Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IRM > Assurance > Flashcards

Assurance Flashcards

1
Q

Hopkin and Thomson 5 sources of internal assurance

A

Culture measurement
Unit documentation
Unit performance
Unit reports
Audit reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ToR of AC defined by the Corporate Governance Institute

A

Financial reporting
Narrative reporting
IC and RM systems
Internal audit
External audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Materiality

A

Risk is material if it can impact bottom line or
With holding info can influence investor decision making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Viability assessment requirement

A

1.UK Corp Gov. Disclosure on long term viability
2. Going concern - 12 months required by accounting standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control environment in risk management

A

Control activities, how effective they are, audit and risk assurance. Whole range of controls and interaction of controls to mitigate risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

FRC internal control system

A

1.encompasses policies, processes, tasks , behaviors
2. Effective and efficient operations by assessing risks , respond to risks, controls
3. Help reduce poor judgement , errors
3. Improve quality of reporting
4. Improve compliance with laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

FRC internal control system includes

A

Control activities
Information and communication
Monitoring of controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are controls - Hopkin and Thomson

A

Three definitions
1. Criteria of control - all elements of am organisation’s thay taken together, support achievement of objectives. Resources, systems, processes culture, structure and tasks

  1. CoSo - a process effected by board, management , designed to provide reasonable assurance regarding achievement of objectives
    Effectiveness and efficacy of operations
    Compliance with laws
    Reliability on financial reporting
  2. IIA - a set of process functions activities systems and people who together ensure achievement of objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

LILAC model to risk culture

A

Leadership
Involvement
Learning
Accountability
Communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IRM model to risk culture

A

ABC
Attitude
Behaviors
Culture
Attitude determines behaviors, repeated behavior sets culture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO definition

A

Effect of uncertainty on objectives . Effect can be positive or negative

Coordinated activities to direct and control an organization with regard to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IRM definition of risk

A

Combination of probability of an event and its consequences. Can be positive to negative

RM - process which helps org understand , evaluate and take action on risks with a view to increasing probability of success and reducing likelihood of failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

COSO definition of risk

A

Possibility that an event will occur and affect achievement of objectives. Positive and negativr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Orange book definition

A

Similar to COSO. Effect of uncertainty on objective. Usually has cause event and consequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Objectives of risk management

A

MADE2
Mandatory
Assurance
Decision making
Effective
Efficient processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

ISO principles of RM

A

PACED
Proportionate
Aligned
Comprehensive
Embedded
Dynamic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk management will help improve 4 areas STOC

A

Strategy
Tactics
Operations
Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

4 types of risks

A
  1. Compliance - minimize
  2. Control risks - manage- associated with new projects. Unknown and unexpected events. Also called uncertainty risk.
  3. Hazard risks - mitigate - associated with potential harm or a situation to undermine objectives .
  4. Opportunity risk - embrace
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Bow tie analysis

A
  1. Left side is source of hazard.indicates the risk classification used. High level sources are STOC
  2. Right side impact - FIRM
  3. Centre is categories of disruption that can happen- people , premise, provess and products

First step is to put risk description in the middle.then identify cause and impact.

Preventative and response controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

4Ts of hazard risk

A

Tolerate -low low- detect control
Transfer High impact - directive control
Treat High likelihood- corrective control
Terminate High high - preventive control

BCP and DRP are both corrective and directive. Or even a fifth type, can’t easily fit to PCDD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

4Es of opportunity risks

A

Exploit - high reward
Explore - High risk
Expand/Exit- high reward high risk
Exist - low low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Sophistication level in risk management

A
  1. Inform - compliance mgmt. Unaware of obligations
  2. Reform - hazard . Aware of non compliance
    3.conform - control mgmt. Actions to ensure compliance
  3. Perform - opportunity mgmt.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Difference between standard and framework

A

Standard includes rm process and framework.
Framework includes structure, responsibilities administration, reporting and communication components of rm. Framework supports implementation of process.

Process includes risk assessment identification , analysis, evaluation, treatment and recording and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Scope of risk management framework

A

RASP
Risk architecture, strategy , protocol
Architecture- roles , responsibilities, reporting structure
Strategy - risk strategy, appetite, attitude and philosophy
Protocols - rules and procedures , methodologies, tools and techniques. Need to be reviewed annual basis.range of documentation required. Ridk assessment procedures, control objectives, resourcing arrangement, reaction planning requirement (BCP) , risk assurance system(ToR for AC, CSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

COSO cube

A

Objectives to achieve- strategic, operations, reporting, compliance
RM process - 8 steps.
Internal environment
Objective setting
Event identification
Risk assessment
Risk response
Control activities
Info and communication
Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

COSO rainbow double helix

A

ERM has to be embedded into activities of the organisation starting from mission, vision and values.
Strategy development
Business objectives
Implementation and performance
Enhanced value

5 principles/components
1. Governance and culture
2. Strategy and objective setting
3. Performa ce
4. Review and revision
5. Information communication and reporting

27
Q

Double S model to risk culture

A

Soliditary
Sociability
Network - high social low soliditary
Communal - high social high soliditary
Fragmented - low social low soliditary
Mercenary - low social high soliditary

28
Q

Components of context

A

External
Internal
Risk management context- includes RASP( including establishment of risk appetite or crtiera) and, Risk process itself.

29
Q

Risk classification system PESTLE

A

Political
Economic
Social
Technological
Legal
Ethical or environmental

Used for external risks. Has to be combined with SWOT.

30
Q

How to evaluate the context for risk management

A

Using FIRM scorecard and developing a riskiest index
Financial and infrastructure for internal context
Marketplace and reputation for external context

31
Q

Risk register

A
  1. Includes all risks and means to identify based on scoring
  2. Three components- data collection, database, data communication
  3. Three functions - collecting risk info, establish trends and relationships between risks
  4. Communicate and escalate
32
Q

Implementing ERM PIML

A

Plan - identify benefits, scope, strategy
Implement - risk appetite setting, establish benchmarks, agree assessment tools
Measure - evaluate control effectiveness, align risk management with other activities, embed risk aware culture
Learn - monitor risk , ERM performance and reporting

33
Q

Implementing ERM PIML

A

Plan - identify benefits, scope, strategy
Implement - risk appetite setting, establish benchmarks, agree assessment tools
Measure - evaluate control effectiveness, align risk management with other activities, embed risk aware culture
Learn - monitor risk , ERM performance and reporting

34
Q

Resilience

A

Definition - capacity if an organization to consistently achieve a desired state following a change in circumstances.
3 behaviors to achieve resilience
1. Awareness of changes
2. Prevent, protect, prepare in relation to all types of resources
3. Respond, recover and review in relation to disruptive events.

35
Q

Risk assessment in ISO

A

Includes risk identification,
analysis - impact likelihood score
and evaluation - ranking against risk appetite or criteria

36
Q

Risk assessment techniques

A

Questionnaire and checklists
Workshops and brainstorming - PESTLE, SWOT. Quantitative analysis - HAZOP, FMEA
Inspection and audit
Flow chart and dependency analysis
Crowdsourcing technology- using mobile applications to upload risks on a data platform

37
Q

Risk attitude vs appetite

A

Attitude concerned with criteria surrounding a risk
Appetite is amount of risk we are willing to take

38
Q

Risk classification by standard

A

FIRM
COSO - strategic ,operational, reporting , compliance
IRM - financial, strategic, operational, hazard
Orange book- several

39
Q

Principles of risk appetite

A

Acknowledging interconnectedness - what’s acceptable in one of business not accepted in another
Messursbility
Variability - different for different risks
Maturity - how adept organisation is at managing risk will have a bearing on risk appetite

40
Q

Controlling downside risks

A

Loss prevention - reducing likelihood.
Damage limitation - once evebt occurred. E.g fire sprinklers.
Cost containment- after damage limitation. Actions to minimize post incident cost, should be set out in BcP, DRP.

41
Q

Risk zones 4Cs

A

Comfort - tolerate
Cautious - treat
Concerned - transfer
Critical - terminate

42
Q

Types of controls

A

Preventative
Directive- first response once risk occurred
Detective - easy to administer and provide early warning
Corrective controls

43
Q

Definition of control

A
  1. Criteria of control - all elements of an organisation that , taken together, support people in achievement of org. Objectives. Elements include resources, systems , processes, culture, structure and tasks
  2. COSO - a process, effected by BoD , mgmt and other personnel , designed to provide reasonable assurance regarding the achievement of objectives in the below categories
    Effectiveness and efficiency of operations
    Reliability of financial reporting
    Compliance with laws
  3. IIA - set of process, functions activities, systems and people grouped together or consciously segregated to ensure effective achievement of goals and objectives
44
Q

Components of CoCo framework

A

A continous cycle. Useful to benchmark compliance with internal control component of COSO.
1. Purpose
2. Commitment
3. Capability
4. Monitoring and learning

45
Q

Control environment

A

FRC states IC system includes
1. Control activities
2. Information and communication processes
3. Monitoring the effectiveness

Control different to data collection and guidance. Should change cause or effect of risk

46
Q

Terms of Reference for AC

A

Financial reporting
Narrative reporting.
IC and RM
IA
External audit - conduct tender, review independence, non audit services, effectiveness of audit

47
Q

Sources of risk assurance

A

Culture measurement
Unit report
Unit performance
Unit documentation
Audit report

Control self assessment

KRIs

48
Q

Internal Audit

A

IIA- IA is concerned with evaluating an organizations management of risk.
Central to effective risk framework is audit through
I. Assurance map - structured means or identifying and mapping source and types of assurance across 4(3) LoD. Risk and control owner, risk oversight, risk assurance.
II. Statistical saying
III. Risk prioritization techniques

49
Q

Corporate governance- FRC

A

principles and provisions + guidance
5 sections - leadership ; division of responsibility ; composition ,succession and evaluation ; audit , risk and internal controls ; remuneration

Board should establish procedures to manage risk, oversee IC framework and determine nature and extent of principal risks the company is willing to assume.

Principal risks - events or circumstances that can threaten companies business model, future performance, solvency, liquidity and reputation.

50
Q

Board structures

A

Unitary - executive plus non executive directors in one board
Two tier- supervision and management of operations

51
Q

Types of corporate governance code

A

Want - principle based . Comply or explain
Compulsory - prescriptive. Comply and sign

52
Q

Committees of board by UK FRC

A

Nomination
Remuneration
Audit

53
Q

What is risk culture

A
  1. H&T - reflects attitude of every component of mgmt. How individuals behave in certain circumstances
  2. IRM - Values beliefs knowledge and understanding about risks. Can be reinforced through positive actions and behaviors
  3. COSO - culture, capacities and practices , integrated with strategy setting and execution thay organizations rely on to manage risk in creating preserving and realizing value
54
Q

IRM risk culture framework

A

Risk culture
Organization culture
Behaviors
Personal ethics
Personal predisposition to risk/risk preference

55
Q

Risk perceptions

A

Different perceptions imply risks might be missed, irrelevant risks might be captured, manage same risks inconsistently, managing stakeholder perceptions of risk rather than real risk

56
Q

Bias

A

Bias influenced by
1. Conscious factors- org culture, familiarity, manageability, size of impact
2. Sub conscious - availability, representativeness , anchoring and adjustment, confirmation trap, bandwagon
3. Affective factors (feeling)

57
Q

Understanding and improving risk culture

A
  1. Deloitte - 4 influences- risk competence, motivation, relationship , organization
  2. LILAC
  3. IRM ABC MODEL
  4. DOUBLE S - sociability, solidarity
58
Q

ABC model

A

Attitude- chosen position towards risk, influenced by perception
Behavior- external observable actions
Cture - values beliefs knowledge and understanding about risk

59
Q

What is successful risk culture

A

Deloitte
1. High level of understanding
2. Positive attitude
3. Move from reacting to active engagement and management of events

IRM
10 point component. Split between tone at the top - leadership, dealing with bad news
governance - clarity, transparency
competency - risk skill, risk resources
decisions - informed, reward

60
Q

How to change risk culture

A
  1. Evaluate current risk culture
  2. Assess impact of current risk culture
  3. Identify areas of improvement
  4. Plan and implement change
    5 Monitor and adapt to change
    To become compliant - 1 to 2 years
    Maturity - 5 to 10 years
61
Q

4 step process - easy SATARLA

A

Define context and objectives
Assess risks
Manage risks
Monitor , review and report

62
Q

Extended enterprise for understanding context by IRM

A

A structure where number of organisations come together. 4 steps to understand.
1. Core processes
2. Inputs to the process
3. Output
4. External influence

63
Q

Stakeholder mapping - Mendelow matrix

A

Understand influence and interest in an activity
High influence , low interest - keep satisfied
High interest, high influence - actively engage and manage
High interest, low influence - keep informed
Low low - miminal effort

IRM (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions