I85PREP
⌘ K
CGIA study materials
CGIA study resources

CGIA practice questions

One question at a time. Build your CGIA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Internal Audit Fundamentals, IIA Standards, and the IPPF

Under the IIA Global Internal Audit Standards, which two components together make up the IPPF's mandatory elements for internal auditors?

  1. The Global Internal Audit Standards and the Topical Requirements Correct answer.
  2. The Core Principles and the Supplemental Guidance
  3. The Definition of Internal Auditing and the Implementation Guides
  4. The Code of Ethics and the Practice Advisories

Explanation

The current IPPF framework comprises the Global Internal Audit Standards, which include the Core Principles, Code of Ethics, and Standards, plus the Topical Requirements that address specific subject areas. Both are mandatory for internal audit functions and individual auditors. Practice Advisories and Implementation Guides are non-mandatory guidance, so they cannot be the correct answer.

Question 2Internal Audit Fundamentals, IIA Standards, and the IPPF

Which statement best describes the purpose of the Core Principles in the Global Internal Audit Standards?

  1. They list the specific technical competencies required of every chief audit executive
  2. They prescribe detailed audit procedures for each engagement
  3. They set out the fundamental principles that internal auditors should demonstrate Correct answer.
  4. They replace the Code of Ethics as the primary ethical framework

Explanation

The Core Principles articulate the fundamental principles that guide the professional practice of internal auditing, such as integrity, objectivity, and demonstrating quality and continuous improvement. They are broad principles, not detailed procedures or competency lists. They complement rather than replace the Code of Ethics.

Question 3Internal Audit Fundamentals, IIA Standards, and the IPPF

The IIA's Definition of Internal Auditing describes internal auditing as an independent, objective assurance and consulting activity designed to do what?

  1. Guarantee the accuracy of the organization's external financial statements
  2. Add value and improve an organization's operations Correct answer.
  3. Enforce compliance with government regulations
  4. Replace the external audit function for private entities

Explanation

The Definition states that internal auditing is designed to add value and improve an organization's operations. It does this by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes. It is not a guarantee of financial statements, a substitute for external audit, or an enforcement function.

Question 4Internal Audit Fundamentals, IIA Standards, and the IPPF

According to the Global Internal Audit Standards, which arrangement best preserves the objectivity of the chief audit executive?

  1. Reporting functionally and administratively to the chief financial officer
  2. Reporting administratively to the audit committee and functionally to the CFO
  3. Reporting functionally to the audit committee and administratively to senior management Correct answer.
  4. Reporting functionally to the external auditor and administratively to the CEO

Explanation

The Standards require the chief audit executive to report functionally to the board, usually through its audit committee, which preserves independence and objectivity over audit scope, reporting, and appointment matters. Administrative reporting to senior management supports day-to-day operations without compromising functional independence. Reporting to the CFO or external auditor creates conflicts and undermines objectivity.

Question 5Internal Audit Fundamentals, IIA Standards, and the IPPF

Which activity would most clearly impair an internal auditor's objectivity during an engagement?

  1. Using data analytics to test a sample of transactions
  2. Interviewing operating staff about control procedures
  3. Reviewing a process the auditor previously designed and implemented Correct answer.
  4. Documenting workpapers in a shared electronic repository

Explanation

Objectivity is impaired when an auditor evaluates work they previously performed, such as designing and implementing a process, because they cannot objectively assess their own work. Documentation, interviewing, and data analytics are normal audit techniques that do not create self-review threats.

Question 6Internal Audit Fundamentals, IIA Standards, and the IPPF

What is the primary purpose of the Code of Ethics within the Global Internal Audit Standards?

  1. To specify the format of audit reports issued to the board
  2. To define the scope of internal audit engagements
  3. To promote an ethical culture in the profession by setting principles and rules of conduct Correct answer.
  4. To establish minimum continuing education hours for internal auditors

Explanation

The Code of Ethics sets principles and rules of conduct that internal auditors must apply, promoting an ethical culture in the profession. It addresses integrity, objectivity, confidentiality, and competency. It does not set education hours, engagement scope, or reporting formats.

Question 7Internal Audit Fundamentals, IIA Standards, and the IPPF

Which document formally defines the internal audit activity's purpose, authority, and responsibility?

  1. The audit report
  2. The internal audit charter Correct answer.
  3. The annual audit plan
  4. The engagement work program

Explanation

The internal audit charter is a formal document approved by the board that defines the internal audit activity's purpose, authority, and responsibility. It establishes the activity's position within the organization and authorizes access to records and personnel. Work programs, audit plans, and audit reports are operational documents that flow from the charter.

Question 8Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal auditor is assigned to audit the procurement function and learns that a close family member is the department's purchasing manager. What is the most appropriate action under the Standards?

  1. Proceed with the engagement and disclose the relationship only in the final report
  2. Delegate the entire engagement to a junior auditor without informing anyone
  3. Decline the assignment and disclose the potential conflict to the chief audit executive Correct answer.
  4. Perform the engagement but have the purchasing manager review the draft findings

Explanation

Internal auditors must avoid conflicts of interest and disclose any impairment to objectivity to the chief audit executive, who should reassign the work. Proceeding with the engagement, even with disclosure, does not eliminate the self-interest and familiarity threat. Silently delegating without disclosure also fails the transparency requirement.

Question 9Internal Audit Fundamentals, IIA Standards, and the IPPF

Which of the following best describes the distinction between assurance and consulting services in internal auditing?

  1. Assurance involves objective assessment of evidence to provide an independent opinion, while consulting is advisory in nature and generally performed at the request of the client Correct answer.
  2. Consulting services must be approved by the external auditor before they begin
  3. Assurance services are performed only for external stakeholders, while consulting is for internal stakeholders
  4. Assurance engagements are non-mandatory, while consulting engagements are mandatory

Explanation

Assurance services involve the internal auditor's objective assessment of evidence to provide an independent opinion or conclusion on governance, risk management, and control. Consulting services are advisory and generally performed at the specific request of an engagement client, with the nature and scope agreed with that client. Both serve internal stakeholders, and neither requires external auditor approval.

Question 10Internal Audit Fundamentals, IIA Standards, and the IPPF

The chief audit executive is asked to assume operational responsibility for implementing a new enterprise risk management system. How should the CAE respond to preserve compliance with the Standards?

  1. Accept the role only if the board approves the arrangement in writing
  2. Accept the role because ERM is closely related to internal audit's mission
  3. Accept the role but assign audit staff to perform both the implementation and the subsequent audit
  4. Decline operational ownership and instead offer assurance and advisory support on ERM design and effectiveness Correct answer.

Explanation

Assuming management responsibility for implementing ERM would impair the internal audit activity's independence and objectivity, because the function would later audit its own work. The CAE should decline operational ownership and provide assurance or advisory services instead. Board approval cannot cure a fundamental self-review threat.

Question 11Internal Audit Fundamentals, IIA Standards, and the IPPF

Which statement correctly describes the relationship between the internal audit activity's risk assessment and the annual audit plan?

  1. The audit plan should be based on a documented risk assessment conducted at least annually Correct answer.
  2. The audit plan must cover every auditable entity every year
  3. The audit plan should be set solely by senior management without internal audit input
  4. The audit plan should be based on the prior year's plan without reassessment

Explanation

The Standards require the chief audit executive to base the audit plan on a documented risk assessment undertaken at least annually. The risk assessment considers the organization's risk appetite and input from senior management, the board, and other stakeholders. Plans are updated as risks change, and full annual coverage of every entity is rarely feasible or required.

Question 12Internal Audit Fundamentals, IIA Standards, and the IPPF

During an engagement, an internal auditor discovers evidence suggesting senior management may be involved in fraudulent financial reporting. According to the Standards, what should the auditor do first?

  1. Report the matter to the chief audit executive so it can be elevated appropriately, potentially to the board or audit committee Correct answer.
  2. Confront the suspected managers directly to obtain a confession
  3. Include the allegation in the routine engagement report without special escalation
  4. Wait until the next scheduled audit to gather additional evidence

Explanation

When fraud indicators point to senior management, the auditor should report the matter to the chief audit executive, who evaluates it and escalates to the board or audit committee as appropriate. Direct confrontation, routine reporting, or delay could allow evidence to be destroyed and would fail to protect the organization. Confidentiality and due professional care govern how the matter is handled.

Question 13Internal Audit Fundamentals, IIA Standards, and the IPPF

Which of the following is an example of a control that addresses the risk of unauthorized changes to a payroll master file?

  1. Distributing pay slips electronically to employees
  2. Requiring dual authorization and logging of all master file changes Correct answer.
  3. Conducting an annual employee engagement survey
  4. Providing payroll staff with a written code of conduct

Explanation

Dual authorization combined with logging of changes is a preventive and detective control directly aimed at unauthorized master file changes. A code of conduct, engagement surveys, and electronic pay slips do not control access to the master file. Effective controls should be proportionate to the specific risk identified.

Question 14Internal Audit Fundamentals, IIA Standards, and the IPPF

An auditor wants to confirm that a control operated consistently throughout the year rather than only at year-end. Which approach best provides evidence of operating effectiveness over the period?

  1. Interviewing the control owner about year-end results
  2. Testing a sample of control executions spread across the entire period Correct answer.
  3. Reviewing the control's design documentation once
  4. Observing the control on a single day in December

Explanation

Testing a sample of control executions distributed across the full period provides evidence that the control operated consistently throughout the year. Design documentation and a single observation or interview provide limited evidence about operation over time. Sampling across the period also helps detect changes in control performance.

Question 15Internal Audit Fundamentals, IIA Standards, and the IPPF

Which statement best describes the concept of due professional care in internal auditing?

  1. It requires the auditor to apply the care and skill expected of a reasonably prudent and competent internal auditor Correct answer.
  2. It requires the auditor to perform 100 percent testing on every engagement
  3. It requires the auditor to guarantee that no errors or fraud exist
  4. It requires the auditor to avoid using professional judgment

Explanation

Due professional care means applying the care and skill expected of a reasonably prudent and competent internal auditor in similar circumstances. It does not imply infallibility, exhaustive testing, or the suspension of judgment. It also requires consideration of the cost of assurance relative to the benefits.

Question 16Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal auditor is planning an engagement and must decide whether the evidence gathered is sufficient and appropriate. Which factor most directly influences the sufficiency of evidence?

  1. The seniority of the auditee's manager
  2. The level of risk associated with the area under review Correct answer.
  3. The color scheme used in the workpapers
  4. The length of the final report

Explanation

Sufficiency refers to the quantity of evidence, which is influenced by the risk of the area under review and the quality of the evidence obtained. Higher-risk areas generally require more persuasive evidence. Presentation choices, manager seniority, and report length do not determine evidence sufficiency.

Question 17Internal Audit Fundamentals, IIA Standards, and the IPPF

Which of the following best illustrates the internal audit activity's role in the organization's governance process?

  1. Assessing whether governance processes promote ethics, values, and accountability Correct answer.
  2. Setting the organization's strategic objectives
  3. Approving the organization's financial statements
  4. Selecting the external audit firm

Explanation

Internal audit supports governance by assessing and evaluating whether governance processes are effective in promoting ethics, appropriate values, and accountability. Setting strategy, approving financial statements, and selecting the external auditor are responsibilities of management and the board, not internal audit.

Question 18Internal Audit Fundamentals, IIA Standards, and the IPPF

An engagement client disagrees with a significant audit finding. According to the Standards, how should the auditor handle the disagreement in the final communication?

  1. Escalate the matter to the external auditor for resolution
  2. Omit the client's view because it may confuse readers
  3. Include the disagreement and the auditor's position in the report Correct answer.
  4. Remove the finding to preserve a cooperative relationship

Explanation

The Standards require the final communication to include the engagement client's views and any disagreement, along with the auditor's position. Removing the finding or omitting the client's perspective undermines the report's accuracy and transparency. Disagreements are not resolved by referral to the external auditor.

Question 19Internal Audit Fundamentals, IIA Standards, and the IPPF

Which situation most clearly demonstrates that an internal auditor has complied with the confidentiality principle of the Code of Ethics?

  1. Posting anonymized findings on a public forum
  2. Discussing confidential matters only with those authorized to receive them Correct answer.
  3. Storing sensitive workpapers on a personal device without controls
  4. Sharing engagement findings with a friend at a social gathering

Explanation

The confidentiality principle requires internal auditors to be prudent in the use and protection of information acquired in the course of their duties and to disclose it only to authorized parties. Sharing at social events, public posting, or unprotected personal storage breaches this principle. Compliance is demonstrated by restricting disclosure to those with a legitimate need to know.

Question 20Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal auditor concludes that a control is ineffective but that the resulting risk is mitigated by a compensating control elsewhere in the process. How should the auditor report this?

  1. Omit the finding because the risk is acceptable
  2. Report the control as effective because overall risk is mitigated
  3. Report the control as ineffective and explain the mitigating compensating control Correct answer.
  4. Report the compensating control as the primary control without mentioning the deficiency

Explanation

The auditor should report the ineffective control as a finding while describing the compensating control that mitigates the related risk, giving readers a complete and accurate picture. Reporting the control as effective would misstate its operation, and omitting the finding conceals a deficiency. The report should distinguish the primary control's failure from the mitigating effect of the compensating control.

Question 21Internal Audit Fundamentals, IIA Standards, and the IPPF

The chief audit executive is developing a quality assurance and improvement program. Which element is required to provide an external assessment of the internal audit activity?

  1. Periodic self-assessments by the CAE
  2. An external assessment conducted at least once every five years by a qualified, independent assessor or assessment team Correct answer.
  3. An annual review by the external financial auditor
  4. Ongoing internal monitoring performed by the audit staff

Explanation

The Standards require an external assessment at least once every five years by a qualified, independent assessor or assessment team from outside the organization. Ongoing monitoring and periodic self-assessments are internal elements of the quality program. The external financial auditor's annual review does not satisfy the external assessment requirement.

Question 22Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal audit activity is considering whether to rely on the work of the external auditor. Which condition is most important for the CAE to evaluate before relying on that work?

  1. Whether the external auditor is independent, competent, and uses a systematic and disciplined approach Correct answer.
  2. Whether the external auditor's report will be published before the internal audit report
  3. Whether the external auditor has offices in the same city as the organization
  4. Whether the external auditor's fees are comparable to the internal audit budget

Explanation

Before relying on the work of other assurance providers, the CAE should evaluate their independence, objectivity, competence, and whether they apply a systematic and disciplined approach. Fee levels, report timing, and office location are not relevant criteria for reliance. A documented evaluation supports the coordination of assurance efforts.

Question 23Internal Audit Fundamentals, IIA Standards, and the IPPF

An auditor identifies a situation where the board has overridden a key internal control. Which course of action best reflects the Standards on communicating risk and control issues?

  1. Defer reporting until the next annual audit plan cycle
  2. Treat the override as immaterial because the board has ultimate authority
  3. Discuss it only with the operating manager responsible for the control
  4. Communicate the matter to the audit committee or board and document the issue and response Correct answer.

Explanation

Board-level overrides of internal controls are significant governance matters that must be communicated to the audit committee or board and documented. Board authority does not make the override immaterial, and limiting discussion to an operating manager or deferring reporting fails to escalate a high-level risk appropriately. The communication should include the issue and management's response.

Question 24Internal Audit Fundamentals, IIA Standards, and the IPPF

A chief audit executive is evaluating whether a proposed consulting engagement would impair the internal audit activity's independence. Which factor is most relevant to that determination?

  1. Whether the client has requested the engagement in writing
  2. Whether the engagement would require internal audit to assume management responsibilities or make management decisions Correct answer.
  3. The number of audit staff available to perform the work
  4. The size of the consulting fee relative to the audit budget

Explanation

The key independence consideration for consulting engagements is whether internal audit would assume management responsibilities or make decisions that management should own. Doing so creates a self-review threat when the activity later provides assurance over the same area. Fees, staffing, and written requests are operational factors but do not determine independence impairment.

Question 25Internal Audit Fundamentals, IIA Standards, and the IPPF

An auditor is assessing whether the internal audit activity's charter remains adequate. Which circumstance most strongly indicates the charter should be reviewed and updated?

  1. The audit committee meets one additional time during the year
  2. The audit team adopts a new workpaper template
  3. The organization changes its office supply vendor
  4. A new chief audit executive is appointed and the organization restructures its reporting lines Correct answer.

Explanation

A change in the chief audit executive combined with a restructuring of reporting lines can alter the activity's purpose, authority, and reporting relationships, making a charter review necessary. The Standards require periodic review of the charter to confirm it remains adequate and is approved by the board. Template changes, vendor changes, and meeting frequency do not affect the charter's substance.

Question 26Internal Audit Fundamentals, IIA Standards, and the IPPF

Under the Global Internal Audit Standards, which two components together make up the IPPF's mandatory elements for internal auditors and the internal audit activity?

  1. The charter and the quality assurance and improvement program
  2. The Code of Ethics and the Standards Correct answer.
  3. The Standards and the implementation guidance
  4. The glossary and the supplemental guidance

Explanation

The IPPF framework distinguishes mandatory and non-mandatory elements. The Code of Ethics and the Global Internal Audit Standards are the mandatory components that internal auditors and the internal audit activity must conform with, while guidance and supplemental materials are supportive rather than binding.

Question 27Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal audit activity must be positioned to fulfill its responsibilities objectively. According to the Global Internal Audit Standards, to whom should the chief audit executive report functionally?

  1. The external auditor
  2. The chief financial officer
  3. The chief operating officer
  4. The board or its audit committee Correct answer.

Explanation

The Standards require the chief audit executive to report functionally to the board, typically through its audit committee, so that the activity can act independently of management. Administrative reporting may run to senior management, but functional reporting to the board preserves the authority and objectivity the activity needs.

Question 28Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal auditor is assigned to review the treasury function and drafts an engagement work program. Which element must the work program establish before fieldwork begins?

  1. The budget line that will fund any remediation
  2. The names of the external auditors who will rely on the results
  3. The specific procedures to be performed to gather sufficient and appropriate evidence Correct answer.
  4. The final rating to be assigned to the treasury function

Explanation

The engagement work program translates the engagement objectives into the detailed procedures needed to obtain sufficient, reliable, relevant, and useful evidence. It is prepared before the engagement begins and is approved by the engagement supervisor, but it does not pre-judge the outcome.

Question 29Internal Audit Fundamentals, IIA Standards, and the IPPF

An internal auditor is drafting a finding on a weak reconciliation control. Which combination of elements is required for the finding to be complete?

  1. Risk appetite, tolerance, and residual risk
  2. Scope, budget, and timeline
  3. Criteria, condition, cause, and effect Correct answer.
  4. Charter, policy, and procedure

Explanation

A well-formed finding links the criteria (what should be) with the condition (what is), the cause (why it happened), and the effect (the risk or impact). Together these give management the information needed to act, and omitting any element weakens the finding's usefulness.

Question 30Internal Audit Fundamentals, IIA Standards, and the IPPF

The chief audit executive learns that a senior manager has begun directing which specific transactions the internal audit activity will examine, limiting the scope of an approved engagement. Which action best reflects the Standards' requirements on scope impairment?

  1. Reassign the engagement to a co-sourced provider and close the matter
  2. Escalate the scope limitation to the board and disclose its effect on the engagement's conclusions Correct answer.
  3. Expand the engagement timeline until management withdraws the restriction
  4. Accept the restriction and document it in the engagement file without escalation

Explanation

When a scope limitation threatens the internal audit activity's ability to achieve its objectives, the chief audit executive must raise the matter with the board so it can be resolved at the appropriate governance level. The limitation and its potential effect on conclusions must be communicated rather than absorbed quietly.

Question 31Governance, Risk Management, and Control Frameworks

In an IT governance framework, which body typically holds ultimate accountability for ensuring that IT risks are identified and managed across the enterprise?

  1. The external penetration testing vendor
  2. The IT service desk team lead
  3. The board of directors or its delegated risk committee Correct answer.
  4. The database administration group

Explanation

Accountability for enterprise IT risk rests at the top of the governance structure, normally the board or a committee to which it has formally delegated oversight. Operational teams and vendors execute controls but do not own enterprise-level risk acceptance.

Question 32Governance, Risk Management, and Control Frameworks

A risk management program records a risk with likelihood rated high and impact rated low, giving a moderate inherent score. What does the inherent score represent?

  1. The exposure before any controls or mitigations are applied Correct answer.
  2. The exposure remaining after controls have been tested
  3. The regulatory penalty if the risk materializes
  4. The cost of the controls currently deployed

Explanation

Inherent risk is the exposure that exists in the absence of controls, providing a baseline against which control value can be judged. Residual risk, by contrast, is what remains after controls operate.

Question 33Governance, Risk Management, and Control Frameworks

Which statement best describes the purpose of a control framework such as COBIT or ISO/IEC 27001 Annex A?

  1. It supplies a structured catalogue of practices or controls that organizations tailor to their own risk profile Correct answer.
  2. It replaces the need for internal audit because the framework is externally validated
  3. It certifies that an organization has achieved zero residual risk
  4. It prescribes a single mandatory technology stack for all adopters

Explanation

Frameworks provide a common structure and reference set of controls or practices; applicability and implementation are determined by each organization's risk assessment and obligations. They are guidance structures, not guarantees of zero risk or mandated products.

Question 34Governance, Risk Management, and Control Frameworks

An organization defines a risk appetite statement that explicitly prohibits storing regulated customer data outside approved jurisdictions. Which governance artifact does this statement most directly represent?

  1. A configuration baseline for servers
  2. An incident response escalation matrix
  3. A business continuity plan recovery objective
  4. A risk appetite statement with a defined tolerance boundary Correct answer.

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept, and tolerances translate that appetite into concrete boundaries. A prohibition on cross-border data storage is a boundary derived from appetite.

Question 35Governance, Risk Management, and Control Frameworks

Under the three lines model, which group provides independent assurance to the governing body regarding the effectiveness of risk management and controls?

  1. The first-line operational business units
  2. The third-party managed service provider
  3. Internal audit Correct answer.
  4. The second-line risk and compliance function

Explanation

Internal audit forms the independent assurance layer that reports objectively to the governing body. First-line units own and manage risk, while second-line functions set frameworks and monitor compliance.

Question 36Governance, Risk Management, and Control Frameworks

Which activity is characteristic of the second line in a three lines model?

  1. Establishing risk policies and monitoring whether business units comply with them Correct answer.
  2. Approving the annual financial statements
  3. Designing and operating the production change management process
  4. Auditing the effectiveness of the risk framework

Explanation

The second line provides expertise, policy, and oversight, monitoring first-line compliance without owning the operational process. Operating the process itself belongs to the first line.

Question 37Governance, Risk Management, and Control Frameworks

A control is described as preventive rather than detective. Which example best fits a preventive control for privileged access?

  1. Requiring multi-factor authentication before a privileged session is established Correct answer.
  2. Investigating alerts generated after an unauthorized privilege escalation
  3. Reviewing privileged account activity logs each month
  4. Reconciling privileged accounts against an approved list quarterly

Explanation

Preventive controls stop an event before it occurs, so enforcing authentication before access is granted is preventive. Log review, reconciliation, and alert investigation all detect conditions after the fact.

Question 38Governance, Risk Management, and Control Frameworks

A risk register entry shows inherent risk high, control effectiveness rated strong, and residual risk medium. A manager argues the residual rating means the control set is adequate. What is the most defensible interpretation?

  1. The residual rating should be ignored because only inherent risk matters
  2. The risk can be closed because any reduction from inherent to residual proves effectiveness
  3. The controls reduce exposure to a level within the stated tolerance, which should be confirmed against the risk appetite Correct answer.
  4. The control set must be redesigned because residual risk is never acceptable

Explanation

Residual risk must be compared with the organization's tolerance to judge acceptability; a reduction alone does not establish adequacy. Closing a risk requires evidence that residual exposure sits within appetite.

Question 39Governance, Risk Management, and Control Frameworks

Which document typically authorizes a risk treatment plan, assigns an owner, and records the target completion date?

  1. The data retention schedule
  2. The service level agreement with a hosting provider
  3. A risk treatment or remediation plan linked to the risk register entry Correct answer.
  4. The enterprise architecture roadmap

Explanation

Treatment plans translate a chosen response into actions, ownership, and deadlines, and are tracked against the originating risk entry. Other documents govern architecture direction, service commitments, or retention rather than risk response.

Question 40Governance, Risk Management, and Control Frameworks

An organization chooses to transfer a risk by purchasing cyber insurance. Which statement about this treatment is accurate?

  1. It converts the risk into an avoided risk
  2. It removes the risk from the register because a third party now bears it
  3. It shifts some financial consequence but does not eliminate the underlying likelihood or operational impact Correct answer.
  4. It guarantees full recovery of all losses up to the policy limit

Explanation

Transfer moves financial exposure to an insurer while the organization still experiences the event and retains reputational and operational consequences. The risk therefore remains on the register with adjusted financial impact.

Question 41Governance, Risk Management, and Control Frameworks

A control self-assessment produces evidence that a key control operated throughout the period, while an independent test finds the same control failed in two months. How should the governance function treat these results?

  1. Average the two results to produce a partially effective rating
  2. Rely on the independent test evidence and treat the control as not consistently effective Correct answer.
  3. Discard both results and rely on management's verbal assurance
  4. Accept the self-assessment because it covers the whole period

Explanation

Independent, objective evidence generally outweighs self-reported assurance when results conflict, and evidence of failure means the control did not operate consistently. The discrepancy should also trigger root cause review of the self-assessment process.

Question 42Governance, Risk Management, and Control Frameworks

Which metric best indicates whether a vulnerability management process is operating effectively over time?

  1. Percentage of servers with antivirus installed
  2. Number of scanners deployed across the estate
  3. Total number of vulnerabilities ever recorded in the scanner
  4. Median time from vulnerability identification to remediation, tracked against defined targets Correct answer.

Explanation

A meaningful control metric measures performance against a target, such as remediation timeliness relative to risk-based deadlines. Raw counts and deployment tallies describe activity volume rather than effectiveness.

Question 43Governance, Risk Management, and Control Frameworks

An organization is deciding whether to accept a risk that exceeds its stated tolerance for customer data exposure. Who should make this acceptance decision?

  1. The vendor supplying the affected system
  2. The team that performs daily backups
  3. The engineer who discovered the weakness
  4. The accountable executive at a level authorized by policy to accept risks above tolerance Correct answer.

Explanation

Acceptance of risk beyond delegated tolerance must escalate to an authority empowered by policy, ensuring accountability matches the decision. Technical staff and vendors may recommend but cannot accept enterprise exposure.

Question 44Governance, Risk Management, and Control Frameworks

Which characteristic distinguishes a key risk indicator from a key performance indicator?

  1. A key risk indicator tracks exposure trends that may precede a loss event Correct answer.
  2. A key risk indicator replaces the need for a risk register
  3. A key risk indicator measures only financial profitability
  4. A key risk indicator is always lagging and retrospective

Explanation

Key risk indicators are forward-looking measures of changing exposure, giving early warning of rising risk. Performance indicators track achievement of objectives rather than exposure direction.

Question 45Governance, Risk Management, and Control Frameworks

A policy states that all production changes require approval, but teams routinely bypass approval during incidents. Which governance weakness does this most directly reveal?

  1. A gap between documented policy and enforced practice, indicating weak compliance monitoring Correct answer.
  2. An inadequate data classification scheme
  3. A missing business impact analysis
  4. An overly broad risk appetite statement

Explanation

When actual behavior diverges from written policy without detection, the governance system lacks effective monitoring and enforcement. The issue is policy-practice alignment, not appetite definition or continuity analysis.

Question 46Governance, Risk Management, and Control Frameworks

Which element is essential for a control to be considered properly designed?

  1. It is documented in more than one repository
  2. It addresses the identified risk with a defined operation, owner, and evidence source Correct answer.
  3. It has been approved by the vendor that supplies it
  4. It is implemented using the newest available technology

Explanation

Design adequacy requires a clear link between the control and the risk, plus defined operation, accountability, and evidence of performance. Technology novelty, document duplication, and vendor approval do not establish design effectiveness.

Question 47Governance, Risk Management, and Control Frameworks

An organization maps its controls to a recognized framework and then performs a gap analysis. What is the primary output of that gap analysis?

  1. A prioritized list of missing or immature controls relative to the framework and risk profile Correct answer.
  2. A complete inventory of all hardware assets
  3. A certification certificate issued by the framework body
  4. A finalized disaster recovery test report

Explanation

Gap analysis compares current practice with a target framework or standard and identifies shortfalls that should be prioritized by risk. It does not itself grant certification or produce unrelated asset or recovery artifacts.

Question 48Governance, Risk Management, and Control Frameworks

Which scenario best illustrates risk avoidance rather than risk mitigation?

  1. Purchasing insurance against payment card breach costs
  2. Adding encryption to a database that stores payment card data
  3. Discontinuing a product line that requires processing payment card data the organization cannot secure Correct answer.
  4. Outsourcing payment processing to a PCI-compliant provider

Explanation

Avoidance eliminates the risk by ceasing the activity that creates it. Encryption and outsourcing mitigate or transfer exposure while the activity continues.

Question 49Governance, Risk Management, and Control Frameworks

A board asks how much risk the organization is currently carrying relative to the limits it set. Which reporting approach answers this most directly?

  1. A summary of last year's audit fees
  2. An aggregated risk profile showing current exposure against appetite and tolerance thresholds Correct answer.
  3. A list of every open help desk ticket by priority
  4. A count of security awareness training completions

Explanation

Governance reporting compares aggregated current exposure with the limits the board approved, enabling an informed decision. Operational ticket lists and activity counts do not express risk against tolerance.

Question 50Governance, Risk Management, and Control Frameworks

An organization uses a quantitative risk analysis and estimates annualized loss exposure. Which combination of inputs produces that figure?

  1. Control cost divided by asset value
  2. Number of incidents divided by number of employees
  3. Likelihood rating plus impact rating on a five-point scale
  4. Single loss expectancy multiplied by annualized rate of occurrence Correct answer.

Explanation

Annualized loss exposure is the expected single-event loss multiplied by how often the event is expected per year. The other combinations are ordinal scoring or unrelated ratios.