Risk Management, Internal Control, Audit and Compliance
What the exam tests
This domain tests the control environment: how risk appetite is set, how controls are designed, and how internal audit, compliance and the audit committee provide independent assurance.
Core rules
- The three lines model distinguishes management controls (first line), risk and compliance functions (second line) and internal audit (third line). Internal audit must not own the risks it audits.
- The board sets risk appetite; management identifies, assesses and treats risks; the risk committee oversees the framework.
- Internal audit should report functionally to the audit committee and administratively to the CEO. This preserves independence while keeping daily access to management.
- The audit committee oversees financial reporting, external audit, internal audit and whistleblowing arrangements.
- Compliance monitors laws, regulations and codes; it does not replace internal audit.
Worked example
An internal audit head reports only to the CFO and has no private access to the audit committee. Reasoning: the CFO is responsible for financial controls that internal audit must examine. Reporting solely to the CFO creates a self-review threat. The fix is a functional reporting line to the audit committee, administrative reporting to the CEO, and a charter confirming unrestricted access to records and the committee.
Traps
Calling risk management the “third line”; making the audit committee the risk committee by default; outsourcing internal audit to the external auditor without addressing independence; treating compliance as optional; and confusing a control deficiency with a fraud finding.