Deck 12: The Risk Intelligent Enterprise: Enterprise Risk Management

Question 1

The International Organization for Standardization framework for risk management is ________.

Answer 1

ISO 31000

Question 2

________ risk is a risk that has the possibility of a positive payoff associate with it.

Answer 2

Rewarded

Question 3

Risk intelligence moves beyond just managing risk to using risk intelligently to create value for the enterprise.

Answer 3

True

Question 4

Application controls are controls over IT services, such as networks and database systems.

Question 5

A silo approach with separate departments developing separate security programs without consideration of comprehensive risk management can prove to be very effective.

Question 6

At the top management level, ________ IT controls provide IT governance that sets the tone from the top of the enterprise.

Question 7

Which of the following titles does not refer to someone in the C-Suite?

A)CIO: Chief Information Officer
B)CSO: Chief Sustainability Officer
C)CIA: Certified Internal Auditor
D)CFO: Chief Financial Officer

Question 8

________ risks have no positive payoff.

Question 9

Risk management shifts an enterprise from a proactive approach of anticipating and mitigating future risks before incidents occur to a reactive approach.

Question 10

Risk intelligence involves using risk in a proactive, constructive way to create additional value for the enterprise.

Question 11

Which of the following is not considered part of IT controls?

A)ERM
B)Application controls
C)Entity-level controls
D)IT general controls

Question 12

________ includes managing not only adverse risks, but also capitalizing on risk that presents the enterprise with opportunities to create value, such as evaluating risk associated with a new business acquisition.

Question 13

Controls are risk driven, so understanding risk is a prerequisite to the appreciation and application of control.

Question 14

The IT control associated with business processes is

A)Entity-level controls
B)IT general controls
C)Application controls
D)Event controls

Question 15

What percentage of CFOs provide advice on IT?

A)64%
B)48%
C)83%
D)72%

Question 16

The IT control associated with top management is

A)IT general controls
B)Entity-level controls
C)Application controls
D)Event controls

Question 17

Which of the following is not part of IT controls?

A)Event controls
B)IT general controls
C)Entity-level controls
D)Application controls

Question 18

Identifying, assessing, and mitigating risks has not been shown to produce better business performance.

Question 19

Enterprise risk management (ERM)goes beyond just security and controls.

Question 20

________ are controls embedded in business processes where a majority of security breaches occur.

Question 21

ERM Operational objectives relate to goals that support the entity's mission.

Question 22

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Event identification

Question 23

Which of the following is not part of the ERM units?

A)Subsidiary
B)Entity-level
C)Operations
D)Division

Question 24

Match the ERM Objective with the appropriate definition.

A)These objectives relate to the entity's compliance with all applicable laws and regulations.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
Reporting objectives

Question 25

The COSO Enterprise Risk Management framework replaces the COSO framework for internal control.

Question 26

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Control activities

Question 27

What is the difference between unrewarded risks and rewarded risks?

Question 28

Match the ERM Objective with the appropriate definition.

A)These objectives relate to the entity's compliance with all applicable laws and regulations.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
Strategic objectives

Question 29

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Internal Environment

Question 30

Which of the following is not an ERM category in an enterprise's objectives?

A)Operational objective
B)Reporting objective
C)Compliance objective
D)Shareholder objective

Question 31

It is possible for a company to be 100% risk free.

Question 32

Which ERM category relates to the effective and efficient use of a corporation's resources?

A)Operational objective
B)Compliance objective
C)Strategic objective
D)Reporting objective

Question 33

What is risk intelligence?

Question 34

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Objective setting

Question 35

Match the ERM Objective with the appropriate definition.

A)These objectives relate to the entity's compliance with all applicable laws and regulations.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
Operational objectives

Question 36

________ is a COSO framework that provides guidance for managing risk.

Question 37

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Monitoring

Question 38

Which of the following is not a dimension in an ERM cube?

A)ERM resources
B)ERM objectives
C)ERM components
D)ERM units

Question 39

Match the ERM component name to the appropriate definition.

A)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
B)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
C)This involves watched evaluation and feedback that permits modifications as needed.
D)This involves the risk management philosophy of the enterprise, including the tone set by top management.
E)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
F)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
Information and communication

Question 40

Match the ERM Objective with the appropriate definition.

A)These objectives relate to the entity's compliance with all applicable laws and regulations.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
Compliance objectives

Question 41

Since it is impossible to foreseeing and control for every possible threat, what approach does enterprise risk management take?

Question 42

________ is the process of assessing the extent to which events would impact an entity's ability to achieve its objectives.

Question 43

When risk responses are being considered, the costs and benefits of options may play a major role in the final decision.

Question 44

________ objectives, sometimes called mission or vision, establish the entity's purpose.

Question 45

The integrated enterprise system is unable to provide management with additional data and information for use in making enterprise risk management assessments and decisions.

Question 46

List and define the eight interrelated ERM components.

Question 47

In ERM risk assessment, ________ may refer to assessing likelihood using qualitative measures, such as high, medium, or low.

Question 48

In the context of enterprise risk management, ________ refers to the process of monitoring an entity's enterprise risk management.

Question 49

In ERM risk assessment, possibility may refer to assessing likelihood using a quantitative measure, such as percentages.

Question 50

The ________ relates to the culture of the organization and its risk consciousness.

Question 51

What is the main limitation in the ERM framework? Why is it a limitation?

Question 52

Which ERM component is comprised of policies and procedures established and implemented to ensure risk responses are effective?

A)Risk assessment
B)Control activities
C)Information and communication
D)Objective setting

Question 53

Match the word to the appropriate sentence to complete the risk response definition.

A)This risk response involves ________ or exiting the activities that give rise to the risk.
B)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
C)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
D)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
Avoiding

Question 54

In ERM risk assessment, ________ may refer to assessing likelihood using a quantitative measure, such as percentages.

Question 55

________ is the acceptable level of variation in attaining objectives.

Question 56

Which ERM category relates to the goals that support a corporation's mission?

A)Reporting objective
B)Operational objective
C)Strategic objective
D)Compliance objective

Question 57

Risk assessment is the acceptable level of variation in attaining objectives.

Question 58

The ________ component involves identifying potential events that might affect the entity.

Question 59

Which ERM component involves the risk management philosophy of the enterprise, including the tone set by top management?

A)Control activities
B)Information and communication
C)Internal environment
D)Event identification

Question 60

The amount of risk an entity is willing to accept in pursuit of value is called ________.

Question 61

Assessment techniques used to assess risk are grouped into two categories. What are these categories? Define each.

Question 62

Match the IT control activity to the appropriate enterprise level.

A)IT governance
B)Business processes
C)IT processes and services
Entity-level IT controls

Question 63

Match the word to the appropriate sentence to complete the risk response definition.

A)This risk response involves ________ or exiting the activities that give rise to the risk.
B)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
C)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
D)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
Acceptance

Question 64

Match the IT control activity to the appropriate enterprise level.

A)IT governance
B)Business processes
C)IT processes and services
Application controls

Question 65

Which question pertains to assessing risk likelihood?

A)What is the estimated frequency of the threat occurring?
B)What is the asset's value?
C)What is the estimated potential loss per threat?
D)How much is the asset worth to the competition?

Question 66

What is risk tolerance? Provide an example.

Question 67

Strategic objectives, also called ________, establish an organization's purpose.

A)Mission
B)Goal
C)Vision
D)A and C

Question 68

Which of the following is not considered a control activity?

A)Locked door
B)Performance reviews
C)Event identification
D)Segregation of duties

Question 69

What are the important questions to ask with assessing a risk's likelihood of occurring?

Question 70

Qualitative measures include

A)Means
B)Regression
C)Percentages
D)Ranking likelihood

Question 71

Match the IT control activity to the appropriate enterprise level.

A)IT governance
B)Business processes
C)IT processes and services
IT general controls

Question 72

When identifying risk responses, what typically plays a major role in the final decision?

A)Current regulations
B)Industry standards
C)Costs and benefits
D)B and C

Question 73

Operation objectives relate to

A)The reliability of both internal and external reports, including both financial and nonfinancial information
B)The effective and efficient use of the entity's resources
C)An entity's compliance with applicable laws and regulations
D)An entity's ability to mitigate risk

Question 74

What are the important questions to ask when assessing a risk's impact?

Question 75

Which of the following is an incident or occurrence that originates inside an organization?

A)Changes in regulations
B)Data integrity
C)New technology
D)Product competition

Question 76

Strategic objectives form the basis for the following objectives except

A)Financial objective
B)Reporting objective
C)Operations objective
D)Compliance objective

Question 77

Match the word to the appropriate sentence to complete the risk response definition.

A)This risk response involves ________ or exiting the activities that give rise to the risk.
B)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
C)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
D)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
Reduce

Question 78

How can a risk management philosophy provide consistency in risk attitudes throughout an organization?

A)By anticipating all possible risks
B)By providing event specific examples
C)By being well-developed and articulated
D)By setting employee expectations

Question 79

Match the word to the appropriate sentence to complete the risk response definition.

A)This risk response involves ________ or exiting the activities that give rise to the risk.
B)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
C)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
D)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
Sharing

Question 80

Which of the following is not an incident or occurrence that originates outside an organization?

A)Changes in consumer demographics
B)New legislation
C)Employee competence
D)Liquidity factors