Internal Acct Exam 2

ch 4 - 9

What is risk?

The effect of uncertainty on objectives; it can be positive or negative.

What is strategy?

A plan to achieve the organization's mission, vision, and goals.

What is risk appetite?

The type and amount of risk an organization is willing to accept.

What is risk assessment?

Identifying and analyzing risks and how serious they are.

What determines risk severity?

Likelihood, impact, and recovery time.

What is ERM?

A systematic process to identify, assess, and prioritize risks across an organization.

enterprise risk management

Risk response — Avoidance

Stop the activity that creates the risk

Risk response — Reduction

Use controls to lower the likelihood or impact of risk.

Risk response — Sharing

Transfer some risk to another party, such as through insurance.

Risk response — Acceptance

Accept the risk without taking additional action.

Risk response — Pursuit

Deliberately take on more risk to achieve an objective.

Risk response — Exploitation

Use an existing risk or opportunity to create value

What is COSO ERM's main goal?

Integrate risk with strategy and performance to create, preserve, and realize value.

What are the three sections of ISO 31000?

Principles, Framework, and Process.

What is Internal Audit's role in ERM?

Independently evaluate risk management and provide assurance and advice

What must Internal Audit NOT do in ERM?

Set risk appetite, make management's risk decisions, or accept risk ownership.

Name three Procure-to-Pay (P2P) risks.

Fake vendors, duplicate payments, and invoices paid without receiving goods.

What is a procedure manual?

A document explaining the steps to perform a task.

What is a policy?

A rule or guideline that directs behavior or decisions.

What is a process map?

A visual diagram showing the steps in a process.

What is a KPI?

A measurable value used to track performance against a goal.

What does a diamond mean in a flowchart?

A decision or question.

What is business process outsourcing (BPO)?

Hiring an outside company to perform a business activity.

Who remains responsible for outsourced risks?

the organization that outsourced the activity.

What is a control deficiency?

A missing, poorly designed, or ineffective control.

What are three limitations of internal controls?

Human error, collusion, and management override.

Do controls provide absolute assurance?

No. They provide reasonable, not absolute, assurance.

What happens if there are too few controls?

Risks may not be adequately managed.

What happens if there are too many controls?

Costs, delays, and inefficiencies can increase.

Who owns and operates internal controls?

Management

What is Internal Audit's role in controls?

Independently evaluate control design and effectiveness

What is an accounts receivable aging report?

A report grouping unpaid customer balances by how long they are overdue.

What does an old overdue receivable suggest?

A higher risk that the customer may not pay.

What is the purpose of an aging report?

Identify collection problems and assess receivable risks and controls

What is governance?

How an organization is directed, managed, and monitored.

What are the Three Lines?

governing body - accountability to stakeholders for org oversight

management - actions to achieve objectives

internal audit - independent assurance

What is the role of the third line?

Provide independent, objective assurance and advice. (IA)

What is the role of the governing body?

Accountability to stakeholders for organizational oversight; promotes integrity, leadership, and transparency.

What is the First Line's role?

Provide products/services to clients and manage risk.

What is the Second Line's role?

Provide expertise, support, monitoring, and challenge on risk-related matters.

Who is responsible for managing risk and achieving organizational objectives?

Management, including the First and Second Lines.

What is the relationship between Management and Internal Audit?

Alignment, communication, coordination, and collaboration.

What are external assurance providers?

Outside providers that offer additional assurance to the organization.

What is the IA Mandate?

The authority, role, and responsibilities of Internal Audit.

What is the IA Charter?

A formal document describing IA's mandate, position, reporting lines, and services.

Who should oversee Internal Audit?

The board, with support and interaction from senior management

What does organizational independence mean?

IA can perform its work without inappropriate interference.

To whom should the CAE report directly?

The board.

What is the CAE responsible for?

Leading Internal Audit and managing its strategy, resources, and performance.

How often is an external quality assessment required?

At least once every five years.

What is a risk-based audit plan?

An audit plan prioritizing areas with the greatest risks.

What should the CAE do about resource shortages?

Communicate the shortage and its impact to the board and management.

What is co-sourcing?

Using outside specialists alongside the internal audit team.

What is combined assurance?

Coordinating assurance providers to reduce gaps and duplicated work.

What are the six qualities of effective communication?

Accurate, objective, clear, concise, complete, and timely

What is QAIP?

Quality Assurance and Improvement Program; evaluates and improves IA quality.

What should IA do if management accepts inappropriate risk?

Discuss the concern and escalate unresolved issues to the board.

What does GIAS Standard 10.3 require?

CAE regularly evaluates IA technology and seeks improvements

What is a CAAT?

Computer-Assisted Audit Technique; technology used to perform audit work

What is ACL used for?

Importing, analyzing, and reporting on large datasets for audits.

What are the five spreadsheet control types?

Access, data validation, data integrity, data analysis, and automation.

Spreadsheet control — Access

Restricts who can view or change spreadsheet content.

Spreadsheet control — Data Validation

Restricts or guides what users can enter.

Spreadsheet control — Data Integrity

Helps keep data accurate, consistent, and reliable.

Spreadsheet control — Data Analysis

Turns raw data into useful information.

Spreadsheet control — Automation

Uses tools like MACROS to perform tasks automatically.

What is an ERP system?

A system integrating information across business functions.

What are audit workpapers?

Documents recording audit procedures, evidence, testing, and conclusions.

What are the four Vs of data?

Volume, Velocity, Variety, and Veracity.

What does Veracity mean?

accuracy, reliability, and trustworthiness of data.

What is descriptive analytics?

“What happened?” Summarizes historical data.

What is diagnostic analytics?

“Why did it happen?” Investigates causes.

What is predictive analytics?

“What is likely to happen?” Forecasts future outcomes.

What is prescriptive analytics?

“What should we do?” Recommends actions or decisions.

What should guide audit technology selection?

Available resources, fit with IA strategy, and technical support.

What are the five COSO ERM focus areas?

Governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

What are the five components of the COSO Internal Control Framework?

Control environment, risk assessment, control activities, information and communication, and monitoring activities.

What are the four types of risk response besides acceptance?

Avoidance, reduction, sharing, and pursuit/exploitation.

What are Domain IV's four main management principles?

Plan strategically, manage resources, communicate effectively, and enhance quality.

What is the difference between CAAT and ACL?

CAAT is the broad category of technology-based audit techniques

ACL is a specific audit analytics tool.

What is the difference between management and Internal Audit?

Management owns and operates controls; IA independently evaluates them.

What is the difference between a control problem and poor performance?

Poor performance is a result; a control problem means a control is missing or ineffective. Poor performance may require investigation.