AIRAF common mistakes
AIRAF · Understand the traps and how to avoid them.
Treating the three lines model as a hierarchy of authority and assigning risk-ownership duties to internal audit, so questions about who owns, monitors, and assures a given risk are answered with 'audit' or 'the board' rather than the business line.
Candidates memorize the three lines as a list of functions and never map each line to its accountability (own/operate, oversee/challenge, assure), so under time pressure they default to whichever function sounds most senior or most independent.
What to do instead
Before answering, restate the scenario as three verbs: who runs the process and owns the outcome (first line), who sets frameworks and challenges (second line), who gives independent assurance (third line). Drill with short scenarios where the correct answer is counterintuitive, e.g. a risk function that designs a control still does not own the residual risk.
Selecting the most conservative-sounding control or the strictest-sounding governance answer instead of the one that fits the stated risk appetite, materiality, or proportionality of the scenario.
Exam writers often include an extreme option that is technically defensible but disproportionate; candidates who equate 'more controls' with 'better risk management' pick it without checking it against the appetite or cost-benefit framing given in the stem.
What to do instead
Force yourself to locate the appetite, threshold, or proportionality cue in the stem and eliminate any option that overrides it. Practice classifying options as 'proportionate', 'disproportionate', and 'irrelevant' before choosing, and note that 'escalate to the board' is rarely right for an operational, low-materiality issue.
Confusing inherent risk with residual risk, or current risk with target risk, when reading a risk register or a heat-map description, and then computing or judging the wrong quantity.
These four labels appear in similar sentence structures, and candidates skim for the word 'risk' rather than the qualifier. Time pressure amplifies the habit of matching keywords instead of parsing the control environment described.
What to do instead
Build a one-line definition set and apply it mechanically: inherent = before controls; residual = after existing controls; target = desired after planned additional action; current = today. On every register question, underline the controls described and ask 'are these existing or proposed?' before selecting.
Judging likelihood and impact as if they were independent and then adding or averaging scores, rather than combining them multiplicatively or through the matrix the framework specifies.
Candidates carry over intuition from simple scoring exercises and assume risk score equals likelihood plus impact, or they average two analysts' ratings to 'be objective', which is not how ordinal scales behave.
What to do instead
Memorize that on ordinal scales you use the prescribed matrix lookup, not arithmetic; averaging ordinal ratings is invalid because the intervals are not equal. Practice questions that show a matrix and ask for the cell, and questions that ask why averaging two ordinal ratings is inappropriate.
Treating a statistical measure as if it answered a different question: reading VaR as a worst-case loss, expected shortfall as a probability, or a correlation as a causation, and then selecting an interpretation option built on that error.
The measures are taught with formulas but rarely with their failure boundaries, so candidates remember the number and not the caveat, and distractor options are deliberately written as plausible misreadings.
What to do instead
Attach one limitation sentence to each measure you study: VaR says nothing about the size of losses beyond the threshold; expected shortfall is an average of tail losses conditional on exceeding the threshold; correlation measures co-movement, not mechanism. When an option asserts a worst case or a cause, reject it unless the stem supplies that evidence.
Choosing a control type by its label rather than by what it actually does, e.g. calling a reconciliation 'preventive' because it is performed diligently, or calling segregation of duties 'detective' because it is reviewed.
Candidates classify controls by how important or how carefully performed they seem, rather than by timing (before, during, or after the event) and by mechanism (prevent, detect, correct, direct).
What to do instead
Classify on two axes: timing relative to the risk event and mechanism. Reconciliation and exception reports are detective; approvals, access restrictions, and input validation are preventive; backup restoration and incident remediation are corrective. Practice by writing the risk event first, then asking whether the control acts before or after it.
Assuming a control that is designed well is operating effectively, or accepting a documented procedure as evidence of control performance without asking for test evidence.
Design and operating effectiveness are taught together, and candidates collapse them. Stems that describe a policy document tempt the reader to conclude the control works.
What to do instead
Separate the two questions explicitly: does the control, as designed, address the risk (design)? and did it actually operate as designed throughout the period (operating)? Require evidence of operation, such as samples, logs, or test results, and treat a policy document alone as evidence of design only.
Reading a KRI or dashboard description and concluding the risk is 'under control' because the indicator is green, without checking whether the indicator is lagging, whether thresholds were set on stale baselines, or whether the metric captures the risk at all.
Green/amber/red framing invites a binary comfort response, and candidates skip the meta-question of whether the metric is a valid proxy for the risk it is meant to monitor.
What to do instead
For every monitoring question, ask three things: is the metric leading or lagging, is the threshold calibrated to the current appetite, and does the metric actually move with the risk? Reject 'no action needed' options when the stem shows a lagging indicator, a threshold breach trend, or a metric unrelated to the stated risk.
Escalating or reporting by seniority rather than by the reporting path the framework requires, e.g. routing a compliance breach to the board first, or omitting the regulator or the risk committee named in the scenario.
Candidates equate 'most serious' with 'most senior recipient' and forget that reporting lines, materiality thresholds, and regulatory notification duties determine the correct route and timing.
What to do instead
Map each scenario to its required recipients and deadlines before choosing: line management, risk function, committee, board, regulator, or external disclosure, in the order and timeframe the framework specifies. Practice stems that include a regulatory notification trigger and check whether the option respects both the internal path and the external duty.
Answering an ethics or conduct question with the legally permissible option when the stem asks for the professionally required or ethically appropriate action, or ignoring a conflict-of-interest disclosure step.
Candidates conflate 'not illegal' with 'acceptable', and distractor options are written to be lawful but beneath professional standards, so the legally safe answer looks correct.
What to do instead
Read the question stem for the standard being invoked: legal minimum, professional code, or firm policy, and answer to the highest standard named. When a personal interest, gift, or outside relationship appears, default to disclosure and recusal as the first step, and treat 'it was permitted by law' as insufficient when a professional standard applies.