Governance, Risk Management, and Control
This domain tests how well you understand the frameworks internal audit works inside: how governance, risk management, and control fit together, and what the Standards require internal audit to evaluate and contribute to.
What the Standards require
- Standard 2100 requires internal audit to evaluate governance and contribute to its improvement; 2110 covers ethical culture, performance management, and communication of risk and control information.
- Standard 2120: internal audit evaluates whether risk management processes are effective and whether risks are identified, assessed, and managed within risk appetite.
- Standard 2130: internal audit must evaluate the adequacy and effectiveness of controls, not design or operate them; recommendations are advice to management.
- In the Three Lines Model, governance sits with the board, the first line owns and manages risk, the second line provides expertise and oversight, and internal audit provides independent assurance.
Frameworks
- COSO's internal control framework comprises five components: control environment, risk assessment, control activities, information and communication, and monitoring.
- COSO ERM organizes risk work into governance and culture, strategy and objective setting, performance, review and revision, and information, communication, and reporting.
- Inherent risk is risk before controls; residual risk is what remains after controls operate. Risk appetite sets the acceptable level of residual risk.
- Control types: preventive, detective, directive, and corrective. Adequacy is about design; effectiveness is about how the control operated in practice.
Worked example
An audit finds that purchase orders require the controller's approval above $10,000, a properly designed control. Testing of 40 transactions shows nine approvals came from the accounts payable supervisor. The control is adequate in design but ineffective in operation. The finding should say so precisely, attribute the failure to operating practice, and recommend a control activity such as system-enforced approval limits rather than a general reminder to staff.
Traps that cost marks
- Confusing inherent and residual risk when assessing whether a risk is acceptable.
- Concluding that internal audit manages risk because it evaluates it.
- Treating a well-designed control as effective without testing operation.
- Citing COSO as a mandatory IPPF element rather than an accepted framework.