Domain II - Nature of work

Question 1

Who is responsible for assessing the risks and controls within their organisation?

Answer 1

All internal auditors have a responsibility to assess the risks and controls within their organisations.

Question 2

Which standard?

The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes.

Answer 2

Standard 2120 Risk Management

Question 3

_______ internal auditing provides organisations with timely, relevant information about the risks they face.

Answer 3

Risk-based internal auditing provides organisations with timely, relevant information about the risks they face.

Question 4

When organisations decided on how to approach risks, what are their options?

Answer 4

They can then decide whether the risk is one to mitigate or avoid – or one to exploit.

Question 5

Explain what this term means?

Risk

Answer 5

The possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood.

Question 6

Explain what this term means?

Risk management

Answer 6

A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organisation’s objectives.

Question 7

Explain what this term means?

Risk appetite

Answer 7

The level of risk that an organisation is willing to accept.

Question 8

Explain what this term means?

Risk responses

Answer 8

The means by which an organisation elects to manage individual risks.

Question 9

Explain what this term means?

Risk assessment

Answer 9

The overall process of of risk identification, risk analysis and risk evaluation.

Question 10

Explain what this term means?

Risk identification

Answer 10

The process of determining which events might occur to affect the objectives of the organisation and their root causes.

Question 11

Explain what this term means?

Risk analysis

Answer 11

The systematic use of available information to determine the likelihood of specified events occurring and the magnitude of their consequences ie their impact.

Question 12

Explain what this term means?

Risk evaluation

Answer 12

The process used to determine risk management priorities by comparing the level of risk against predetermined standards, target risk levels or other criteria.

Question 13

Explain what this term means?

Inherent (gross) risk

Answer 13

Evaluation of risk before management undertakes any action or initiates any risk responses.

Question 14

Explain what this term means?

Retained (net) risk

Answer 14

The evaluation of risk after management action and risk responses.

Question 15

Name different types of risks.

Answer 15

main categories: financial, reputational and regulatory

but also strategic and operational, physically risky activities (health and safety)

Question 16

When can internal auditors provide the greatest value in terms of risks?

Answer 16

When they communicate clearly both the downsides and upsides to risk. Without this information, no organisation will thrive.

Question 17

There’s a range of standards and frameworks organisations can use in developing risk management processes. Describe the generic process.

Answer 17

Set objectives
Identify risks
Analyse
Appetite?
Determine response
Monitor and report
Learning lessons
(Start at the top)

Question 18

Why is setting objectives important to the risk management process?

Answer 18

Risks can only be identified, assessed and prioritised in relation to objectives.

Question 19

What can objectives be like in terms of the risk management process?

Answer 19

These objectives can be long term, high level and strategic in nature, and apply to the whole organisation; or they may be short term and operational, and apply to business units, teams, and business processes.

Question 20

Mention 6 different risk identification tools

Answer 20

1) Questionnaires and surveys
2) Process flow analysis
3) Workshops and interviews
4) Scenario planning
5) External and internal environmental analysis
6) Event inventories

Question 21

For an organisation to manage risks, what does it need to know first?

Answer 21

The risks it faces.

Question 22

What has all risks identified by management that may impact achievement of the organisation’s objectives?

Answer 22

The risk register

Question 23

What do you need to consider when identifying risks?

Answer 23

The organisation’s environment, strategy and attitude to risk.

Question 24

What is the risk if the organisation’s environment, strategy and attitude to risk are not considered while identifying risks.

Answer 24

Risk identification becomes nothing more than a random generation of unpleasant consequences and missed opportunities, most of which may well be irrelevant to the organisation.

Question 25

When identifying risks, what does the organisation’s environment include? Think macro and micro.

Answer 25

the macro - the external influences on the organisation (think political, economic, social, technological, legal and environmental) - and the micro - the more immediate, internal elements of the organisation (think McKinsey 7S model).

Question 26

What does the organisation’s attitude to risk determine?

Answer 26

Whether it recognises any given risk and what risk management strategy it adopts to deal with the potential obstacle to meeting its objectives.

Question 27

After risks are identified, what is the next step?

Answer 27

Analysing the risks.

Question 28

When risks are analysed, what are the two factors that are determined during the analysis?

Answer 28

The probability (or likelihood of occurrence)
&
The consequences (or the impacts on business)

Question 29

What is a reliable way of assessing the probability and consequences of a risk?

Answer 29

This can be one of the most difficult areas to address as there is often no way of reliably assessing these factors.

Question 30

Mention some ways of analysing risks.

Answer 30

Tools such as root causes analysis can support this analysis.

Other tools and methods include:

quantitative eg benchmarking and modelling
qualitative eg interviews and workshops
hybrid – a mix of both qualitative and quantitative approaches.

The results can be plotted in a heat map or risk matrix as illustrated in the figure. In our simple example, using RAG ratings, no arithmetic values have been applied to each risk. In some organisations, risks are quantified.

Question 31

Who should set the risk appetite?

Answer 31

The board should set the risk appetite.

Question 32

Why is setting a risk appetite important?

Answer 32

so that decisions about the response to risk are weighed against agreed criteria as to what is tolerable.

Question 33

How is analysing and evaluating risks different?

Answer 33

Once an analysis of likelihood and impact has been completed, it should then be possible to evaluate the risks against the organisation’s risk appetite to determine what action it will take.

Question 34

What is a risk before management action called?

Answer 34

Inherent or gross risk.

Question 35

What is a risk after management action called?

Answer 35

Residual, retained or net risk.

Question 36

What is the difference between inherent and residual risk?

Answer 36

The difference between inherent and residual risk is the measure of the effectiveness of the risk management responses and activities (including internal controls).

Question 37

What is the difference between gross and net risk?

Answer 37

The difference between inherent and residual risk is the measure of the effectiveness of the risk management responses and activities (including internal controls).

Question 38

What is the difference between inherent and retained risk?

Answer 38

The difference between inherent and residual risk is the measure of the effectiveness of the risk management responses and activities (including internal controls).

Question 39

How do you determine response to a risk?

Answer 39

Risk responses should be evaluated to ensure they do in fact manage the risks down to the level required.

The remaining ‘residual’ risk should be assessed. It should be in line with the target residual risk. If it is reasonable, no further action is required. If it is still excessive, the organisation needs to consider what further responses it will put in place (or not).

Question 40

Name the different risk response styles.

Answer 40

Accept
Avoid
Pursue
Reduce (requires controls)
Share

Question 41

Why should risks be monitored?

Answer 41

• to assess whether or not the risks are changing
• to provide assurance that risk management is effective
• to identify when further action is necessary.

Although directors, managers and other staff may have identified their risks and described how they are using controls or other means to respond to them, the board cannot be sure that the risk responses are working unless they monitor them.

Question 42

What does an effective risk management system ensure?

Answer 42

that monitoring and reporting mechanisms form part of the organisation’s routine processes.

Question 43

What does a risk register usually detail?

Answer 43

the risk and description of the risk

gross risk analysis

details of risk responses applied

subsequent net risk assessment

conclusion on whether level of net risk level is acceptable

information on more action to be taken

what monitoring controls are to be applied

risk owner allocated

risk action manager allocated

review date.

Question 44

Explain the 3 lines of defence and their role in risk management.

Answer 44

First-line roles are those most directly focused on providing the client with products and/or services, and include the roles of support functions such as human resources, administration, IT and building services. First-line roles are responsible for managing risk.

Second-line roles centre on specific aspects of risk management, including compliance with ethical, legal and regulatory requirements, quality assurance, IT security and broader responsibilities such as enterprise risk management. Those in second-line roles often challenge those in the first line, as well as offering expertise, scrutiny and oversight.

Third-line roles, such as internal audit, are unique in being independent of management and its responsibilities. This independence enables internal audit to provide objective assurance and advice. It is impossible to be both independent of management and to assume management responsibilities (ie first and second line roles). Where internal audit has first or second line roles, independent assurance of these activities must be drawn from other sources.

Above all of this is the governing body whose roles are integrity, leadership and transparency but most of all accountability to stakeholders for organisational oversight.

Question 45

Mention 5 key roles of the governing body in the 3 lines of defence model.

Answer 45

Accepts accountability to stakeholders for oversight of the organisation.

Engages with stakeholders to monitor their interests and communicate transparently on the achievement of objectives.

Nurtures a culture promoting ethical behavior and accountability.

Establishes structures and processes for governance, including auxiliary committees as required.

Delegates responsibility and provides resources to management for achieving the objectives of the organisation.

Determines organisational appetite for risk and exercises oversight of risk management (including internal control).

Maintains oversight of compliance with legal, regulatory, and ethical expectations.

Establishes and oversees an independent, objective, and competent internal audit function.

Question 46

Mention key roles of the management in first line in the 3 lines of defence model.

Answer 46

Leads and directs actions (including managing risk) and application of resources to achieve the objectives of the organisation.

Maintains a continuous dialogue with the governing body, and reports on planned, actual, and expected outcomes linked to the objectives of the organisation, and risk.

Establishes and maintains appropriate structures and processes for the management of operations and risk (including internal control).

Ensures compliance with legal, regulatory, and ethical expectations.

Question 47

Mention key roles of the management in second line in the 3 lines of defence model.

Answer 47

Provides complementary expertise, support, monitoring, and challenge related to the management of risk, including:

• the development, implementation, and continuous improvement of risk management practices (including internal control) at a process, systems, and entity level
• the achievement of risk management objectives, such as: compliance with laws, regulations, and acceptable ethical behavior; internal control; information and technology security; sustainability; and quality assurance.

Provides analysis and reports on the adequacy and effectiveness of risk management (including internal control).

Question 48

Mention key roles of the 3rd line in the 3 lines of defence model.

Answer 48

Maintains primary accountability to the governing body and independence from the responsibilities of management.

Communicates independent and objective assurance and advice to management and the governing body on the adequacy and effectiveness of governance and risk management (including internal control) to support the achievement of organisational objectives and to promote and facilitate continuous improvement.

Reports impairments to independence and objectivity to the governing body and implements safeguards as required.

Question 49

Mention key roles of the external assurance providers in the 3 lines of defence model.

Answer 49

legislative and regulatory expectations that serve to protect the interests of stakeholders

requests by management and the governing body to complement internal sources of assurance.

Question 50

True or false?

Risk is the possibility of an event occurring that threatens the achievement of objectives.

Answer 50

False.

Risk is possibility of an event occurring that will have an impact on the achievement of objectives. This impact can be a threat but it can also be an opportunity. The latter is often referred to as ‘upside risk.’

Question 51

What term is defined as ‘the process used to determine risk management priorities by comparing the level of risk against predetermined standards, target risk levels or other criteria’?

Answer 51

Risk evaluation

Question 52

What term is used to describe a risk that does not take into account any response that the organisation may put in place?

Answer 52

Gross or inherent risk

Question 53

Which line of defence is HR?

Answer 53

1st line

Question 54

Which line of defence is Compliance?

Answer 54

2nd line

Question 55

Which line of defence is Internal Audit?

Answer 55

3rd line

Question 56

Mention 2 popular frameworks used for risk management.

Answer 56

COSO Enterprise Risk Management - Integrating with Strategy and Performance,

and

the ISO standard 31000:2018.

Question 57

What are the 5 components set out by COSO?

Answer 57

Governance and culture
Strategy and objective-setting
Performance
Review and revision
Information, communication and reporting

Question 58

Explain what Governance and culture is about according to COSO framework.

Answer 58

About: The organisation’s tone, reinforcing the importance of, and establishing oversight responsibilities for risk management. Culture pertains to ethical values, desired values, and the understanding of organisational risks.

Principles:

1. Exercises board risk oversight
2. Establishes operating structures
3. Defines desired culture
4. Demonstrates commitment to core values
5. Attracts, develops, and retains capable individuals

Question 59

Explain what Strategy and objective-setting is about according to COSO framework.

Answer 59

About: Setting the organisational strategy, plan and risk appetite. A risk appetite is established and aligned with strategy; business objectives put strategy into practice while serving as a basis for identifying, assessing, and responding to risk.

Principles:

6. Analyses business context
7. Defines risk appetite
8. Evaluates alternative strategies
9. Formulates business objectives

Question 60

Explain what Performance is about according to COSO framework.

Answer 60

About: Risks that may impact the achievement of objectives need to be identified and assessed. Risks are prioritised by severity in the context of risk appetite. The organisation then selects risk responses and takes a portfolio view of the amount of risk it has assumed. The results of this process are reported to key risk stakeholders.

Principles:

10. Identifies risk
11. Assesses severity of risk
12. Prioritises risks
13. Implements risk responses
14. Develops portfolio view

Question 61

Explain what Review and revision is about according to COSO framework.

Answer 61

About: By reviewing entity performance, an organization can consider how well the risk management components are functioning in light of substantial changes and what revisions are needed.

Principles:

15. Assesses substantial change
16. Reviews risk and performance
17. Pursues improvement in enterprise risk management

Question 62

Explain what Information, communication and reporting is about according to COSO framework.

Answer 62

About: Risk management requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down, and across the organisation.

Principles:

18. Leverages information and technology
19. Communicates risk information
20. Reports on risk, culture, and performance

Question 63

What is ISO 31000:2018?

Answer 63

ISO 31000:2018 Risk management – Guidelines is a risk management standard. It is designed to be applied to a range of industries and contexts. The standard provides principles, a framework and a process for managing risk.

Question 64

What are the 3 main components of ISO 31000:2018?

Answer 64

Risk Assessment
Value Creation and Protection
Leadership and Commitment

Question 65

True or false?

The COSO risk management framework places greater emphasis on controls than ISO31000:2018.

Answer 65

This statement is largely true. COSO has an internal control framework as well as a risk management one. The former is aligned with COSO’s risk management framework.

Question 66

Which three areas form ISO 31000:2018?

Answer 66

The ISO 31000:2018 standard comprises the three components - principles, framework and processes.

In addition, there are a further two related standards:

ISO Guide 73 Risk management - vocabulary
IEC 31010 Risk management - risk assessment techniques.

Question 67

What are the 3 areas internal auditors normally provide assurance on?

Answer 67

Internal auditors will normally provide assurances on three areas:

1. Risk management processes, both their design and how well they are working
2. Management of those risks classified as ‘key’, including the effectiveness of the controls and other responses to them
3. The reliability of risk assessments and the reporting of risk and control statuses.

Question 68

What are the core roles of internal audit in regards to Enterprise Risk Management?

Answer 68

• Giving assurance on the risk management process
• Giving assurance that risks are correctly evaluated
• Evaluating risk management processes
• Evaluating the reporting of key risks
• Reviewing the management of key risks

Question 69

What are the legitimate roles of internal audit with safeguards in regards to Enterprise Risk Management?

Answer 69

• Facilitating the identification and evaluation of risks
• Coaching management in responding to risks
• Coordinating of risk management activities
• Consolidating reporting on risks
• Maintaining and developing the risk management framework
• Championing the establishment of risk management
• Developing the risk management strategy for board’s approval

Question 70

What are roles IA should NOT take in regards to Enterprise Risk Management?

Answer 70

• Setting the risk appetite
• Imposing risk management processes
• Management assurance on risks
• Taking decisions on risk responses
• Implementing risk responses on management’s behalf
• Accountability for risk management

Question 71

What are the key factors to take into account when determining internal auditing’s role?

Answer 71

whether the activity raises any threats to the internal audit activity’s independence and objectivity and whether it is likely to improve the organisation’s risk management, control and governance processes.

Question 72

Explain what maturity model means.

Answer 72

It is a gauge by which to measure an organisation’s current state of and progress towards mastery of a given area.

Question 73

What does risk maturity mean?

Answer 73

The extent to which a risk management approach has been adopted and applied, as planned, by management across the organisation to identify, assess, decide on responses to and report on opportunities and threats that affect the achievement of the organisation’s objectives.

Question 74

What does risk appetite mean?

Answer 74

The level of risk that an organisation is willing to accept.

Question 75

What does risk-based internal auditing mean?

Answer 75

Risk-based internal auditing is a methodology that links IA to an organisations’ overall risk management framework. It allows IA to provide assurance to the board that risk management processes are managinig risks effectively, in relation to the risk appetite.

Question 76

What is the primary methodology IA should be using in organisations?

Answer 76

Risk based internal auditing.

Question 77

True or false?

Of importance to RBIA is understanding the level of risk maturity within the organisation.

Answer 77

True. The internal audit approach should reflect where the organisation is in terms of maturity and support its journey towards a fully embedded framework. .

Question 78

What does the risk maturity of an organisation determine?

Answer 78

• type of assurances that internal audit can provide
• framework that will be used for audit planning, critically the source of risk information internal audit will use in planning
• type of consulting services that internal audit can provide.

Question 79

What are the levels of risk maturity?

Answer 79

Initial, repeatable, defined, managed and optimised

Question 80

Describe what it means if an organisation’s risk maturity is at the initial level?

Answer 80

No formal approach to risk management

Question 81

What should the IA approach be if the organisation’s risk maturity is at the initial level?

Answer 81

Report that no formal risk management in place

Consultancy to champion risk management

Use alternative framework to determine internal audit plane

Assurance on control processes.

Question 82

Describe what it means if an organisation’s risk maturity is at the repeatable level?

Answer 82

Scattered silo-based approach to risk management

Question 83

What should the IA approach be if the organisation’s risk maturity is at the repeatable level?

Answer 83

Report poor risk management

Consultancy to champion risk management

Use alternative framework to determine internal audit plan

Assurance on control processes.

Question 84

Describe what it means if an organisation’s risk maturity is at the defined level?

Answer 84

Risk management strategy and policies in place and communicated

Risk appetite and tolerance levels defined.

Question 85

What should the IA approach be if the organisation’s risk maturity is at the defined level?

Answer 85

Report on risk management deficiencies

Consultancy to embed risk management

Start with management view of risk and supplement

Assurance on risk management policies and control processes.

Question 86

Describe what it means if an organisation’s risk maturity is at the managed level?

Answer 86

Enterprise wide approach to risk management developed and communicated.

Question 87

What should the IA approach be if the organisation’s risk maturity is at the managed level?

Answer 87

Management view of risk drives internal audit plan

Assurance on risk management processes and mitigation

Consulting to improve risk management

Question 88

Describe what it means if an organisation’s risk maturity is at the optimised level?

Answer 88

Risk management fully embedded into processes and systems

Question 89

What should the IA approach be if the organisation’s risk maturity is at the optimised level?

Answer 89

Management view of risk drives internal audit plan

Assurance on risk management processes and mitigation

Consulting as required.

Question 90

Standard 2120 Risk Management states:

The internal audit activity must evaluate the ________ and contribute to the improvement of risk management processes.

What text is missing?

Answer 90

Effectiveness

Question 91

An assessment of risk maturity finds that risk management and internal control is fully embedded into the organisations’ processes and systems.

What is the level of the organisation’s risk maturity?

Answer 91

Optimised

Question 92

When do you need a control?

Answer 92

When you’re not prepared to tolerate a risk.

Question 93

What is the purpose of controls?

Answer 93

to manage risk

Question 94

What happens is a control doesn’t have an associated risk?

Answer 94

It actively diverts first-line attention from areas that rightly deserve it more = pointless.

Question 95

To conduct a truly, risk-based audit, what should an internal audit engagement start with?

Answer 95

A clear understanding of the risks facing the organisation.

Question 96

If you don’t understand what the controls you’re assessing are meant to mitigate, ____________

Answer 96

You can’t provide a service of value to the organisation.

Question 97

Standard 2130 sets out _____________.

Answer 97

internal audit’s responsibilities in maintaining controls

Question 98

The internal audit activity must assist the organisation in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement.

How is this different if it is assurance service or consulting service?

Answer 98

2130.A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:

• achievement of the organisation’s strategic objectives
• reliability and integrity of financial and operational information
• effectiveness and efficiency of operations and programmes
• safeguarding of assets
• compliance with laws, regulations, policies, procedures, and contracts.

2130.C1 – Internal auditors must incorporate knowledge of controls gained from consulting engagements into evaluation of the organisation’s control processes.

Question 99

In one word, what is described here:

“Any action taken by management, the board and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organises and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.”

Answer 99

Control(s)

Question 100

In two words what is described here:

The policies, procedures (both manual and automated) and activities that are part of a control framework, designed and operated to ensure that risks are contained within the level that an organisation is willing to accept.

Answer 100

Control processes

Question 101

In two words what is described here:

The attitude and actions of the board and management regarding the importance of control within the organisation. The control environment provides the discipline and structure for the achievement of the primary objectives of the system of internal control. The control environment includes the following elements: integrity and ethical value, management’s philosophy and operating style, organisational structure, assignment of authority and responsibility, human resource policies and practices, and competence of personnel.

Answer 101

Control environment

Question 102

When do directive and preventative controls occur and what should they do?

Answer 102

before an ‘unwanted event’, and should reduce the number of them.

Question 103

When do detective and corrective controls occur and what should they do?

Answer 103

after an unwanted event, alerting those responsible to the problem and helping them put things right.

Question 104

Give an example of directive control?

Answer 104

Accounting manuals, documented procedures, training and supervision.

Question 105

Give an example of preventative control?

Answer 105

Segregation of duties, access controls and authorisation.

Question 106

Give example of detective control?

Answer 106

Exception reports, reconcilitations, control totals and error reports.

Question 107

Give example of corrective controls?

Answer 107

Error, incident and complaint handling procedures and virus isolation.

Question 108

What do directive control direct people to do?

Answer 108

to perform tasks in the way best designed to mitigate risk.

Question 109

What preventive controls can also be physical?

Answer 109

security fences, staffed gates and entrances, and locks can all be effective controls

Question 110

Other than categorising controls as directive, prevetive, detective and corrective, what are other ways can you categorise controls?

Answer 110

Macro and micro-level,
key and secondary controls,
active and passive controls

Question 111

When a control is at macro-level, what does this mean?

Answer 111

they mitigate organisation-wide risk.

Question 112

What are the two subcategories of macro-level controls?

Answer 112

governance and management controls. Examples include tone at the top, codes of ethics, board sub-committees, risk management frameworks and IT general controls.

Question 113

When a control is at micro-level, what does this mean?

Answer 113

These include activity, process and task-level controls.

Question 114

We can categorise controls by their degree of importance to mitigating risk - also known as….

Answer 114

Key and secondary controls

Question 115

How do key controls operate?

Answer 115

These must operate effectively to reduce risk to the desired level.

Question 116

How do secondary controls operate?

Answer 116

These are not essential to mitigating the risk but can help the activity, process or transaction to run more efficiently.

Question 117

If controls are categorised based on the level of human interventions, this would be called…

Answer 117

Active and passive controls.

Question 118

What are active controls?

Answer 118

Active (manual) control: These are controls that require human action.

Question 119

What are passive controls?

Answer 119

Passive (automated) control: These are controls that operate without human action.

Question 120

What are the two types of control failures that can happen?

Answer 120

inadequate controls and ineffective controls

Question 121

Explain what is an inadequate control.

Answer 121

Inadequate controls are either non-existent or poorly designed – even if executed correctly, they still wouldn’t mitigate the targeted risk.

Question 122

Explain what is an ineffective control.

Answer 122

Ineffective controls, on the other hand, are those that exist and are adequately designed – but performed incorrectly or not at all.

Question 123

What are the possible control failures for the following control:

Individual swipe cards to a room with file containing personal information.

Answer 123

If the control process doesn’t include regular review of individuals’ access, it is inadequate.

If staff share swipe cards, knowing this is forbidden, then the process is ineffective.

Question 124

What are the possible control failures for the following control:

Complaints procedures for customers.

Answer 124

If the organisation’s complaints procedure is too complex, either for customers or for staff, then it is inadequate as a control.

If, however, staff do not follow the procedure, thinking they can resolve matters more quickly for the customer by skipping steps, then the control is ineffective.

Question 125

If during fieldwork, it comes to light that people are not following procedures or processes they know they should, what should you ask first?

Answer 125

Why don’t you?

If, in this instance, staff are correct, and they can reduce the risks arising from customer dissatisfaction more efficiently, then that is positive. It shows that staff members are mindful of risks and keen to improve controls. Rather than criticising staff for not following a possibly over-engineered control process, why not encourage them to update it with their improvements? By giving credit where due, internal auditors show their keenness to work positively with colleagues throughout the organisation.

Question 126

If you find that a control process is inadequate, should you test it for effectiveness anyway?

Answer 126

No. It’s a waste of time. Even if staff perform the process accurately, its inadequacy means that it still wouldn’t mitigate the risk to the desired level. With very few exceptions, an inadequate controls means you stop there – you have a finding.

Question 127

Which are elements of the control environment?

Assignment of authority and responsibility

Correctly checked
Integrity and ethical values

Correctly checked
Organisational structure

Answer 127

All three are elements of the control environment. There are a further elements: management’s philosophy and operating style, assignment of authority and responsibility, human resource policies and practices and competence of personnel.

Question 128

What type of control is variance analysis?

Answer 128

Hard control.

Hard controls are quantitative and objective. A comparison of budget and actual figures through the process of variance analysis identifies how well an organisation is performing against targets. Budgets often use monetary and numerical targets.

Automated and passive control is incorrect. Automated and passive controls work without human intervention such as a warning within a computer system which might indicate that an expense heading has exceeded a specific level.

Soft controls are qualitative and subjective; this is incorrect.

Question 129

Name the 6 frameworks, standards and regulations that have implications for organisational control.

Answer 129

1) COSO Internal Control - Integrated Framework
2) CoCo (Criteria of Control) model
3) King Report on Corporate Governance
4) Sarbanes Oxley (SOX) Act
5) COBIT 2019
6) Basel III standards

Question 130

Explain CoCo model.

Answer 130

CoCo’s philosophy is that control comprises those elements of an organisation (including its resources, systems, processes, culture, structure and tasks) that, taken together, support people in the achievement of the organisation’s objectives.

CoCo has 20 so-called criteria of control group into four areas:

Purpose
Commitment
Capability
Monitoring and learning.

Question 131

What does the King Report on Corporate Governance focus on?

Answer 131

outcomes, placing accountability on the governing body (eg the board) to attain the governance outcomes of an ethical culture, good performance and effective control within the organisation and legitimacy with stakeholders.

Question 132

What is the aim of the Sarbanes Oxley (SOX) act?

Answer 132

to increase transparency in the financial reporting by corporations to protect investors by improving the accuracy and reliability of corporate disclosures through a formalised system of checks and balances.

Question 133

What is COBIT 2019?

Answer 133

a framework for the governance and management of enterprise information and technology aimed at the whole organisation. COBIT distinguishes between governance and management, setting out:

the components to create and sustain a governance systems
the design factors to build a governance system that fits the organisation.

Question 134

What are the Basel III standards designed to do?

Answer 134

to strengthen the regulation, supervision and risk management of banks. A key aspect of the reform are the so-called pillars:

Enhanced minimum capital and liquidity requirements
Enhanced supervisory review process for firm-wide risk management and capital planning
Enhanced risk disclosure and market discipline.

Question 135

Which one of the risk frameworks is the most widely-used?

Answer 135

COSO

Question 136

What does the COSO framework explain?

Answer 136

That there is a direct relationship between organisational structure, objectives and components (3 types of objectives and five components).

Question 137

What are the five components of COSO?

Answer 137

Control environment
Risk assessment
Control activities
Information and communication
Monitoring

Question 138

What are the 3 objectives of COSO?

Answer 138

Operations
Reporting
Compliance

Question 139

Organisations must comply with laws and regulations including company law, tax law and environmental protection regulations.

What category of internal control objectives does this requirement form part of?

Operations
Reporting
Compliance

Answer 139

Compliance

Question 140

True or false?

COBIT is a technical (IT) framework to manage business technologies.

Answer 140

False.

COBIT is a framework for the governance and management of enterprise and information and technology. It is not limited to IT and IT functions. COBIT sets out components that describe what decisions should be taken, how and by whom.

Question 141

What is fraud to organisations?

Answer 141

A significant loss which can lead to loss of confidence in the organisation or even lead to its collapse.

Question 142

Explain the term Fraud. What does it mean?

Answer 142

Any illegal act characterised by deceit, concealment, or violation of trust. These acts are not dependent upon the threat of violence or physical force. Frauds are perpetrated by parties and organisations to obtain money, property, or services; to avoid payment or loss of services; or to secure personal or business advantage.

Question 143

Explain the term Fraud risk. What does it mean?

Answer 143

The probability that fraud will occur and the potential severity or consequences to the organisation when it occurs.

Question 144

Explain the term Fraud red flag. What does it mean?

Answer 144

1. Indicators that fraud is taking place. 2. Conditions that consistently contribute to fraud.

Question 145

What types and categories of fraud are there?

Answer 145

Fraud benefiting individuals

Fraud benefiting the organisation

Question 146

What are examples of fraud benefiting individuals?

Answer 146

embezzlement
espionage
theft of assets
unauthorised use of information
accepting bribes and kickbacks.

Question 147

What are examples of fraud benefiting the organisation?

Answer 147

misrepresentation of financial and non-financial data
transfer pricing
sale or assignment of fictitious or misrepresented assets
illegal payments to facilitate business activities.

Question 148

Fraud red flags can mean two things. What are those two things?

Answer 148

First, indicators that suggest fraud may be occurring. Second, conditions that could give rise to fraud.

Question 149

Is a fraud red flag is proof that fraud is taking place.

Answer 149

No, it is a signal that something is not as it should be and should be investigated further.

Question 150

If we consider fraud red flags from the perspective of macro environment, what does this mean?

Answer 150

This refers to the environment external to the organisation. It’s worth remembering organisations are influenced by this environment, and can influence it too. The PESTLE (political, economic, social, technological, legal and environmental) tool is useful in analysing potential macro environmental fraud risks.

Question 151

If we consider fraud red flags from the perspective of micro environment, what does this mean?

Answer 151

Refers to the environment within the boundaries of the organisation. The organisation has greater influence on this environment. We can categorise micro environment factors into a number of factors, as the figure below illustrates.

Question 152

Give an example of a fraud red flag in management?

Answer 152

• Lack of expertise in the area of work (consider qualifications, experience and whether professional standards are applied in the work).
• Poor supervision and oversight over the work the manager does.
• Key managers who are too controlling and do not delegate work.
• Key managers who delegate a lot of work without providing appropriate supervision.

Question 153

Give an example of a fraud red flag in organisational culture?

Answer 153

• Lack of clear values in relation to ethics.
• An acceptance of low-level fraud
• Tone at the top that sets the wrong climate

Question 154

Give an example of a fraud red flag in staff?

Answer 154

• High turnover and low staff morale
• Large number of complaints about particular members of staff
• Unclear reporting lines and a lack of accountability
• Remuneration policies that encourage damaging work practices
• Employees who are reluctant to take leave or when they do, take leave for very short periods

Question 155

Give an example of a fraud red flag in processes?

Answer 155

• Poor physical security
• Poor access controls
• Poor filing of or missing documents - higher than usual or expected
• Unrealistic targets e.g. sales
• Roles and responsibilities that are not appropriately segregated

Question 156

Give an example of a fraud red flag in Finance?

Answer 156

• High levels of cash only transactions
• Unexplained rises in expenses
• Large number of refunds to customers
• Changes in levels of inventory eg excessive shrinkage
• High level of adjustments in the book of accounts
• Unexplained growth in sales, particularly in relation to specific customers

Question 157

Give an example of a fraud red flag in a Macro Environment (External)?

Answer 157

• Economic downturns that add pressure for organisations and individuals to perform
• Industries with low regulatory oversight or where some aspects of fraud are regarded as being acceptable
• Countries with high corruption ratings

Question 158

What does PESTLE stand for and what is it useful for?

Answer 158

The PESTLE (political, economic, social, technological, legal and environmental) tool is useful in analysing potential macro environmental fraud risks.

Question 159

What are the three conditions that need to exist for a person to violate trust and commit fraud (and therefore enable)?

Answer 159

Pressure
Rationalisation
Opportunity

Question 160

Explain why pressure is an element in creating the perfect conditions for a person to commit fraud.

Answer 160

This factor is sometimes referred to as motive. An individual is likely to be under some kind of pressure to commit fraud. This could be financial eg debts. Motives may include grievance against the business or greed.

Question 161

Explain why opportunity is an element in creating the perfect conditions for a person to commit fraud.

Answer 161

There must be an opportunity to enable the individual to commit fraud. This may arise from poor controls. For instance, if the person ordering items is also the person who authorises and receives them, this gives rise to the potential for skimming.

Question 162

Explain why rationalisation is an element in creating the perfect conditions for a person to commit fraud.

Answer 162

Individuals who commit fraud usually rationalise their behaviour. They may suggest that they were only borrowing items, that it is common organisational practise to take items, that they were ‘owed’ the items for overtime and so forth.

Question 163

What are the five principles of managing fraud?

Answer 163

1. Fraud risk governance
2. Fraud risk assessment
3. Fraud prevention
4. Fraud detection
5. Fraud investigation and corrective action

Question 164

What does good fraud risk governance look like?

Answer 164

As part of an organisation’s governance structure, a fraud risk management program should be in place, including a written policy (or policies) to convey the expectations of the board of directors and senior management regarding managing fraud risk.

Question 165

What does good fraud risk assessment look like?

Answer 165

Fraud risk exposure should be assessed periodically by the organisation to identify specific potential schemes and events that the organisation needs to mitigate.

Question 166

What does good fraud prevention look like?

Answer 166

Prevention techniques to avoid potential key fraud risk events should be established, where feasible, to mitigate possible impacts on the organisation.

Question 167

What does good fraud detection look like?

Answer 167

Detection techniques should be established to uncover fraud events when preventive measures fail or unmitigated risks are realized.

Question 168

What do good fraud investigation and corrective action look like?

Answer 168

A reporting process should be in place to solicit input on potential fraud, and a coordinated approach to investigation and corrective action should be used to help ensure potential fraud is addressed appropriately and timely.

Question 169

What is the role of the Board in terms of fraud?

Answer 169

Corporate policy on the non-tolerance of fraud, dealing with its occurrence and laying down responsibilities and measures to mitigate risk
Notifying appropriate regulatory authorities of relevant transgressions
Ratifying policy, mitigation strategy and response plan
Corporate ethos, setting the right ethics and policies
Risk and threat assessment
Adequate and effective internal control
Adequate and effective internal audit.

Question 170

What is the role of Line Management in terms of fraud?

Answer 170

Managing, controlling, reporting and taking action on the risk of fraud including:

having processes in place to deter and detect fraud
applying adequate controls to prevent transgressions
leading investigations
overseeing investigations conducted by specialists on their behalf
dealing effectively with issues raised by staff (including taking appropriate action to deal with reported or suspected illegal activity)
involving the police where necessary.

Question 171

What is the role of Staff in terms of fraud?

Answer 171

Operating procedures to safeguard the organisation’s assets
Alerting management when they believe that the possibility of fraud exists
Reporting immediately to management when they suspect that an illegal act has been committed.

Question 172

What is the role of Internal Audit in terms of fraud?

Answer 172

Independent assurance on the effectiveness of the processes put in place to manage fraud risk.

Question 173

What is the role of Audit Committee in terms of fraud?

Answer 173

Review arrangements by which staff can raise concerns in confidence about improprieties
Arrangements are in place for investigation and follow up of any concerns raised in relation to fraud.

Question 174

What is the difference between fraud and improper activities?

Answer 174

Fraud involves intentional deception. Improper activities may not be illegal but breach organisational policies. Further, it does not involve intentional deception.

Question 175

True or false?

Internal audit has a key role in detecting and investigating fraud.

Answer 175

False

It is not internal audit’s job to detect or investigate fraud . Internal audit’s primary responsibilities are to:

carry out audit engagements using due professional care and in such a way as to be alert to the possibility of fraud and misconduct
review procedures to safeguard assets so as to ensure that cost-effective measures are in place to prevent, detect or deter fraud
ensure that the prevention, detection and deterrence of fraud are also taken into account when new systems are designed or changes made to existing systems.

Question 176

True or false?

Internal auditors must be able to evaluate the risk of fraud.

Answer 176

True.

International Standard 1210.A2 states that:

Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organisation, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud. (emphasis added)

Question 177

True or false?

Internal auditors should be alert to the potential for fraud to occur.

Answer 177

True.

The statement is true and is supported by a variety of standards, eg 2210.A2 which states that:

Internal auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives.