IIA CRMA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance structure in which operating management owns risk, an independent oversight function monitors and challenges it, and internal audit provides independent assurance to the governing body.

First line of defense

Operating management that identifies, owns, and manages risk day to day, implementing controls and accepting accountability for outcomes within its assigned business processes and objectives.

Second line of defense

Risk, compliance, and quality functions that set frameworks, monitor exposures, and challenge the first line, providing oversight without assuming ownership of the underlying business risk.

Third line independence

Internal audit reports functionally to the governing body and avoids operational responsibilities, preserving the objectivity needed to conclude on risk management effectiveness without self-review.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, approved by the governing body and expressed in qualitative and quantitative terms.

Risk tolerance

The acceptable variation in performance around a specific objective, translating broad risk appetite into measurable limits that management and assurance can monitor and test.

Risk criteria

Defined thresholds and scales used to evaluate the significance of risk, including likelihood, impact, velocity, and aggregation, applied consistently across the enterprise.

COSO ERM components

Governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting. Assurance maps evidence and conclusions to these five components.

ISO 31000 process

Scope and context, identification, analysis, evaluation, treatment, plus continuous communication and consultation and monitoring and review, applied iteratively rather than as a one-time sequence.

Assurance versus consulting

Assurance engagements independently conclude on risk management effectiveness against criteria; consulting engagements advise or facilitate without expressing an effectiveness conclusion, preserving objectivity.

Residual risk

The risk remaining after controls are applied, calculated from inherent risk adjusted for control design and tested operating effectiveness rather than management's self-assessment alone.

Inherent risk

The exposure that exists before considering controls, assessed by impact, likelihood, velocity, complexity, and regulatory exposure, and used to rank auditable entities for coverage.

Risk-based audit plan

A coverage plan that ranks auditable entities by residual risk and allocates assurance resources accordingly, with documented rationale for inclusions, exclusions, and frequency.

Engagement objectives

Statements of the risk management question to be answered and the scope boundaries, including processes, entities, systems, and period, that frame the assurance work.

Engagement criteria

The standards against which risk management is evaluated, such as framework requirements, regulation, or internal policy; every finding must cite the criterion breached.

Risk register quality

Risks stated as cause and consequence tied to objectives, with named owners, defined rating scales, documented controls and residual ratings, and updates after incidents or change.

Key controls

Controls that most reduce a significant risk, selected for extensive testing because failure would materially affect objectives, distinguishing them from secondary or compensating controls.

Reliance on other providers

Using work performed by the second line, external audit, or regulators after evaluating competence, objectivity, and scope, with documented basis and coordination to avoid duplication.

Sufficient appropriate evidence

Evidence that is enough in quantity and relevant and reliable in quality to support conclusions, with externally validated sources generally stronger than management assertions.

Walkthrough purpose

Confirming understanding of process flow and control design through tracing a transaction, which supports design conclusions but does not establish operating effectiveness over a period.

Attribute sampling

A method estimating the deviation rate in a population, with sample size driven by tolerable deviation, expected deviation, and confidence, requiring a complete and homogeneous population.

Risk and control matrix

A working paper linking each significant risk to controls, assertions, test procedures, and evidence references, serving as the primary structure for an assurance engagement.

Root cause analysis

Distinguishing symptoms from underlying causes such as unclear ownership, inadequate staffing, or conflicting incentives, so that recommendations address why a deficiency occurred.

Finding structure

Condition, criteria, cause, effect, and recommendation, stating what was found, the standard breached, why it happened, the exposure, and agreed action with owner and date.

Control design versus operation

Design testing asks whether a control could address the risk as documented; operating effectiveness testing asks whether it actually performed consistently over the period.

Test of one

Examining a single instance, which can support conclusions about control design or existence but cannot support conclusions about operating effectiveness across a period.

Assurance opinion basis

An overall conclusion requires explicit scope and criteria plus sufficient evidence; scope limitations are disclosed rather than issuing an unqualified opinion.

Issue escalation

Reporting findings to process management for action and to the governing body when risk exceeds appetite, significant risk is accepted, or remediation stalls.

Risk acceptance authority

Documented authorization, at a level defined by policy, for management to accept a reported exposure, with internal audit still reporting the residual risk to the governing body.

Remediation follow-up

Verifying fixes through evidence of implementation and retesting the control rather than accepting management's statement, while tracking open issues against agreed due dates.

Key risk indicators

Metrics with defined thresholds that signal rising exposure, monitored continuously and escalated when breached, supporting assurance conclusions about ongoing risk monitoring.

Quality assurance improvement program

Internal and periodic external assessments that evaluate whether the assurance function conforms to standards and remains credible in its conclusions.