ERM dumbed down

Board of Directors Role

BANTAY: Provides oversight; ensures risk management is established, adequate, and effective.

Management / Senior Management Role

GAWA: Handles day-to-day governance, sets the ethical tone at the top, and implements controls.

Internal Audit (IA) Role

SURI: Independent, objective assurance and consulting. Evaluates governance, risk management, and controls without designing or executing them.

Operations (First Line) Role

HAWAK: Owns and manages risks day-to-day; performs operational controls.

MCQ Exclusion Rule for Internal Audit

If an answer choice contains words like "design", "implement", "ensure", "accountable", "decide", or "set appetite", it is NOT Internal Audit.

What makes governance effective?

Explicit consideration of risk when setting strategy.

False statement regarding governance scope

Governance is NOT focused mainly on strategic direction; it encompasses oversight, ethics, control, and risk.

Why "reliance and trust" is not a governance principle

Trust is not an internal governance principle; governance requires formal oversight, accountability, and controls.

Year and location IIA was founded

1941 in New York.

Internal Audit Practitioner (IAP) designation

Entry-level and student certification offered by the IIA.

Primary functional reporting line of the Chief Audit Executive (CAE)

Functionally reports to the Board of Directors (Audit Committee); administratively reports to senior management (CEO).

Key threats to auditor independence

Designing and implementing operational controls, or auditing an area/department previously managed (self-review).

Audit Committee composition rule

Must consist of independent/non-executive directors; executive directors are prohibited to prevent self-review.

Three Lines: 1st Line of Defense

Operations and operational management—identifies, assesses, and controls risks day-to-day.

Three Lines: 2nd Line of Defense

Risk management and compliance functions—provides framework, expertise, monitoring, and challenge without owning risk.

Three Lines: 3rd Line of Defense

Internal audit—provides independent and objective assurance on governance, risk management, and control.

Risk Appetite vs. Risk Capacity

Risk Appetite is willingness/desire to take risk; Risk Capacity is ability/resources to withstand risk (Appetite must be ≤ Capacity).

SARA Mnemonic for Risk Responses

Share (insurance, outsourcing), Avoid (stop activity), Reduce (implement controls), Accept (retain low risk).

CIA-RM Risk Management Steps

Context, Identify, Analyze, Respond, Monitor.

ORC Mnemonic (COSO Internal Control Objectives)

Operations (efficiency/effectiveness), Reporting (reliable financial/nonfinancial data), Compliance (adherence to laws). Governance is NOT an ORC category.

Preventive Controls

Controls designed to stop an error or irregularity BEFORE it occurs (e.g., approvals, segregation of duties, passwords).

Detective Controls

Controls designed to discover and flag errors or irregularities AFTER they occur (e.g., inventory counts, account reconciliations).

Green (Core Assurance) IA Roles in ERM

Evaluating risk processes, assessing significant risks, reviewing risk reporting, and assuring alignment with risk appetite.

Yellow (Consulting with Safeguards) IA Roles in ERM

Facilitating risk identification workshops, coaching management on risk responses, coordinating ERM activities (management must retain ownership).

Red (Prohibited) IA Roles in ERM

Setting risk appetite, deciding risk responses, implementing controls on behalf of management, or being accountable for risk management.

CROPS Mnemonic (Internal ERM Environment)

Culture & ethics, Risk appetite, Organizational structure, People, Systems & processes.

PESTLE Mnemonic (External ERM Environment)

Political, Economic, Social, Technological, Legal/regulatory, Environmental.

G-S-P-R-I Mnemonic (COSO ERM 2017 Components)

Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information, Communication & Reporting.

Barbell Wholesale Case: Credit Limit Risk & Control

Risk: Clerk approximates order amounts, leading to unapproved credit or bad debts. Control (Preventive): Credit department must verify exact order total against approved credit limits prior to release.

Barbell Wholesale Case: Unbilled Shipment Risk & Control

Risk: Goods shipped without generating an invoice because bills of lading are filed without matching. Control (Detective): Accounting regularly matches bill of lading sequence numbers against sales invoices.

Barbell Wholesale Case: Data Entry Discrepancy Risk & Control

Risk: Single clerk enters and files records, risking keying errors, omissions, or duplicate invoices. Control (Preventive/Detective): Batch control totals, invoice sequence checks, and independent monthly AR reconciliations.