Risk Management and Internal Control
What this domain tests
The exam tests the COSO ERM and Internal Control frameworks, risk identification and response, control design and monitoring, and the roles of management, internal audit and the board.
Core rules
- COSO ERM (2017) has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.
- COSO Internal Control (2013) has five components: control environment, risk assessment, control activities, information and communication, and monitoring.
- Risk response: avoid, reduce, share or accept. Acceptance must be documented and within risk appetite.
- Control types: preventive, detective and corrective; manual and automated. Segregation of duties separates custody, authorisation, recording and reconciliation.
- Fraud triangle: pressure, opportunity and rationalisation.
Worked example
In a purchase cycle, one clerk raises the purchase order, receives goods and approves the invoice for payment. This creates opportunity for fictitious vendors and theft. The fix is to segregate authorisation (purchase order), custody (goods receipt), recording (accounts payable) and reconciliation (treasury). A three-way match between order, receipt and invoice is a detective control. The control environment weakness is more serious than the individual error because it permits recurrence.
Traps
Confusing ERM with internal control; classifying monitoring as a control activity; treating risk assessment as a one-off exercise; accepting risk without a documented rationale; and ignoring IT general controls when relying on automated application controls.