ICSAN Admin Risk common mistakes
ICSAN Admin Risk · Understand the traps and how to avoid them.
Treating the three lines model as a rigid org chart, so when asked who owns a control the candidate assigns it to internal audit because audit 'checks' the process.
Candidates memorise 'audit = assurance' and collapse assurance and ownership into one role; the first line (operational management) owning and running controls is a distinction the exam tests repeatedly.
What to do instead
For every control question, first ask 'who performs the activity?' - that unit owns the control (first line). Audit provides independent assurance (third line) and never owns or operates a control. Practise labelling each control in a scenario with its line before answering.
Confusing inherent risk with residual risk, and choosing the residual figure when the question describes the risk before controls are applied.
Both terms appear in the same scenario, and candidates answer the number that looks more alarming rather than matching it to whether controls are described as existing.
What to do instead
Scan the stem for control language. No controls mentioned or controls explicitly removed = inherent. Controls applied and effective = residual. When both are given, read the exact question verbatim ('before mitigation', 'remaining after controls') and map the term, not the magnitude.
Rating a risk as high because the impact is severe, ignoring that likelihood is negligible, instead of applying the matrix as defined in the scenario.
Severity words like 'fraud' or 'regulatory breach' trigger an emotional high rating; candidates substitute gut feel for the stated scoring rule.
What to do instead
Always locate the risk matrix or scoring rule in the stem and compute impact x likelihood mechanically. If the stem gives a scale, quote the two scores and multiply. Where a matrix is not given, state the assumption before choosing.
Selecting a detective control when the question asks for a preventive control (or vice versa), e.g. choosing bank reconciliation for a question about stopping an error entering the ledger.
Candidates classify controls by how familiar they are rather than by timing; reconciliation feels like a strong answer because it is common.
What to do instead
Build a two-column mental list. Preventive = segregation of duties, authorisation, access restriction, pre-approval, input validation. Detective = reconciliation, exception report, variance review, audit. Match the timing word in the stem ('stop', 'prevent', 'detect', 'identify after') to the column.
Answering a segregation-of-duties question by adding a review step rather than separating the conflicting duties, so the same person still both initiates and approves.
Candidates default to 'more oversight' as a universal fix and miss that the specific weakness is one person holding incompatible duties.
What to do instead
Identify the two incompatible functions named (custody, authorisation, recording, reconciliation) and split them between people or systems. A review by a manager is a compensating control only when separation is impossible - and the question must say so.
Treating a vendor payment or procurement scenario as a generic operational risk when the stem describes collusion, a fictitious supplier, or an override of approval limits - which is fraud risk.
Candidates categorise by process (procurement = operations) rather than by the intent and deception signals in the facts.
What to do instead
Look for the fraud triangle markers: pressure, opportunity, rationalisation, plus red flags such as a new supplier with no history, payments just under an approval threshold, or one person controlling the whole cycle. If deception for personal gain is present, answer under fraud risk and name the specific scheme (e.g. fictitious vendor, split payments).
Citing a regulation or legal requirement from memory without matching it to the jurisdiction or facts in the stem, or inventing a specific section number.
Candidates want to sound authoritative and reach for a familiar statute, but the exam scenario may be jurisdiction-neutral or governed by an internal policy instead.
What to do instead
Answer from the principle in the stem (e.g. data protection duty, anti-money-laundering reporting obligation, whistleblower protection) and only name a statute if the stem supplies the jurisdiction. If you cannot recall a specific provision with confidence, describe the obligation rather than fabricate a citation.
Writing a business continuity answer that jumps to recovery (backup site, failover) without first addressing business impact analysis, recovery time objectives, and the crisis escalation and communication chain.
Disaster recovery technology is the most memorable part of continuity, so candidates lead with it and skip the analysis and governance layers the exam rewards.
What to do instead
Structure continuity answers in sequence: business impact analysis and critical process identification, then RTO/RPO, then strategies and plans, then testing and maintenance, then crisis communication and escalation. If the question asks 'first step', the answer is almost always the impact analysis or plan activation decision, not the technology.
Describing risk reporting as 'tell the board everything regularly' instead of matching report content, frequency and escalation threshold to the audience (board, audit committee, operational management).
Candidates treat reporting as a communication soft skill and miss that the exam tests escalation criteria, aggregation, and the distinction between strategic and operational reporting.
What to do instead
For each reporting question, name the audience, the decision they must make, and the escalation trigger (e.g. risk above appetite, control failure, fraud indicator). Board and audit committee get aggregated, appetite-referenced reporting; management gets operational detail with owners and actions. Always state the escalation threshold explicitly.
Answering an ethics question with the legally permissible option when the stem describes a conflict of interest or a conduct breach that is legal but improper, or failing to disclose a personal interest.
Candidates equate ethical with lawful and pick the option that avoids legal trouble rather than the one that meets the professional code and the appearance test.
What to do instead
Apply a three-step filter: is it lawful, is it consistent with the code of conduct, and would it withstand public scrutiny? When a personal interest, gift, or related-party situation appears, the default answer is declare and recuse. Choose the option that protects integrity and disclosure even when a quieter legal option exists.