Risk Management and Internal Controls
Frameworks to know
Candidates should be fluent in COSO's Internal Control-Integrated Framework (five components, seventeen principles) and the ERM framework (governance and culture, strategy and objective-setting, performance, review and revision, information-communication-reporting). Also know the three lines model: business units own risk, risk and compliance oversee, internal audit assures.
The control vocabulary
Preventive controls stop errors; detective controls find them; corrective controls fix them. Segregation of duties separates authorization, custody, recording, and reconciliation. Traps ask which control type best mitigates a specific risk-for example, daily reconciliation is detective, not preventive, even though it deters fraud.
Risk assessment mechanics
Inherent risk, control risk, residual risk. Questions often confuse inherent (before controls) with residual (after controls). Risk appetite is the amount of risk the board accepts; risk tolerance is the acceptable variation around it. A common trap: treating a low-likelihood, high-impact risk as automatically low priority.
Testing controls
Design effectiveness asks whether a control, as designed, addresses the risk. Operating effectiveness asks whether it worked consistently over the period. A control can be well designed but poorly operated-questions love this distinction.
Worked example
A wire room requires two approvals over $50,000. Testing shows approvals exist in 95% of files. Rule of thumb: design is effective, but operating effectiveness fails because the threshold is not consistently applied; report it as a control deficiency and assess whether it is significant.
Deficiency classification
Deficiencies are categorized as deficiencies, significant deficiencies, or material weaknesses based on likelihood and magnitude.