Risk Management and Internal Control
This domain tests risk identification, assessment, treatment, and the control environment that keeps objectives on track. Expect questions on risk appetite, the Three Lines Model, COSO components, and control design.
Core rules
- Risk management is continuous: establish context, identify, analyse, evaluate, treat, communicate, and monitor. ISO 31000 is the reference framework.
- Risk appetite is the amount of risk the board is willing to accept; tolerance is the operational boundary.
- The Three Lines Model: management owns risk and controls (first line); risk and compliance provide oversight (second line); internal audit gives independent assurance (third line). The board and audit committee sit above.
- COSO internal control has five components: control environment, risk assessment, control activities, information and communication, and monitoring.
- Segregation of duties, authorisation, reconciliation, and physical controls are preventive; reviews and reconciliations can also be detective.
- A risk register should record cause, consequence, likelihood, impact, rating, owner, treatment, due date, and residual risk.
Worked example
Procurement fraud risk: one officer can raise a requisition, approve a supplier, and release payment. The fix is not 'more vigilance' but control design: separate requisition, purchase order, goods receipt, and payment approval; keep a vendor master change log; run duplicate-payment analytics; test a sample quarterly. The risk owner is the procurement head; internal audit tests design and operation.
Traps
- Treating the risk register as a compliance document.
- Confusing risk owner with risk auditor.
- Relying only on detective controls.
- Ignoring fraud risk and related-party risk.
- Leaving residual risk unrated.