Notes+Questions on Internal control Governance Risk Assessment Control Application

1. The Internal Control System — Core Concepts

 

Definition (COSO): Internal control is a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in three categories:

· Reliability of financial reporting

· Effectiveness and efficiency of operations

· Compliance with applicable laws and regulations

Reasonable assurance means a high level of confidence that financial statements or reports are free from material misstatements, while absolute assurance (Infalliability)means 100% certainty and zero risk of error.

Key limitation: Internal controls provide reasonable assurance, not absolute assurance. Limitations include human error, faulty judgment, collusion, management override, and cost-benefit constraints.

Internal controls provide reasonable rather than absolute assurance because they are subject to unavoidable inherent limitations rooted in human behavior, authority, and changing environments.

Human Error

• Human Error occurs because people are prone to fatigue, carelessness, distraction, or misinterpretation of instructions.
• Example: An accounting clerk accidentally enters an invoice amount as $120,000 instead of $1,200,000, and a tired reviewer fails to catch the typo during a routine check.

Collusion

• Collusion happens when two or more individuals secretly cooperate to bypass controls, defeating systems like segregation of duties.
• Example: A purchasing manager and an accounts payable clerk work together to approve fake vendor invoices and split the fraudulent payouts, bypassing the independent check between purchasing and payment. 

Management Override

• Management Override arises when executives or individuals in positions of high authority use their power to bypass established policies.
• Example: A CEO orders the finance department to bypass standard purchase order approvals to fast-track an unauthorized high-value contract for a personal friend's company.

Compromised Judgment

• Compromised Judgment involves poor decision-making or flawed estimates made under pressure or with incomplete information.
• Example: Management sets aggressive, unrealistic quarterly sales targets, pushing regional staff to log fake sales transactions or cut corners on credit checks just to meet goals.

Obsolescence and Changing Conditions

• Obsolescence occurs when controls fail to adapt to shifts in business size, technology, regulations, or operations.
• Example: An outdated manual approval workflow for software updates remains in place, leaving the company blind to newer automated cyber threats or cloud-infrastructure vulnerabilities.

 

Three objectives (the "control triad"): Operations, Reporting, Compliance.

The control triad consists of Operations, Reporting, and Compliance, which form the core objectives of internal control frameworks like COSO.

The Control Triad Components

• Operations
• Focuses on the effective and efficient use of an organization's resources.
• Aims to achieve basic business objectives, safeguard assets, and improve performance.
• Relates to day-to-day business execution and operational resilience.
• Reporting
• Focuses on the reliability, timeliness, and transparency of internal and external financial and non-financial reporting.
• Ensures stakeholders receive accurate data for informed decision-making.
• Includes regulatory filings and disclosures regarding serious disruptions or metrics. 
• Compliance
• Focuses on adherence to applicable laws, regulations, and internal policies.
• Converts external legal and regulatory obligations into expected organizational behavior.
• Ensures the business operates within statutory boundaries and ethical guidelines.

 

Types of controls by timing:

· Preventive — stop problems before they occur (e.g., segregation of duties, passwords, authorization).

· Detective — identify problems after they occur (e.g., reconciliations, variance analysis, physical counts).

· Corrective — fix problems once detected (e.g., error correction, backup restoration).

· Directive — guide behavior toward desired outcomes (e.g., policies, training).

 

Control classifications (CIA Part 1 emphasis): Preventive, detective, corrective, directive, input, processing, output, feedforward, feedback, key controls, compensating controls.

 

Compensating control: A secondary control that mitigates risk when a primary control cannot operate as designed or is absent. Example: daily supervisory review of deposit slips when cash receipts and recordkeeping cannot be segregated in a small department.

 

2. COSO Internal Control — Integrated Framework (2013)

The COSO Internal Control – Integrated Framework (2013) is the dominant framework for designing and evaluating internal control. It consists of five interrelated components and 17 principles.

2.1 Five Components

Control Environment The "tone at the top" — integrity, ethical values, organizational structure, competence, accountability

Risk Assessment Identifying and analyzing risks to objectives; determining how risks should be managed

Control Activities Policies and procedures that help ensure management directives are carried out

Information & Communication Relevant information identified, captured, and communicated in a timely manner

Monitoring Ongoing and separate evaluations to assess control effectiveness

 

The Control Environment is the foundation — all other components build upon it. Major corporate scandals (e.g., Enron) often stem from a toxic control environment rather than a lack of policies.

 

2.2 The 17 Principles (by Component)

Control Environment (Principles 1–5)

1. Demonstrates commitment to integrity and ethical values

2. Board of directors demonstrates independence and exercises oversight

3. Establishes structure, authority, and responsibility

4. Demonstrates commitment to competence

5. Enforces accountability

 

Risk Assessment (Principles 6–9)

6. Specifies suitable objectives with sufficient clarity

7. Identifies and analyzes risks to achieving objectives

8. Assesses fraud risk

9. Identifies and analyzes significant change

 

Control Activities (Principles 10–12)

10. Selects and develops control activities

11. Selects and develops general controls over technology

12. Deploys control activities through policies and procedures

 

Information & Communication (Principles 13–15)

13. Obtains or generates relevant information

14. Communicates internally

15. Communicates externally

 

Monitoring Activities (Principles 16–17)

16. Conducts ongoing and/or separate evaluations

17. Evaluates and communicates deficiencies

 

Exam tip: The 2013 Framework introduced the codification of 17 principles and 51 points of focus.

 

2.3 COSO ERM (2017) — For CMA Part 1

COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017) has five components and 20 principles:

1. Governance and Culture (5 principles)

2. Strategy and Objective-Setting (4 principles)

3. Performance (5 principles)

4. Review and Revision (3 principles)

5. Information, Communication, and Reporting (3 principles)

 

ERM expands internal control beyond financial reporting to strategy and enterprise-wide risk.

 

3. COBIT — IT Governance Framework

COBIT (Control Objectives for Information and Related Technologies), developed by ISACA, is the leading framework for governance and management of enterprise IT (GEIT).

3.1 COBIT 2019 — Six Governance Principles

 

COBIT 2019 is built on six principles for a governance system (expanded from five in COBIT 5):

1. Provide Stakeholder Value — Enterprises exist to create value for stakeholders by balancing benefits, risk optimization, and resource use.

2. Holistic Approach — Governance built from a number of interacting components working together.

3. Dynamic Governance System — Governance must adapt to changing enterprise needs.

4. Governance Distinct from Management — Governance ensures goals are achieved by evaluating needs, setting direction, and monitoring; management plans, builds, runs, and monitors activities.

5. Tailored to Enterprise Needs — Frameworks must be customized to the enterprise's context.

6. End-to-End Governance System — Covers the entire enterprise, treating information and technology as assets.

 

3.2 COBIT 2019 — Seven Enablers

1. Principles, policies, and frameworks

2. Processes

3. Organizational structures

4. Culture, ethics, and behavior

5. Information

6. Services, IT infrastructure, and applications

7. People, skills, and competencies

 

3.3 COBIT Domains (40 Objectives)

· EDM — Evaluate, Direct, Monitor (Governance)

· APO — Align, Plan, Organize (Management)

· BAI — Build, Acquire, Implement

· DSS — Deliver, Service, Support

· MEA — Monitor, Evaluate, Assess

 

Exam relevance: COBIT's MEA02 process specifically addresses monitoring and evaluating the system of internal control. COBIT is used to translate regulatory obligations (SOX, ISO 27001, PCI DSS, DORA) into a single control architecture.

 

4. Governance — CIA Part 1 Context

 

4.1 Definition and Ownership

Governance is the combination of processes and structures the board uses to inform, direct, manage, and monitor the organization toward its objectives.

· Owned by: The board / governing body

· Internal audit's role: Evaluate and contribute to improving governance — not to own or operate it

 

4.2 The IIA Three Lines Model (2020)

Replaced the older "Three Lines of Defense":

Line Role

Governing Body Oversight and direction

First Line Management — owns and manages risk

Second Line Risk management and compliance functions

Third Line Internal audit — independent assurance

 

Hard rule: Management owns risk and control; the board oversees; internal audit assures.

 

4.3 Governance, Risk, and Control — Interlocking Processes

 

1. Governance sets direction and oversight

2. Risk management identifies what could derail objectives

3. Control provides assurance objectives are met

 

The board sets objectives, risk appetite, ethical tone, and oversight expectations. Management identifies risks and decides responses. Controls are the specific actions that bring risk down to acceptable levels.

 

5. Risk Assessment — CIA Part 1 & CMA Part 1

5.1 Risk Vocabulary

· Risk: The possibility that events will affect the achievement of objectives — positively or negatively.

· Inherent risk: Risk before any controls.

· Residual risk: Risk remaining after controls.

· Risk appetite: The amount of risk the organization is willing to accept.

· Risk tolerance: Acceptable variation around the risk appetite.

· Risk response: Avoid, reduce, share/transfer, accept.

 

5.2 Risk Assessment Process (COSO)

The Risk Assessment component of COSO (Principles 6–9) requires:

1. Specifying suitable objectives — objectives must be clear enough to identify risks.

2. Identifying and analyzing risks — assess likelihood and impact.

3. Assessing fraud risk — specifically consider fraud in risk assessment.

4. Identifying significant change — monitor changes that could affect internal control.

 

Risk assessment techniques: Risk mapping based on likelihood and impact, use of matrices, risk registers.

 

5.3 Internal Audit's Role in Risk Assessment

· Primary role: Provide objective evaluations of risk and contribute to the risk management process.

· CIA Part 1 weight: Internal Control & Risk is 25–35% of the exam.

· Internal audit evaluates adequacy and effectiveness of risk management — it does not perform the risk assessment for management (would impair objectivity).

 

6. Accounting Information Systems (AIS) Controls

6.1 General Controls (ITGCs)

IT General Controls apply to all systems in the IT environment:

· Logical access security — passwords, user access rights

· Change management — controlling modifications to systems

· Computer operations — job scheduling, backups, disaster recovery

· Segregation of incompatible duties in IT

· System development procedures

· Physical security — hardware, facilities

 

ITGCs are pervasive — they support the integrity of every application running in the environment.

 

6.2 Application Controls

Application controls are specific to a particular application and relate to individual transactions:

Category Purpose Examples

Input Controls Ensure accuracy and completeness of data entered Check digits, field validation, batch totals, edit checks

Processing Controls Ensure data is processed correctly Run-to-run totals, reasonableness checks, sequence checks

Output Controls Ensure outputs are accurate, complete, and delivered securely Distribution lists, reconciliation of output totals

Data File Controls Ensure integrity of stored data File maintenance controls, access restrictions

 

Check digit: An algorithmic validation embedded in an input field (e.g., customer or account number) that detects transposition and transcription errors at data entry — a classic input application control.

 

6.3 Relationship Between ITGCs and Application Controls

 

ITGCs provide the environment in which application controls operate. If ITGCs are weak, application controls may not function reliably. Auditors typically test ITGCs first, then application controls.

 

7. FCPA — Foreign Corrupt Practices Act (1977)

7.1 Two Sets of Provisions

The FCPA has two major provisions:

1. Anti-bribery provisions — prohibit corrupt payments to foreign officials.

2. Accounting provisions — require issuers to:

   · Make and keep books and records that accurately and fairly reflect transactions

   · Devise and maintain a system of internal accounting controls sufficient to provide reasonable assurance that:

     · Transactions are executed in accordance with management's authorization

     · Transactions are recorded to permit preparation of financial statements in conformity with GAAP

     · Access to assets is permitted only in accordance with management's authorization

     · Recorded accountability for assets is compared with existing assets at reasonable intervals

 

7.2 FCPA and Internal Controls

The FCPA was the first law to openly hold management accountable for maintaining adequate books, records, and internal accounting controls. It "made it clear that it is illegal for a public company to have an inadequate system of internal control".

 

Key point: A violation of the anti-bribery provision is not required to violate the internal control provision. The accounting provisions are independent.

 

7.3 FCPA vs. SOX — Critical Distinction

 

 FCPA SOX §404

Materiality threshold None — no financial threshold Material weakness threshold

Scope Internal accounting controls (broad) Internal control over financial reporting (ICFR)

Focus Accurate books, management control over assets Detection of material misstatement

 

A $75,000 payment may be immaterial for SOX purposes but still violate FCPA's internal control provision.

 

Compliance guidance: Organizations should review and test controls, and maintain a well-constructed compliance and ethics program to prevent, detect, remediate, and report misconduct.

 

 

8. Sarbanes-Oxley Act (SOX) 2002

8.1 Key Sections for Internal Control

Section 302 — Corporate Responsibility for Financial Reports

· CEO and CFO must personally certify the accuracy of financial statements in quarterly and annual reports

· Must certify they have evaluated the effectiveness of disclosure controls and procedures

· Must disclose all significant deficiencies in internal control

 

Section 404 — Management Assessment of Internal Controls

· Management must assess and report on the effectiveness of internal control over financial reporting (ICFR)

· External auditors must attest to management's assessment

· Section 404(a) requires an internal control report in the annual report

 

8.2 SOX and COSO

SOX §404 effectively mandates the use of a recognized internal control framework. COSO Internal Control – Integrated Framework (2013) is the most widely used framework for SOX compliance in the U.S..

 

8.3 SOX and FCPA Interplay

 

SOX and FCPA compliance are not equivalent:

· SOX compliance ≠ FCPA compliance

· SOX internal auditors focus on financial reporting controls; FCPA compliance requires forensic accounting skills and transaction testing of compliance-sensitive accounts (commissions, gifts, charitable contributions)

· SOX walkthroughs may not reveal anomalies when controls are compromised through collusion; FCPA transaction testing is more likely to detect such issues

 

9. Summary — Key Distinctions for Exam

Concept Key Point

COSO IC (2013) 5 components, 17 principles; reasonable assurance; foundation = Control Environment

COSO ERM (2017) 5 components, 20 principles; expands to strategy and enterprise risk

COBIT 2019 6 governance principles, 7 enablers, 40 objectives across 5 domains

Governance Board owns; sets direction, risk appetite, oversight

Risk management Management owns; identifies, assesses, responds to risks

Internal audit Assures; evaluates adequacy and effectiveness — does not own or operate

ITGCs Pervasive controls (access, change mgmt, operations)

Application controls Input, processing, output — specific to an application

FCPA No materiality threshold; books & records + internal accounting controls

SOX §302 CEO/CFO certification of financials and disclosure controls

SOX §404 Management assessment + auditor attestation of ICFR

 

10. Exam Weightings (for prioritization)

 

CIA Part 1:

 

· Section A (Foundations of Internal Auditing): 35%

· Section C (Governance, Risk Management, and Control): 30% — includes COSO, Three Lines Model, governance, risk, control concepts

· Internal Control & Risk specifically: 25–35%

 

CMA Part 1:

· Internal Controls: 15% — covers COSO IC and ERM frameworks, control activities, limitations, SOX §302/§404, FCPA, IT controls, SOC reports

Questions on Internal control Governance Risk Assessment Control Application

1. Which of the following is NOT one of the three categories of objectives in the COSO internal control framework?

A. Reliability of financial reporting

B. Effectiveness and efficiency of operations

C. Compliance with laws and regulations

D. Maximization of shareholder wealth

Answer: D

 

2. Internal control provides:

A. Absolute assurance

B. Reasonable assurance

C. No assurance

D. Guaranteed assurance

Answer: B

3. Which type of control is designed to detect errors after they occur?

A. Preventive

B. Detective

C. Corrective

D. Directive

Answer: B

4. Segregation of duties is an example of which type of control?

A. Preventive

B. Detective

C. Corrective

D. Directive

Answer: A

5. Which of the following is a limitation of internal control?

A. Human error

B. Collusion

C. Management override

D. All of the above

Answer: D

6. A compensating control is used when:

A. A primary control fails

B. A primary control cannot be implemented

C. Management wants to reduce costs

D. Both A and B

Answer: D

7. Which of the following is NOT a component of the COSO internal control framework?

A. Control environment

B. Risk assessment

C. Control activities

D. Financial reporting

Answer: D

 

8. The "tone at the top" is most closely associated with which COSO component?

A. Control environment

B. Risk assessment

C. Control activities

D. Monitoring

Answer: A

9. Which of the following is a corrective control?

A. Password protection

B. Bank reconciliation

C. Backup restoration

D. Training

Answer: C

10. The primary purpose of internal control is to:

A. Eliminate all risks

B. Ensure achievement of objectives

C. Guarantee profitability

D. Prevent fraud entirely

Answer: B

11  internal control is A process designed to provide reasonable assurance regarding the achievement of objectives in ******* effectiveness, reliable ******, and compliance.

Answer   internal control is A process designed to provide reasonable assurance regarding the achievement of objectives in operational effectiveness, reliable reporting, and compliance.

12 three main types of internal controls? ********,*******, and ******* controls.

Answer: three main types of internal controls? Preventive, detective, and corrective controls.

13 preventive control is  A control designed to ****** errors or fraud before they happen (e.g., segregation of duties).

Answer deter or prevent

14 ******** control is  A control designed to discover errors or fraud after they have occurred (e.g., bank reconciliations).

Answer detective control

15corrective control is  A control that ******* problems discovered by detective controls (e.g., restoring backups or correcting data entry errors).

answer corrective control is  A control that rectifies problems discovered by detective controls (e.g., restoring backups or correcting data entry errors).

16 segregation of duties (SoD) is  Dividing key financial tasks—********,********* and *******—among different people to reduce fraud risks.

answer segregation of duties (SoD)  is Dividing key financial tasks—authorization, recording, and custody—among different people to reduce fraud risks.

17 What does the "custody" function mean in SoD? Having physical possession of or access to ********, such as cash or inventory.

Answer asset

18 What does the "authorization" function mean in SoD? The formal approval required to ******* a financial transaction or business event.

Answer execute

19  What does the "recording" function mean in SoD? Entering  ********** data into the accounting logs, journals, or ledgers.

Answer transaction

20What is reasonable assurance? The concept that controls mitigate risks to an acceptable level, recognizing that ********* certainty is too costly or impossible.

Answer absolute

21What is an inherent limitation of internal control? Management ******, collusion among  *******, human ******, and cost-benefit trade-offs.

Answer What is an inherent limitation of internal control? Management override, collusion among employees, human error, and cost-benefit trade-offs.

22 What is collusion? A secret agreement between two or more people to circumvent ******** and commit ******.

Answer What is collusion? A secret agreement between two or more people to circumvent controls and commit fraud.

23 What is management override? When executives bypass established controls to  ******* financial results or operations.

Answer manipulate

24  What is an IT general control (ITGC)? Controls that apply to all parts of an IT system, such as ******* policies and data center *******.

Answer Controls that apply to all parts of an IT system, such as password policies and data center security.

25 . ******** control is Controls embedded within specific software applications, like validity checks or data entry validation.

Answer application control

26 What are the five components of the COSO cube? Control Environment, *****, ********, Information & Communication, and Monitoring Activities.

Answer Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

27 What is the Control Environment? The foundation component that sets the ethical tone of the organization, often called the "***********."

Answer "tone at the top."

28 What are Control Activities? The specific ******* and ******* that ensure management's directives to mitigate risks are carried out.

Answer policies and procedures

29 What is the Information & Communication component? The system that identifies, captures, and exchanges information to enable people to carry out their ********.

Answer responsibilities

30What are Monitoring Activities? Regular assessments to evaluate whether all five components of internal control are ****** and ******* properly.

Answer Regular assessments to evaluate whether all five components of internal control are present and functioning properly.

31What is the primary focus of COBIT? Providing a comprehensive framework for Enterprise Governance of *******and  ********

Answer Providing a comprehensive framework for Enterprise Governance of Information and Technology (EGIT)

32 What is the difference between COSO and COBIT? COSO focuses on overall corporate ****** and ************, while COBIT focuses specifically on IT ********* and management.

Answer COSO focuses on overall corporate financial and internal controls, while COBIT focuses specifically on IT governance and management.

33 What are the two main domains dividing COBIT objectives? ***** objectives and ******* objectives.

Answer two main domains dividing COBIT objectives? Governance objectives and Management objectives.

34 What are the EDM domains in COBIT governance? Evaluate, *****, and Monitor.

Answer EDM domains in COBIT governance? Evaluate, Direct, and Monitor.

35 . What are the four management domains in COBIT? APO=****, Plan, Organize, BAI=****, Acquire, Implement, DSS=******, Service, Support, and MEA =*****, Evaluate, Assess.

Answer What are the four management domains in COBIT? APO (Align, Plan, Organize), BAI (Build, Acquire, Implement), DSS (Deliver, Service, Support), and MEA (Monitor, Evaluate, Assess).

36  ******* is  The system of rules, practices, and processes by which a firm is directed, controlled, and balanced among stakeholders.

Answer corporate governance

37 Who bears ultimate responsibility for corporate governance? *********.

Answer ultimate responsibility for corporate governance? The Board of Directors.

38What is the main role of the Audit Committee? To ******** the financial reporting process, internal controls, and the work of independent auditors.

Answer oversee

39 What is IT governance? A subset of corporate governance focused on ****** IT strategy with overall business goals to maximize value and manage IT risks.

Answer aligning

40 What is the "tone at the top"? The ****** atmosphere and commitment to compliance created by an organization’s leadership and executive board.

Answer ethical

41What is risk assessment? The process of identifying, analyzing, and evaluating ***** risks that could ****** an organization from achieving its goals.

Answer What is risk assessment? The process of identifying, analyzing, and evaluating potential risks that could prevent an organization from achieving its goals.

42 What is inherent risk? The raw risk exposure an organization faces in the absolute ******* of any management control actions.

Answer absence

43 What is residual risk? The remaining risk exposure that stands after internal controls and risk responses have been ********

Answer implemented.

44  ********* risk is  The risk that a misstatement or error will not be prevented, detected, or corrected by internal controls on a timely basis.

Answer control risk

45 What is the formula for Audit Risk? Audit Risk = ****** Risk × Control Risk × ******* Risk.

Answer Audit Risk = Inherent Risk × Control Risk × Detection Risk.

46 ********  is  The broad amount of risk an organization is willing to accept or pursue in order to achieve its strategic value goals.

Answer risk appetite

47 *******  is The specific, measurable variation or boundaries an organization can accept around individual objectives.

Answer risk tolerance

48 What are the four primary risk response strategies? Avoid, Accept, Reduce  or **** , and Share or*****

Answer four primary risk response strategies? Avoid, Accept, Reduce (Mitigate), and Share (Transfer)

49 example of *** ****** is  Implementing a strict software validation rule to prevent typos and double-billing errors.

Answer example of risk reduction

50 example of ********* is   Purchasing an insurance policy or outsourcing operations to a third-party vendor

Answer example of risk sharing or transfer

51 example of *******  is  Exiting a highly volatile market or stopping a product line completely to eliminate the associated dangers.

Answer example of risk avoidance

52  Risk ***** is  A dynamic log used to identify, document, track, and score all risks across an organization.

Answer Risk Register

53 two axes of a standard risk matrix are ****** or Probability  and  ****** or Severity.

Answer two axes of a standard risk matrix are Likelihood (Probability) and Impact (Severity).

54 six basic components of an AIS are  People, Procedures, Data, Software, IT Infrastructure, and ******.

answer six basic components of an AIS are  People, Procedures, Data, Software, IT Infrastructure, and Internal Controls.

55 *************** system   is A centralized, modular software system that integrates all core business processes, including finance, HR, and supply chain.

Answer Enterprise Resource Planning (ERP) system

56   ****** is  The accuracy, completeness, consistency, and trustworthiness of data throughout its entire lifecycle

Answer data integrity

57 *********  is  A step-by-step chronological record providing evidence of the path financial data takes from its source origin to the final ledger.

Answer audit trail

58 ******** is  The original paper or digital record capturing the initial details of a business transaction (e.g., invoices, receipts).

Answer source document

59 XBRL  is  eXtensible Business Reporting Language; a standardized digital language used globally for exchanging business and financial *****.

Answer business and financial reports

60 **********document is  A computer-generated output sent to an external party, who adds data to it and returns it to the system as a new input.

Answer turnaround document

61  ***** control in an AIS  is Controls designed to ensure that data entered into the system is accurate, complete, and valid (e.g., field checks).

Answer input control

62 processing control in an AIS is  Controls ensuring that data is calculated correctly and processed without *****,e.g., run-to-run totals.

Answer omission

63 output control in an AIS is  Controls ensuring that the ***** of processing are accurate, complete, and securely distributed to authorized users.

Answer results

64**********  is  An input control that compares data against a master file database to ensure its legitimacy (e.g., checking if a customer ID exists)

Answer validity check

65********  is  An input control testing numerical data against a fixed upper or lower boundary value.

Answer limit check

66  primary purpose of the FCPA is  To prohibit US companies and individuals from ****** foreign government officials to secure or retain business.

Answer bribing

67  "facilitating payment" under the FCPA is  Small grease payments made to ****** routine, non-discretionary government actions (e.g., processing a visa).

Answer expedite

68 . Sarbanes-Oxley Act passed? In 2002, following major accounting scandals like Enron and WorldCom., primary goal of SOX  is  To protect investors by improving the *****,****** and ******* of corporate financial disclosures.

answer primary goal of SOX is  To protect investors by improving the accuracy, transparency, and reliability of corporate financial disclosures.

69 PCAOB is  Public Company Accounting Oversight Board; the non-profit corporation created by ****** to oversee public accounting audits.

Answer SOX

70 SOX Section 302 requirement is : CEOs and CFOs must personally ***** (submit/certify) the accuracy and completeness of the quarterly and annual financial reports.

Answer certify

71 SOX Section 404(a) requirement is : Management must issue an annual report assessing the ******* of the company’s internal control over financial reporting (ICFR).

Answer effectiveness

72 SOX Section 404(b) requirement is : Independent auditors must ***** to and report on management's assessment of internal controls for accelerated filers.

Answer attest

73  Internal Control over Financial Reporting (ICFR) is : A process designed to provide reasonable assurance regarding the ****** of financial statements in accordance with GAAP.

Answer reliability

74 protection does SOX offer to ********* is : Section 806 outlaws retaliation against employees who report suspected corporate fraud or violations of SEC rules.

Answer whistleblowers

75 . material weakness is : A deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material ******** will not be prevented or detected.

Answer material misstatement

76 ********** deficiency is : A control deficiency less severe than a material weakness, yet important enough to merit attention by those charged with governance

Answer significant deficiency

77 How do COSO and SOX integrate? COSO is the most common framework adopted by public companies to meet the ******* requirements of SOX Section 404.

Answer compliance requirements

78 How do COBIT and SOX integrate? COBIT provides the framework to test and justify the IT ******* controls (ITGCs) supporting ****** reporting systems under SOX.

Answer How do COBIT and SOX integrate? COBIT provides the framework to test and justify the IT general controls (ITGCs) supporting financial reporting systems under SOX.

79 Why is an AIS critical for SOX compliance? It automates and tracks transactional logs, generating the explicit audit trail needed for internal control ********.

Answer internal control verifications/assessment

80 How does risk assessment drive the scope of a SOX audit? It forces auditors and management to focus testing only on accounts and systems that have a high likelihood of **********

Answer material misstatement

Case-based questions and answers provide an effective framework for understanding real-world corporate vulnerabilities, evaluation processes, and mitigation strategies.

Scenario:
Apex Cleaning Services recently won a major contract to provide general office cleaning for a sprawling, multi-story corporate headquarters. The contract requires cleaning crews to operate during regular business hours (when corporate staff are present) as well as overnight shifts. The cleaning duties involve using industrial chemical solutions, handling heavy floor-buffing machinery, and working at heights to clean glass partitions. The team includes employees of various demographics, including three night-shift workers under the age of 18.

Questions & Detailed Answers

Q1. Outline the steps the manager must take to complete a formal Risk Assessment for this new contract.

• Answer: The manager must follow a systematic 5-step risk assessment framework:

1.    Identify the Hazards: Perform a thorough walkthrough of the corporate headquarters to spot anything that could cause harm (e.g., wet floors, chemical exposures, heavy machinery, high glass panes).

2.    Determine Who Might Be Harmed and How: Identify specific groups at risk. In this scenario, this includes regular office workers (slips/trips), the cleaning staff themselves, and high-risk individuals like the workers under 18 who may lack industry experience.

3.    Evaluate the Risks and Decide on Controls: Estimate the likelihood and severity of injuries occurring from untreated hazards (inherent risk). Implement controls to lower this risk to an acceptable level (residual risk).

4.    Record the Findings: Document the identified hazards, the individuals at risk, and the action plans in the company's official risk register.

5.    Review and Update: Periodically reassess the environment—especially if new cleaning equipment is introduced or office layouts change.

Q2. The manager must consult with internal "health and safety representatives" regarding the risks. Why is this consultation critical, particularly for the underage staff?

Answer: Consultation is vital because health and safety representatives provide legal, regulatory, and practical expertise on protective measures. Workers under 18 are legally classified as a vulnerable demographic due to a potential lack of risk awareness, physical maturity, and experience. The representatives ensure that the risk assessment strictly complies with local labour laws, which might restrict minors from operating heavy industrial buffer machinery or handling highly toxic chemical solvents during overnight shifts.

 

Scenario2:
XYZ Textiles Ltd. is an enterprise that sources raw cotton internationally and manufactures apparel in India. Due to sudden geopolitical tensions, shipping lanes in their primary sourcing region have been heavily disrupted, resulting in a 40% surge in raw material transit costs. Concurrently, a rival firm has launched a highly aggressive automated digital marketing campaign, eroding XYZ's domestic market share by 5% over one quarter. The Audit Committee has been tasked by the Board to evaluate their risk posture.

Questions & Detailed Answers

XYZ Textiles Ltd. Risk Profiling Matrix

+--------------------+----------------------------+--------------------------------------------+

 

| Risk Type          | Primary Vulnerability      | Mitigation Strategy                        |

+--------------------+----------------------------+--------------------------------------------+

 

| Economic / Supply  | Raw material price spikes  | Backward integration & long-term hedging   |

| Competitor         | Domestic market erosion    | Brand differentiation & R&D investments    |

+--------------------+----------------------------+--------------------------------------------+

Q1. What details should the Chief Risk Officer (CRO) present to the Board regarding the "Economic and Supply Chain Risk" affecting the company?

• Answer: The CRO must present a clear diagnostic of how macroeconomic forces are pressuring profit margins. The report should highlight:
• The Root Cause: Geopolitical maritime disruptions creating supply lag and driving up raw cotton costs.
• The Direct Impact: Margin compression on final sales if cost increases are absorbed, or decreased volume if costs are passed onto customers.
• The Mitigation Action: The company must explore backward integration (e.g., developing localized supply networks or purchasing raw material farms), entering into long-term fixed-price supply contracts to neutralize volatility, and tightening internal cost controls.

Q2. Distinguish between "Inherent Risk" and "Residual Risk" using the competitor risk faced by XYZ Textiles.

• Answer:
• Inherent Risk: This is the natural level of risk exposure before any protective measures or management actions are taken. For XYZ Textiles, the inherent risk is the unmitigated 5% loss of domestic market share and potential brand irrelevance driven by the competitor's aggressive digital campaign.
• Residual Risk: This is the remaining level of risk that exists after management applies structural controls and mitigation strategies. For example, if XYZ responds by investing heavily in R&D, improving product quality, and deploying their own targeted brand campaigns, the residual risk might be reduced to a minor, manageable 1% market variance.

Case Study 3: IT Security & Vendor (Third-Party) Risk Management

Scenario:
Right Place Right Time Solutions is a medium-sized IT services provider. Over the past year, their enterprise clients have demanded strict adherence to global information security standards. To win a massive banking client, the company must outsource its data hosting to a third-party cloud infrastructure vendor. However, a recent preliminary audit reveals that the cloud vendor occasionally subcontracts its server maintenance to a fourth-party technical firm based overseas. The company's new CISO must implement a comprehensive risk management program.

Questions & Detailed Answers

Q1. What is the fundamental difference between an "IT Risk" and an "IT Issue" in the context of this data hosting transition?

• Answer:
• An IT Risk is a uncertain, future event that has not yet occurred but would negatively impact objectives if it did. In this case, the possibility that the overseas fourth-party subcontractor might experience a data breach due to relaxed access privileges is a risk.
• An IT Issue is a problem that has already manifested and is currently impacting the business. If the third-party server goes offline for three hours today, disrupting client portals, it is an issue that requires immediate incident response rather than proactive risk planning.

Q2. Outline a robust Third-Party Risk Management framework the CISO can deploy to safeguard customer data against fourth- and fifth-party exposures.

• Answer: The CISO should implement a lifecycle framework comprised of these critical stages:

1.    Strict Due Diligence: Evaluate the primary cloud vendor's security protocols, background checks, and historical compliance records before signing.

2.    Service Level Agreements (SLAs) with Concentrated Clauses: Mandate legally binding contracts that explicitly restrict the vendor's right to outsource data access to fourth parties without prior written consent and formal security vetting.

3.    Continuous Monitoring & Continuous Auditing: Utilize automated threat intelligence tools to monitor the vendor's security perimeter and require yearly independent security certificates (e.g., SOC 2 Type II reports).

4.    Offboarding & Incident Reaction Planning: Define concrete protocols for data retrieval, secure destruction, and contract termination in the event that the vendor fails to uphold security mandates.

---