III IC-85 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Hierarchy of authority

Statute and regulation outrank published standards, which outrank internal policy, which outranks informal practice. Exam items about conflicting requirements resolve upward through this chain.

Shall versus should

'Shall' denotes a mandatory requirement whose omission is a deficiency. 'Should' denotes expected practice that permits a documented, justified alternative. Items turn on this distinction.

Inherent versus residual risk

Inherent risk is exposure before controls are applied; residual risk is exposure remaining after controls operate. The difference evidences control effect and must be supported by testing.

Risk score formula

Risk score equals likelihood multiplied by impact. The product maps to a risk band, and treatment choice follows the band rather than the raw numeric value alone.

Control design versus operation

A control is effective only when properly designed and actually operating as designed. Exam scenarios often supply one condition and omit the other to create a trap.

Evidence hierarchy

Direct observation and system-generated records provide stronger evidence than interviews, which in turn outrank unverified management assertion. Conclusions should rest on the strongest available tier.

Exception handling sequence

Identify, contain, determine root cause, remediate, verify effectiveness, then report. Omitting the verification step is the most frequently offered incorrect sequence in exam items.

Proximate versus systemic cause

Proximate cause is the triggering event; systemic cause is the underlying condition that permitted it. Prevention-focused items reward the systemic cause.

Correlation versus causation

Two variables moving together without a controlled comparison establishes association only. A causal claim requires evidence that removes plausible alternative explanations.

Cost-benefit control test

Compare total control cost against expected loss reduction, computed as avoided probability multiplied by avoided impact. The comparison is not made against total asset value.

Sampling documentation

A defensible sample records population definition, selection method, and rationale. Convenience samples cannot support conclusions about the wider population.

Independence lookback rule

A reviewer must not review work they performed or supervised within the lookback period set by the applicable standard. Independence is assessed by role and time.

Reporting deadline independence

Regulatory reporting deadlines are calendar-based and do not pause for internal investigation. Late filing constitutes a separate violation from the underlying issue.

Materiality threshold direction

Applying a stricter threshold than required is generally acceptable; applying a looser threshold is not. Scoping decisions must be defensible against the stated requirement.

Professional skepticism

Neither assuming wrongdoing nor accepting assertions without corroboration. It is demonstrated by whether the practitioner sought independent evidence before concluding.

Ethical priority ordering

Public interest and legal compliance rank above employer loyalty, which ranks above personal convenience. Items presenting these in conflict resolve in that order.

Confidentiality duration

Confidentiality obligations survive engagement close. Disclosure is permitted only when legally required, client-authorized, or necessary to prevent serious harm under the applicable code.

Findings structure

Written findings state condition, criteria, cause, effect, and recommendation. A recommendation without an identified cause is unsupported and typically the wrong option.

Recommendation authority test

Recommendations must fall within the auditee's authority to implement. Recommending action the auditee cannot take is a recurring incorrect answer choice.

Objectivity in conclusions

Conclusions must rest on evidence documented before the conclusion was formed. Conclusions reverse-engineered from a desired outcome fail the objectivity test.

Competence boundary

A practitioner should decline work outside demonstrated competence rather than develop skill at the client's risk. Referral or additional qualified support is the correct response.

Stem qualifier effect

Words such as 'most likely', 'best', 'primary', and 'first' each select a different correct option from the same fact pattern. Read the qualifier before evaluating choices.

Negative stem handling

Stems containing 'EXCEPT' or 'NOT' require verifying that three options are true. The correct answer is the outlier, so each remaining option must be checked.

Absolute word heuristic

Options containing 'always', 'never', 'all', or 'guaranteed' are usually wrong in judgment items because standards permit documented, justified exceptions.

Scope-exceeding distractors

Options that add facts absent from the stem or exceed its stated scope are eliminable regardless of whether the added statement is independently true.

Role-specific correct action

Scenario items reward the action required by the role named in the stem. A correct action performed by the wrong role remains a distractor.

Estimate-before-compute rule

Estimate the expected magnitude before calculating. An option an order of magnitude away from the estimate is a distractor regardless of arithmetic detail.

Trend baseline consistency

Trend analysis requires an unchanged measurement definition across the series. Redefining the metric mid-series invalidates comparison and is a standard data-interpretation trap.

Incomplete data response

When data are incomplete, the defensible answer states the limitation and the resulting confidence level rather than extrapolating a precise figure from insufficient evidence.

Prioritization rule

Address items that are both high-impact and time-critical first. Urgency alone does not outrank impact when resources are constrained across competing demands.

Escalation timing rule

Where a scenario offers an escalation path, the earliest required notification point is usually correct over a later, more dramatic action such as external reporting.

Documentation timing

Documentation and record-retention obligations attach at the moment of the event, not at engagement close. Retroactive documentation is a classic incorrect answer.