Risk Assessment, Monitoring, and Auditing
Risk, controls, and assurance
Risk assessment identifies what could go wrong, estimates likelihood and impact, and prioritizes inherent risk before controls. Residual risk is what remains after controls. Candidates must distinguish control design (is it capable of preventing or detecting the issue?) from operating effectiveness (did it actually work over the period?). Monitoring is ongoing, management-driven activity; auditing is independent, periodic testing. Sampling, walkthroughs, and key risk indicators support conclusions, but sample design and documentation matter. Findings should be risk-rated, assigned an owner, tracked to closure, and root-caused.
Traps
Common traps include testing only design; concluding no exceptions from a biased or too-small sample; treating monitoring as audit; ignoring residual risk and risk appetite; and closing issues without evidence. Another trap is assuming automated controls always operate effectively without testing configuration or access.
Worked example
A firm reviews 20 of 10,000 transactions and finds no errors. That does not prove the control works; the sample may be unrepresentative. Rule of thumb: define the population, select a defensible sample, test both design and operation, and document the basis for conclusions.