Case 1: Risk Tolerance vs. Risk Capacity
Scenario: AlfaTech's board has established a risk committee. The committee is evaluating its insurance policies for plant assets. The company is reasonably well-capitalized. During the discussion, the committee makes the following four statements:
· A. "If a fire occurs, the company can withstand a loss of up to $500,000."
· B. "We will review and update the insurance policy annually."
· C. "We will set the insurance deductible at $150,000."
· D. "Under normal circumstances, coverage should be no less than 80% of replacement value."
Question: Which statement best describes the company's risk tolerance ?
Answer:
---
Case 2: Inherent Risk vs. Residual Risk
Scenario: An internal auditor assessed that the risk of steel theft at a plant is high. In response, management introduced three controls: (1) perimeter fencing, (2) a metal detector at the entrance, and (3) monthly steel inventory counts.
Question: If the controls operate as intended, which outcome would the internal auditor hope to see?
· A. Inherent risk will be mitigated to a level lower than residual risk.
· B. Inherent risk will be reduced to an acceptable level.
· C. Residual risk will be reduced to an acceptable level.
· D. Residual risk will be eliminated.
Answer:
---
Case 3: The Three Lines Model – Roles and Independence
Scenario: A mid-sized organization has adopted the Three Lines Model. During a governance review, the following four situations are observed:
· A. Internal audit implemented new controls after identifying deficiencies.
· B. The risk management function reports directly to the chief audit executive (CAE).
· C. Operational management accepts risks and implements controls; internal audit later provides independent assurance over their effectiveness.
· D. Internal audit coordinates and approves risk responses before management implements them.
Question: Which scenario best reflects proper alignment with the Three Lines Model?
Answer:.
---
Case 4: Internal Audit's Role in Risk Management
Scenario: A chief audit executive (CAE) is asked to take on additional responsibilities within the organization's enterprise risk management (ERM) framework. The board asks which of the following roles would be acceptable for the internal audit activity, depending on the organization.
· A. Managing and coordinating the risk management process.
· B. Directing the IT function to implement specific risk controls.
· C. Setting the organization's risk appetite.
· D. Championing risk controls even when they are not cost-effective.
Answer:
---
Case 5: Relative Risk and Control Failure
Scenario: A purchase order was processed without being compared to an approved price list. An auditor is evaluating the relative risk stemming from this control failure and considers four possible explanations:
· A. A temporary employee processed the purchase order.
· B. The director of the purchasing department approved the purchase order.
· C. The comparison is not required by organizational policy.
· D. The vendor is one used often by the organization.
Question: Which explanation suggests the least amount of relative risk going forward?
Answer:
---
Case 6: Risk Response – Shifting vs. Acceptance
Scenario: A company identifies a high-severity risk related to potential product liability. Management decides to purchase product liability insurance to transfer the financial consequences of a claim. Later, the same company decides not to renew the policy and instead self-insure the exposure, documenting the decision and monitoring the risk.
Question: Which sequence best describes the change in risk response?
· A. Avoidance → Sharing
· B. Sharing → Acceptance
· C. Reduction → Avoidance
· D. Acceptance → Sharing
Answer:
---
Key Takeaways for CIA Part 1 Risk Management
Concept What to Remember
Risk tolerance Acceptable variation in outcomes; often expressed as a threshold (deductible, limit)
Risk capacity Maximum loss the organization can absorb
Inherent vs. residual Inherent = before controls; residual = after controls. Controls reduce residual risk—they do not change inherent risk
Three Lines Model First line owns risk; second line monitors; third line (internal audit) assures independently—no design/implementation
IA's role in ERM May coordinate and manage the process, but must not make risk decisions or set appetite
Risk responses Avoidance, reduction (mitigation), sharing (transfer), acceptance
No comments:
Post a Comment