Quiz
FAFE Domain 2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (45)
1A ministry of health wants to assess its ability to respond to an outbreak of cholera. The ministry assesses the inherent risks associated with cholera and with different scenarios under which an epidemic might unfold, such as an earthquake or a severe weather event. Which risk criteria best describe the ministry's expanded "terms of reference against which the significance of risk is evaluated?"
I. Volatility.
II. Correlation.
Ill. Velocity.
IV. Interdependency.- AI and IV.
- BII and IV.
- CIII and IV.
- DII and III.
2HAL, a leading software and hardware vendor in the private sector, is weighing the pros and cons of expanding into the public sector. Which are the most appropriate terms to describe the risks that HAL is evaluating?
I. Speculative risk.
II. Market risk.
III. Enterprise risk.
IV. Technology risk.- AI and II.
- BI and III.
- CII and IV.
- DIII and IV.
3The state assembly decrees that the state's Pension Investment Division (PID) must divest of all holdings related to a certain country. Soon after, the financial markets soar on unexpected predictions of dramatic economic recovery. In response, PID sells large positions of its portfolio at a premium and covers its losses from the mandated divestiture. According to the bowtie diagram analysis methodology, what two terms best describe the risk factors leading to the sale?
I. Consequence.
II. Trigger event.
III. Risk event.
IV. Intermediate event.- AII and IV.
- BI and III.
- CI and II.
- DIII and IV.
4An advertising agency that has experienced steady growth for a decade gathers its staff together for a control risk self-assessment (CRSA) and identifies the following top concerns:
I. Heavy reliance "legacy" on former clients rather than cultivating new clients.
II. High staff turnover. Only the CEO and the award-winning creative director have been with the firm since inception.
III. Effects of the economy on each business sector they serve.
IV. The firm's new focus on a global, rather than a regional, market.
Which of the above risks represents a potential single point of failure?- ARisk I.
- BRisk II.
- CRisk III.
- DRisk IV.
5Two real-estate investment partners are assessing the relative risks of prime property in Los Angeles, California, and a comparable property in a similarly vibrant area of Brooklyn, New York. One partner discounts heavily the value of the Los Angeles property because of the potential for earthquake damage. The Los Angeles-averse partner is most likely influenced by which element of risk management analysis?
- ARisk psychology.
- BRisk prioritization.
- CRisk severity.
- DRisk response.
6Which of the following is not a benefit of risk mapping and prioritization?
- AThe results help an enterprise to communicate better its risk aggregated risk profile to key external stakeholders.
- BRanking risks by their level of severity helps an organization determine the optimal allocation
of resources devoted to risk response or treatment. - CRisk maps are key graphical representations of the variance in risk appetites across different
divisions within an organization. - DHelping the enterprise identify how certain risks can offset other risks to ensure that the enterprise
maintains an overall risk profile that remains within risk capacity.
7A city comptroller was the sole signatory on the city's accounts. Over two decades she embezzled $30 million from the municipality by shifting public funds through multiple city bank accounts before hiding them in a secret account. Despite regular external audits, her fraud went undetected until a colleague discovered the secret bank account. What are the most likely reasons that this fraud was perpetuated over such a long time?
I. Incomplete understanding of the risk conditions leading to a faulty risk response mechanism.
II. The cost of treating the risk to keep the level within appetite outweighed the benefits gained from treating the risk.
III. Inadequate directive controls.
IV. Inadequate preventative controls.- AII, III, and IV.
- BI and III only.
- CI and IV only.
- DI, II, and III.
8Community Hospital Systems (CHS) set a goal that all patients be seen within 30 days of their requests. Employees who met the scheduling goal were rewarded with bonuses. Unbeknownst to senior executives, schedulers were entering fraudulent data into the scheduling system to disguise the much longer actual wait time. Significant numbers of patients experienced deteriorating health, and several died before seeing a medical professional. Which of the following were the primary drivers behind the fraudulent reporting?
I. A bureaucracy that had been taught, over time, to hide its problems from senior management.
II. Incomplete or inappropriate reliance on performance metrics.
III. Reducing treatment wait time was an inappropriate operating objective. Therefore, CHS did not deploy its resources effectively to achieve its strategic objectives.
IV. Lack of alignment between its organizational objectives and risk management processes.- AI and II only.
- BII and III only.
- CIII and IV only.
- DII and IV only.
9A summer camp is known for its expertise in wilderness training and adventures. The camp carries $50 million of liability insurance, and parents of campers must sign liability waivers. All counselors are certified in wilderness first aid and activity instruction and are required to undergo periodic refresher training. All campers receive training and must meet stringent skill and safety requirements before embarking on a wilderness trip. Which two response options best summarize
the camp,s risk response strategy?
I. Avoid.
II. Transfer.
III. Mitigate.
IV. Tolerate.- AII and III.
- BI and II.
- CII and IV.
- DIII and IV.
10The term risk escalation refers to:
- ARisks that have materialized as events.
- BWeaknesses in the internal control system that raise residual risks beyond the limits of the risk appetite.
- CThe increase in an enterprise's risk profile resulting from previously unknown risks arising from changes in the internal or external environments or changes to the organization's objectives and activities.
- DThe process of and procedures for reporting risk incidents up the chain of command.
11Put the following risk identification activities in the proper sequence:
I. Develop initial risk register.
II. Conduct Control Risk Self-Assessment (CRSA).
III. Calculate risk severity.
IV. Define the risk universe.- AI, II, III, and IV.
- BII, IV, I, and III.
- CII, III, IV, and I.
- DIII, IV, II, and I.
12An information broker, InfoMart, suffered an information security breach that exposed hundreds of thousands of customers' sensitive personal information. The breach was a result of fraud perpetrated by criminals pretending to be legitimate customers. In addition to heavy fines and redress costs, the company is now on probation subject to 20 years of external auditing by the Federal Trade Commission. What would be the most important improvement that InfoMart should make to avoid future breaches?
- AImplement better IT general controls and IT application controls, with special emphasis on
automating controls that force employees to adhere to policies affecting change management and
access rights as well as authentication and authorization of system users. - BMake the chief information security officer (CISO) responsible for monitoring vulnerabilities in
business processes and IT. - CStrengthen business processes for vetting customers and their activities and create offices of
customer credentialing, compliance, and privacy that would report directly to the board of
directors' privacy committee. - DEliminate products that contain personal data regarding an individual's financial assets, criminal
and employment histories, and known associates/family members.
- AImplement better IT general controls and IT application controls, with special emphasis on
13Risk severity is often calculated as a function of likelihood, categorized as "unlikely," "possible," or "likely," and impact, categorized as "catastrophic," "disruptive," or "problematic." Using the InfoMart case above and the study guide's definitions of likelihood and impact categories, one would most likely assign a likelihood of ______ and an impact of ______ to a future InfoMart data breach:
- AUnlikely, disruptive.
- BUnlikely, catastrophic.
- CLikely, problematic.
- DPossible, disruptive.
14What is the greatest challenge that is unique to conducting and interpreting risk prioritization exercises?
- ALikelihood and impact are not the only risk criteria that the organization needs to consider.
- BThe assumption that different risk criteria (such as likelihood and impact) carry equal weight in the analysis.
- CAttaching numbers to measures of risk requires a degree of subjectivity and judgment.
- DRisk analysis, evaluation, and prioritization are processes that require regular updates.
15According to COSO guidance, the term sweet spot refers to:
- AIdentifying and investing the optimal amount of money devoted to risk management.
- BThe point at which the aggregate risk exposure of different divisions in an enterprise are balanced in accordance with overall risk appetite.
- CAn enterprise achieving a state in which overall risk profile is equal to its total risk capacity.
- DThe point at which an organization's risk-taking results in the highest net gain in value.
16Review or audit of risk management processes has three primary goals. Which of the following is not one of the three goals?
- ATo identify and repair weaknesses and faults.
- BTo avoid impugning the reputation of top management.
- CTo identify changes in the organization's objectives and environment and ensure alignment.
- DTo determine that the organization is achieving its goals (because risk management is working).
17A corporation uses a risk management plan form that includes a section on methodology with the following steps:
I. Control risks.
II. Monitor risks.
III. Risk response tracking.
IV. Risk response planning.
V. Prioritize risks.
VI. Risk identification.
VII. Categorize risks.
VIII. Risk impact assessment.- AI, II, III, VIII, IV, VII, VI, V.
- BVI, VII, VIII, V, IV, III, II, I.
- CVIII, VII, VI, V, IV, III, II, I.
- DVI, VII, IV, III, II, VIII, V.
18In a school cafeteria, an employee was accused of stealing $500 a day in cash by operating a cash only line for a la carte items, without a cash register. The employee was charged with stealing more than $1 million over 20 years. Effective monitoring should have identified the following as red flags except:
- ALarge amounts of an asset (cash) with inherent risk.
- BAbsence of a cash register in the a la carte line.
- CLack of monitoring of ratio of inventory consumption for the a la carte line to the ratio for four cash receipts lines.
- DLack of an annual ethics briefing for all employees.
19Some literature and guidance advocates assessing the context as an early step in the risk management process. In using the term context, what are important considerations?
- AMapping the social scope of risk management (what are stakeholders facing?).
- BWhat are the objectives of the stakeholder (financial impact, programmatic impact, other)?
- CWhat resources are available to mitigate resources?
- DAll three of the above are elements of context.
20An investment company is constructing a complex of four residential rental buildings that will have more than 100 units. The complex is in a geographic area that has a long rainy season. Which of the following steps would likely be most essential to monitoring and mitigating the risk of rain damage?
- AAssuring compliance with local codes during construction.
- BEstablish a reserve for capital expenditures, if needed.
- CMonthly inspections by internal maintenance staff and annual assessments by external engineering firms.
- DActively encouraging renters to report possible problems.
21Risk management processes can fail. Which of the following accurately identifies three reasons why the processes are prone to failure?
- AAll systems will naturally fail; systems designed to solve problems may generate new problems; complex systems tend to defeat themselves.
- BSystems do not attract systems people; individual interactions squeeze out large systems; effective
systems do not need information. - CSimple systems are too elemental; individuals are too rigorous in doing what they are supposed
to do; systems are not allowed enough "mission creep." - DIssues or problems are changed by the systems that are designed to solve them; systems do not
develop their own goals; complex systems always avoid self-defeat.
22In reporting risk incidents, there is a value in reporting near misses. Which of the following would not be considered a near miss?
- AA restaurant was bombed by a criminal organization during the hours it was closed.
- BA poisonous snake was stolen from a zoo and taken aboard a crowded city bus, but it was killed
by a policewoman before it could bite any passengers. - CA tornado warning system was not functioning, but the residents of the area were all attending
church services and not in residences that were struck. - DCitizens reported a gas leak, but the investigators did not arrive in time to avoid a major explosion.
23A national legislature provides authority and foreign aid funds to be spent on constructing schools in a country that is prone to rebel attacks. The risk of the schools being destroyed is deemed very high. In this situation, which of the four responses is likely not an option?
- AAvoidance.
- BTransference.
- CMitigation.
- DAcceptance.
24A manufacturing firm with a range of locations and products is hierarchical. For 10 years, clear but detailed criteria were used to report up through many layers. Due to voluminous reporting, the firm simplified the criteria allowing judgment so that only a very few risks get to the top. Some managers are concerned that the revised system may not be effective. What would you suggest?
- ARevert to the old system, because important risks might be missed.
- BContinue with the new system to show confidence that managers' judgments at all levels are
trusted at the top. - CStart over with a completely new third approach.
- DInvolve managers in developing a hybrid of the old and revised systems.
25A corporation has 10 regions and offices in 90 countries. The firm annually assesses risks on an entity-wide basis. Broad guidance is sent from the corporate level, but wide latitude is permitted in the field-from very informal to very structured, with no requirement for documentation. What is needed?
- AThe corporate office should establish a consistent approach.
- BEvery office needs supporting evidence, and it should be subject to a minimum review process from a higher level.
- CThe timing should be clear and the same (or similar) format should be used for input.
- DAll of the above.
26Risk assessment reviews can be qualitative or quantitative. In periodic reviews of risk management, the use of these two types should be taken into account. In this regard, which of the following statements is true?
- AQuantitative assessment techniques include interviews and workshops.
- BBenchmarking assessment techniques include sensitivity analysis, scenario analysis, and stress tests.
- CNon-probabilistic models using subjective assumptions include cash flow at risk, earnings at risk,
and back testing. - DQuantitative assessments are more complex than qualitative assessments but typically yield more
precise measures.
27A list of common pitfalls in risk assessment would likely not include which of the following?
- ALimiting risk assessment to financial hazards.
- BOversimplifying risk quantification.
- CLimiting the number of significant risks to be managed.
- DDeveloping risks in a vacuum.
28When assigning responsibilities for monitoring risk mitigation plans, which of the following criteria is most important?
- ATo ensure an independent attitude, monitoring responsibility should be limited to higher levels rather than at levels where detailed processes occur.
- BThose with monitoring responsibility can generally minimize consideration of cost-benefit analysis.
- CTo properly assess the monitoring process, those doing the monitoring must hear from those close to the risks/controls.
- DMonitoring should focus on established, not emerging, risks.
29In considering risk mitigation plans for supply chain management, assume the following four items are identified and labeled as shown:
I. Government legislation-External risk.
II. Every employee is considered a risk manager-Internal risk.
III. Market volatility-Not considered a risk.
IV. Asset productivity-Internal risk.
Which of the above four items is/are accurately labeled?- AI and IV.
- BI, II, III, and IV.
- CI only.
- DI, II, and IV.
30A large agricultural firm produces crops that rely on honeybees for cross-pollination to increase and enhance production. An unknown, uncontrolled disease has killed large numbers of bees (diminishing crops) and is now moving toward the firm's fields. What is the best response to this emerging risk?
- AAcceptance/toleration.
- BAvoidance/termination.
- CSharing/transference.
- DTreatment/reduction.
31What is the most likely reason that an organization may fail in its efforts to implement enterprise risk management (ERM)?
- AERM is not uniformly applied across the company and there is not a comprehensive focus on all key business risks.
- BERM is not driving everything that management drives.
- CIt was not implemented in a discrete time frame, usually 12 months or less.
- DThe organization did not adhere to regulatory requirements for ERM use.
32The Committee of Sponsoring Organizations of the Treadway Commission's (COSO's) Enterprise Risk Management- Integrated Framework states, "Where potential events are not directly related, management assesses them individually." However, when correlation exists between events, management must take which of the following actions first?
- AMake a judgment about the priority of risks through an executive decision.
- BSegregate the events and assess the effects, impact, or contribution to the severity of another
event. - CQuantifying the risks of the events and deciding which risks to mitigate using the results.
- DComplete a gap analysis.
33How is the COSO ERM framework different from the ISO 31000 guide?
- AThe COSO framework is applicable only in the United States, while ISO guidance is used internationally
- BThe COSO framework describes ERM as an iterative process and ISO 31000 guidance describes ERM as a serial process.
- CThe COSO ERM framework is broad and includes ISO 31000 as a source of its input to the development of the ERM framework.
- DISO 31000 views risks as loss events, while COSO ERM views risks as related to uncertainty.
34The COSO ERM framework encompasses more specific frameworks relating to specific risks to corporate objectives. How is The IIA's Guide to the Assessment of IT Risk (GAIT) incorporated into the COSO ERM framework?
- AOnce key risks are identified in a risk assessment, an organization can use an appropriate framework for IT risks. GAIT would be used in developing best practices and measures to manage and monitor IT risks.
- BGAIT should be used to manage risks that impact financial reporting and should not be used as part of an ERM discipline.
- CThe ERM framework incorporated the four key principles of GAIT into components
- DGAIT does not require that key IT controls be identified as a result of a top-down assessment of business risks and the controls required to mitigate enterprise-wide risks. Instead, the ERM framework calls for management to take risk mitigation into account.
35ISO 31000 and COSO's ERM provide frameworks that help organizations with framing their risk management activities. Which of the following is the best approach in assessing an organization's risk management approach?
- ACreate inventories of the ISO and COSO frameworks and align them with the organization's activities to determine gaps.
- BFind out what is the most common framework being used by competitors in the industry.
- CMeet with the internal auditors to find out which approach they assess as the best.
- DConsider multiple components of an organization's industry, culture, and objectives to determine
the most effective risk management approach.
36When evaluating the risk management process using a process elements approach, ISO 31000 identifies seven components that must exist for a risk management process. Which of these components is not one of the process elements?
- ARisk identification.
- BRisk analysis.
- CRisk evaluation.
- DRisk deliberation.
37Internal audit can play a key role in evaluating risk management processes. Which of the following are possible roles that internal audit should take when evaluating an organization's risk management processes?
I. An assurance of the risk management process itself.
II. Follow up on risk treatment plan status.
III. Setting the risk appetite.
IV. Assurance on significant risks and management assertions.- AI, II, and III.
- BI, II, and IV.
- CII, III, and IV.
- DI, III, and IV.
38Which of the following is not one of the formal components of COSO's ERM framework?
- AManagement must consider internal and external events that create threats and opportunities.
- BConsider how objectives can be achieved by assessing the likelihood and probability of events that may affect the achievement of objectives.
- CAn entity's tone at the top, ethical values, and operating style will help management establish a risk management philosophy and risk appetite.
- DRisk appetite is defined and communicated as part of the entity's mission statement.
39Strategic objectives are generally set for three or more years and cascade down to operational objectives, which are usually shorter in term. Determine which of the options below is stated first as a strategic objective, then next as an operational objective:
- AWe will end world hunger by creating partnerships with other nations to integrate resources.
We will set goals to end hunger globally by working with hunger organizations in other countries. - BCreating new job opportunities for people with the most severe intellectual disabilities.
Identifying choices that consider the strengths of the person with intellectual disabilities and matching him/her up with employers. - CWe want to be the place that everyone calls home when they are away from theirs.
We will make our bedding choices wider so that guests can choose from several options. - DOur science and medicine will end cancer.
Find a cure for cancer, one survivor at a time.
- AWe will end world hunger by creating partnerships with other nations to integrate resources.
40A mid-size firm has set up its ERM framework and wants to assess whether its ERM components are working properly. To do this, what are some of the ways to judge "effective" ERM?
- AAssess whether risks have been controlled across COSO's ERM framework components with reasonable assurances that risk management will allow the firm's objectives to be achieved.
- BReview the firm's operational objectives and determine if each of them has been met.
- CAssess ERM effectiveness by using the results of the financial auditor's report.
- DUse the corporate scorecard results as an indicator of the effectiveness of ERM.
41Some companies are not mature in identifying risks that will prevent them from meeting their strategic objectives. What is not a way that ERM can help with achieving strategic objectives?
- AERM can help companies achieve objectives by assigning priorities and resources that help achieve operational objectives, which push the strategy forward.
- BWith proper internal controls, companies have reasonable assurance that risk management is
working effectively, which provides a continuous basis for achieving objectives at all levels. - COnce the ERM vision and the related goals and objectives are articulated, management can conduct
a risk assessment to decide how to manage the risks to achieving the goals across all levels of the
organization. - DCompanies should make a list of all their risks and assign ownership to a department that can
routinely monitor and manage them.
42You are the risk officer for an organization that has a social mission. Resources are limited, so the organization must set strategic objectives that represent options that consider the potential for uncertainties as well as the opportunities that exist and could exist to achieve objectives and goals. As the organization sets goals, it cascades the importance of SMART objectives down through the organization. What does the mnemonic SMART stand for?
- ASuccess, Maturity, Appropriateness, Resources, Talent.
- BSpecific, Measurable, Achievable, Realistic, Time-limited.
- CSpecific, Measurable, Achievable, Repeatable, Tested.
- DStated, Measured, Achievable, Risk-averse, Time-sensitive
43When an organization uses training and written manuals to guide and supervise behavior and control outcomes of its accounting functions and responsibilities, this is a control method for treating risks. Which type of control is this?
- APreventative control.
- BDetective control.
- CDirective control.
- DCorrective control.
44Internal controls need to be considered for their effectiveness in reducing or eliminating the risks for which they are intended to control, but also the cost-effectiveness of the internal control. To assess cost-effectiveness, what does the analysis need to include as part of the risk treatment decision?
I. The cost of implementing the control.
II. The effect of the control on external stakeholders.
III. The cost of internal auditors assessing the effectiveness of the control.
IV. The cost of not implementing the control.- AI and II.
- BII and III.
- CI and III.
- DI and IV.
45When an organization focuses on short-term tactics that provide some protection from risks, it can destroy shareholder value and result in being overly risk-averse. Value-creating organizations focus on long-term risks and develop far-reaching strategies to address them. Which of the following is not an example of issues that an organization addresses in value creation?
- AShort-term market fluctuations.
- BNonfinancial value.
- CEnvironmental and social issues.
- DInnovation.
Information
- Description
- Quiz on FAFE Domain 2, created by Misty Gregg on 19/07/2019.
- Author
- Misty Gregg
- Language
- English
- Views
- 5
- Rating
- No ratings yet Rate this quiz