Risk Management and Internal Control
This domain tests whether you can build a risk framework and judge whether controls actually mitigate the risk, including classifying control deficiencies and applying the three lines model.
Core rules
- COSO ERM (2017) has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting - supported by twenty principles.
- ISO 31000 process: establish context, identify, analyse, evaluate, treat, monitor and communicate. Treatment options are avoid, reduce, transfer, accept.
- Risk appetite is the aggregate risk the entity will accept; risk tolerance is the acceptable variation around a specific objective; capacity is the maximum risk it can bear.
- Three lines model (IIA 2020): management owns and manages risk (first line); risk and compliance functions provide independent oversight (second line); internal audit provides independent assurance (third line), reporting to the audit committee.
- Controls are preventive, detective or corrective; manual or automated; entity-level or transaction-level. Key controls should be tested for design and operating effectiveness.
- Deficiency taxonomy: deficiency, significant deficiency (merits audit committee attention), material weakness (reasonable possibility of material misstatement not prevented or detected).
Worked example
A risk register rates a vendor-payment fraud risk at likelihood 4 and impact 5 on a 5×5 matrix - gross score 20, above the appetite threshold of 12, so treatment is mandatory. Segregation of duties between vendor master creation and payment release cuts likelihood to 2, giving a residual score of 10, within appetite. Because the residual sits close to tolerance and the control is manual, the auditor recommends automated three-way matching and quarterly independent review, then re-tests. Note the logic: score gross, treat, score residual, compare with appetite, monitor.
Traps
Reporting the residual score as the inherent risk; treating a compensating control as eliminating rather than reducing risk; and calling every issue a material weakness - the classification must be tied to the possibility of material misstatement.