s objectives.

Answer 59

These are the systems or processes that support the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities.

Answer 60

These are processes used to assess the quality of internal control performance over time. This objective is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two.

Answer 61

1) The organization demonstrates a commitment to integrity and ethical values. 2) The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control. 3) Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. 4) The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives. 5) The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Answer 62

1) The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. 2) The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. 3) The organization considers the potential for fraud in assessing risks to the achievement of objectives. 4) The organization identifies and assesses changes that could significantly impact the system of internal control.

Answer 63

1) The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. 2) The organization selects and develops general control activities over technology to support the achievement of objectives. 3) The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

Answer 64

1) The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. 2) The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. 3) The organization communicates with external parties regarding matters affecting the functioning of internal control.

Answer 65

1) The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. 2) The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Answer 66

Soft controls, which emphasize ideas and expectations (for example, shared values, expectations, commitment, competence, and trust) rather than specific tasks (for example, policies and procedures).

Answer 67

* Board’s responsibility for internal controls * Management’s responsibility for internal controls * Employees’ responsibility for internal controls * Adopting a risk-based approach * Ongoing monitoring of risks and controls

Answer 68

The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement.

Answer 69

1) Identify objectives and any associated risks. 2) Determine the significance of any risks. 3) Make note of the responses to these risks. 4) Identify the “key controls.” 5) Assess how well a given control is designed. 6) Test the control to ascertain the effectiveness of the design.

Answer 70

1) The level of control must be “appropriate for the risk it addresses.” For example, petty cash does not need as many controls as cash received from customers. 2) The costs of the control must not exceed the benefits it provides. For example, the office supply cabinet does not need 24/7 surveillance and a biometric scanner for access, but a server room certainly would. 3) No control should “create significant business concerns.” For example, regardless of how efficiently a control manages a particular risk, if the control breaks the law, it puts the company in significant legal jeopardy.

GOVERNANCE, RISK MANAGEMENT AND CONTROL Flashcards

(94 cards)