Deck 12: The Risk Intelligent Enterprise: Enterprise Risk Management

Question 1

Which of the following is NOT part of IT controls?

A)Event controls
B)IT general controls
C)Entity-level controls
D)Application controls

Answer 1

A

Question 2

What is risk intelligence?

Answer 2

Risk intelligence moves beyond just managing risk to using risk intelligently to create value for the enterprise. Some risk has only a downside or loss associated with it, such as computer viruses that destroy corporate emails. Risk intelligence includes managing not only adverse risks, but also capitalizing on risk that presents the enterprise with opportunities to create value, such as evaluating risk associated with a new business acquisition.

Question 3

Enterprise risk management (ERM)goes beyond just security and controls.

Answer 3

True

Question 4

A silo approach with separate departments developing separate security programs without consideration of comprehensive risk management can prove to be very effective.

Question 5

Risk intelligence involves using risk in a pro active, constructive way to create additional value for the enterprise.

Question 6

The SEC requires company boards to report in-depth on how their enterprises identify risk, set risk tolerances, and manage risk/reward trade-offs.

Question 7

The IT control associated with top management is

A)IT general controls
B)Entity-level controls
C)Application controls
D)Event controls

Question 8

Identifying, assessing, and mitigating risks has not been shown to produce better business performance.

Question 9

Controls are not task driven. Understanding risk is not a prerequisite to the appreciation and application of control.

Question 10

________ risks have no benefits, only threats to success.

Question 11

At the top management level, ________ IT controls provide IT governance that sets the tone from the top of the enterprise.

Question 12

________ risks have the possibility of benefits associated with it.

Question 13

What percentage of CFOs provide advice on enterprise risk management?

A)63%
B)58%
C)79%
D)83%

Question 14

Which of the following is NOT considered part of IT controls?

A)ERM
B)Application controls
C)Entity-level controls
D)IT general controls

Question 15

The International Organization for Standardization framework for risk management is ________.

Question 16

Risk management shifts an enterprise from a pro active approach of anticipating and mitigating future risks before incidents occur to a reactive approach.

Question 17

The IT control associated with business processes is

A)Entity-level controls
B)IT general controls
C)Application controls
D)Event controls

Question 18

________ are controls embedded in business processes where a majority of security breaches occur.

Question 19

Application controls are controls over IT services, such as networks and database systems.

Question 20

Which of the following titles does NOT refer to someone in the C-Suite?

A)CIO: Chief Information Officer
B)CSO: Chief Sustainability Officer
C)CIA: Certified Internal Auditor
D)CFO: Chief Financial Officer

Question 21

Match the ERM component name to the appropriate definition.

-Internal Environment

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 22

Which of the following is NOT a dimension in an ERM cube?

A)ERM resources
B)ERM objectives
C)ERM components
D)ERM units

Question 23

Which ERM component involves the risk management philosophy of the enterprise,including the tone set by top management?

A)Control activities
B)Information and communication
C)Internal environment
D)Event identification

Question 24

________ is a COSO framework that provides guidance for managing risk.

Question 25

Match the ERM Objective with the appropriate definition.

-Reporting objectives

A)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the entity's compliance with all applicable laws and regulations.

Question 26

Match the ERM component name to the appropriate definition.

-Control activities

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 27

Given the impossibility of foreseeing every conceivable control to address all threats, risk management uses the approach of assessing risk to determine the probability of risk, its frequency, and its impact.

Question 28

Match the ERM component name to the appropriate definition.

-Monitoring

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 29

Which ERM objective relates to the effective and efficient use of a corporation's resources?

A)Operational objective
B)Compliance objective
C)Strategic objective
D)Reporting objective

Question 30

It is possible for a company to be 100% risk free.

Question 31

The COSO Enterprise Risk Management framework replaces the COSO framework for internal control.

Question 32

Match the ERM Objective with the appropriate definition.

-Compliance objectives

A)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the entity's compliance with all applicable laws and regulations.

Question 33

Match the ERM Objective with the appropriate definition.

-Strategic objectives

A)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the entity's compliance with all applicable laws and regulations.

Question 34

Match the ERM Objective with the appropriate definition.

-Operational objectives

A)These objectives relate to the reliability of the enterprise's reporting, both internal and external.
B)These objectives relate to the effective and efficient use of the entity's resources.
C)These objectives relate to goals that support the entity's mission.
D)These objectives relate to the entity's compliance with all applicable laws and regulations.

Question 35

Which ERM objective relates to the goals that support a corporation's mission?

A)Reporting objective
B)Operational objective
C)Strategic objective
D)Compliance objective

Question 36

What is the difference between downside risks and upside risks?

Question 37

Which of the following is part of the ERM units?

A)Internal Environments
B)Entity-level
C)Operations
D)Monitoring

Question 38

Match the ERM component name to the appropriate definition.

-Information and communication

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 39

Match the ERM component name to the appropriate definition.

-Objective setting

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 40

Match the ERM component name to the appropriate definition.

-Event identification

A)This is comprised of policies and procedures established and implemented to ensure risk responses are effective.
B)This involves identifying occurrences that affect an enterprise's ability to attain its objectives.
C)This involves ensuring relevant data is captured and communicated effectively throughout the organization to appropriate individuals in a timely manner.
D)This involves watched evaluation and feedback that permits modifications as needed.
E)This ensures that the enterprise has a process for setting goals that are consistent with the entity's mission and risk appetite.
F)This involves the risk management philosophy of the enterprise, including the tone set by top management.

Question 41

In the context of enterprise risk management, ________ refers to the process of monitoring an entity's enterprise risk management.

Question 42

Match the word to the appropriate sentence to complete the risk response definition.

-Sharing

A)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
B)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
C)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
D)This risk response involves ________ or exiting the activities that give rise to the risk.

Question 43

________ forms the basis for operations, reporting, and compliance objectives.

Question 44

________ is the acceptable level of variation in attaining objectives.

Question 45

What is the main limitation in the ERM framework? Why is it a limitation?

Question 46

List and define the eight interrelated ERM components.

Question 47

In ERM risk assessment, ________ may refer to assessing likelihood using qualitative measures, such as high, medium, or low.

Question 48

In ERM risk assessment, possibility may refer to assessing likelihood using a quantitative measure, such as percentages.

Question 49

________ is the process of assessing the extent to which events would impact an entity's ability to achieve its objectives.

Question 50

The ________ is also impacted by human resource policies, including hiring practices.

Question 51

List and define the four categories in the ERM framework of an enterprise's objectives.

Question 52

In ERM risk assessment, ________ may refer to assessing likelihood using a quantitative measure, such as percentages.

Question 53

The ________ component involves identifying potential events that might affect the entity.

Question 54

When risk responses are being considered, the costs and benefits of options may play a major role in the final decision.

Question 55

The integrated enterprise system is unable to provide management with additional data and information for use in making enterprise risk management assessments and decisions.

Question 56

The ________ relates to the culture of the organization and its risk consciousness.

Question 57

Which ERM component is comprised of policies and procedures established and implemented to ensure risk responses are effective?

A)Risk assessment
B)Control activities
C)Information and communication
D)Objective setting

Question 58

Match the word to the appropriate sentence to complete the risk response definition.

-Reduce

A)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
B)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
C)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
D)This risk response involves ________ or exiting the activities that give rise to the risk.

Question 59

A well developed and articulated risk management philosophy can provide consistency in risk attitudes throughout the entire enterprise.

Question 60

Match the word to the appropriate sentence to complete the risk response definition.

-Avoiding

A)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
B)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
C)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
D)This risk response involves ________ or exiting the activities that give rise to the risk.

Question 61

Which question pertains to assessing risk likelihood?

A)What is the estimated frequency of the threat occurring?
B)What is the asset's value?
C)What is the estimated potential loss per threat?
D)How much is the asset worth to the competition?

Question 62

Match the IT control activity to the appropriate enterprise level.

-Entity-level IT controls

A)IT governance
B)Business processes
C)IT processes and services

Question 63

Qualitative measures include

A)Means
B)Regression
C)Percentages
D)Ranking likelihood

Question 64

What are the four risk response categories? Include a definition of each.

Question 65

Match the IT control activity to the appropriate enterprise level.

-IT general controls

A)IT governance
B)Business processes
C)IT processes and services

Question 66

What are five external events that may pose a risk to an enterprise's ability to achieve objectives? Provide examples.

Question 67

Operation objectives relate to

A)The reliability of both internal and external reports, including both financial and nonfinancial information
B)The effective and efficient use of the entity's resources
C)An entity's compliance with applicable laws and regulations
D)An entity's ability to mitigate risk

Question 68

Match the IT control activity to the appropriate enterprise level.

-Application controls

A)IT governance
B)Business processes
C)IT processes and services

Question 69

Match the word to the appropriate sentence to complete the risk response definition.

-Acceptance

A)An entity reduces risk likelihood or risk impact by ________ the risk with another entity.
B)This risk response refers to actions taken to ________ risk likelihood, risk impact, or both.
C)When an entity responds to risk with ________, the entity takes no action to affect risk likelihood or risk impact.
D)This risk response involves ________ or exiting the activities that give rise to the risk.

Question 70

What are four internal events that may pose a risk to an enterprise's ability to achieve objectives? Provide examples.

Question 71

Assessment techniques used to assess risk are grouped into two categories. What are these categories? Define each.

Question 72

Which of the following is NOT an external factor that might affect an enterprise's ability to achieve objectives?

A)Economic events
B)Natural environment
C)Processes
D)Political events

Question 73

Which of the following is an incident or occurrence that originates inside an organization?

A)Changes in regulations
B)Data integrity
C)New technology
D)Product competition

Question 74

The risk time frame ________ relates to the organization's strategy, affecting three to five years or longer.

Question 75

Which of the following is both an internal and external factor that might affect an enterprise's ability to achieve objectives?

A)Infrastructures
B)Technology events
C)Economic events
D)Social events

Question 76

Which of the following is NOT considered a control activity?

A)Locked door
B)Performance reviews
C)Event identification
D)Segregation of duties

Question 77

Hiring competent employees who are provided ongoing training

A)Can increase risks from accidents and errors
B)Can increase the amount of fraud
C)Can reduce risks from accidents and errors
D)Can reduce an enterprise's risk tolerance

Question 78

ISO 13000 is not the only internationally accepted enterprise risk management standard.

Question 79

Which of the following is NOT an incident or occurrence that originates outside an organization?

A)Changes in consumer demographics
B)New legislation
C)Employee competence
D)Liquidity factors

Question 80

What is risk tolerance? Provide an example.