Risk Management and Internal Controls
What the exam tests
Risk and internal control questions test risk identification, response selection, control design, and fraud prevention. Expect ERM, COSO components, preventive and detective controls, segregation of duties, the fraud triangle, and IT general controls.
Core rules and concepts
- ERM aligns risk appetite with strategy. Risk responses: avoid, reduce, share or transfer, accept. Residual risk remains after controls.
- COSO internal control components: control environment, risk assessment, control activities, information and communication, and monitoring. The control environment sets tone at the top.
- Control types: preventive (approval, segregation, access restriction), detective (reconciliation, exception report, audit), corrective (remediation). Preventive controls stop errors; detective controls find them later.
- Segregation of duties separates custody, authorization, recording and reconciliation. The fraud triangle: pressure or incentive, opportunity, rationalization.
- IT controls: access management, change management, backup and recovery, and monitoring. Control owners should be separate from control testers; monitoring includes ongoing and separate evaluations.
Worked example
In a purchase-to-pay process, one clerk creates vendors, approves purchase orders, receives goods, and releases payments. This is a severe segregation failure: the clerk could create a fictitious vendor and pay it. A control response is to separate vendor master maintenance, purchasing, receiving and payment approval; require a three-way match of purchase order, receiving report and invoice; and run an independent exception report for duplicate vendors and bank-detail changes. The risk is fraud and misstatement, not just inefficiency. A detective monthly reconciliation alone leaves too much time for loss, so a preventive structure is stronger. Residual risk should be reported to the board or audit committee with clear ownership and due dates.
Traps that cost marks
- Calling a reconciliation a preventive control.
- Treating risk acceptance as failure to control; it can be valid within appetite.
- Listing COSO components without linking them to the scenario.
- Assuming fraud requires only opportunity and ignoring pressure and rationalization.
- Relying on an annual audit as the main control over payments.