CIA P1 Governance, Risk Management and Control: practice questions with answers

Question 1

A country's corporate governance code requires each listed company either to follow every provision of the code or to disclose in its annual report which provisions it has departed from and why. This approach is best described as:

1. A A rules-based regime in which any departure from a provision is a legal offence
2. B A principles-based "comply or explain" regime relying on disclosure and market scrutiny
3. C A stakeholder-based regime in which employees approve all departures from the code
4. D A self-regulatory regime in which companies choose provisions without any disclosure

Show the answer

Answer: B. Governance codes broadly follow one of two approaches. Rules-based regimes (for example, much of the US Sarbanes-Oxley Act) make requirements legally mandatory. Principles-based codes usually operate on a "comply or explain" basis: companies may depart from a provision provided they disclose the departure and the reasons, and shareholders and the market judge whether the explanation is acceptable.

Question 2

A new payments regulation affecting Ivelet Payments will take effect in ten months. Which approach would most effectively manage the compliance risk arising from this regulatory change?

1. A A structured process to interpret the rule, assess its impact, assign owners, update policies, controls and training, and track progress
2. B Having the legal department email the full text of the regulation to all staff and ask each department to make whatever changes it considers necessary
3. C Waiting until the regulator's first inspection after the effective date, then correcting any breaches that the regulator identifies
4. D Asking internal audit to draft the new procedures and controls required by the regulation and to sign off that the business has implemented them

Show the answer

Answer: A. Compliance programs need a regulatory change management process: horizon scanning to identify new rules, interpretation (often by legal or compliance), an impact assessment on products, processes and systems, assignment of owners for each change, updates to policies, controls and training, and monitoring of progress, with post-implementation checks. Internal audit can give assurance on, or advise on, this process but should not own it.

Question 3

Kestrel Pharma has no formal enterprise risk management process. The CEO asks the chief audit executive (CAE) to facilitate workshops to help management identify and evaluate the company's key risks. What is the most appropriate response?

1. A Decline, because any internal audit involvement in enterprise risk management impairs independence and objectivity
2. B Agree, and have internal audit take ownership of the resulting risk register and decide on the risk responses
3. C Agree to facilitate as an advisory service, with management owning risks and decisions, safeguards in place and the board informed
4. D Agree, and later give assurance on the workshop results without informing the board of internal audit's earlier involvement

Show the answer

Answer: C. Facilitating risk workshops and coaching management are legitimate internal audit roles with safeguards. Under the Global Internal Audit Standards, the CAE should make clear that management remains responsible for risk management, put safeguards in place to protect objectivity (for example, having assurance on these areas performed or overseen by others), and inform the board. Internal audit must not take ownership of risks or decide risk responses.

Question 4

A warehouse supervisor and a receiving clerk at Pemberton Supplies work together to record receipts of goods that were never delivered, so that fictitious supplier invoices pass the system's three-way match and are paid. This situation best illustrates:

1. A An inherent limitation of internal control, because collusion can circumvent even well-designed controls
2. B A design deficiency in the three-way match, showing that this type of control should never be relied on
3. C A failure confined to the Monitoring Activities component, with the other four components unaffected
4. D Clear proof that the organization has no code of conduct or that employees have never been told of it

Show the answer

Answer: A. Internal control provides reasonable, not absolute, assurance because of inherent limitations, including faulty judgment, human error, management override and collusion among two or more people. Segregation of duties works only if the people involved act independently. Detective measures such as inventory counts, analysis of supplier activity and whistleblowing channels help reduce this residual risk.

Question 5

Dunsfold Medical buys 85% of a critical sensor for its devices from one supplier, whose only factory is in an area prone to earthquakes. Dunsfold's contract gives it no right to review the supplier's business continuity arrangements. Which statement best describes this risk?

1. A It is a third-party concentration risk that Dunsfold must still manage, even though another organization performs the activity
2. B It is the supplier's risk rather than Dunsfold's, so it should be recorded only in the supplier's risk register and not in Dunsfold's
3. C It is a market risk, because it arises from changes in prices of components traded in financial markets
4. D It is only a compliance risk, because the contract does not contain the supplier review rights required by regulators

Show the answer

Answer: A. Third-party risk arises from relying on external organizations such as suppliers, outsourcers and service providers. Concentration on a single supplier in one high-hazard location increases it. An organization can outsource an activity but not its accountability for the risks to its objectives, so Dunsfold should assess the risk and respond, for example through alternative suppliers, safety stock, contract rights to review the supplier's continuity plans and ongoing monitoring.

Question 6

Based on The IIA's guidance on internal audit's role in enterprise risk management (ERM), which of the following is a core internal audit role?

1. A Evaluating the reporting of key risks to the board and senior management
2. B Coordinating ERM activities across the organization's business units
3. C Taking decisions on how the organization will respond to identified risks
4. D Championing the establishment of ERM within the organization

Show the answer

Answer: A. The IIA's guidance divides possible ERM roles into three groups:

- Core roles (assurance): giving assurance on risk management processes, giving assurance that risks are correctly evaluated, evaluating risk management processes, evaluating the reporting of key risks, and reviewing the management of key risks.
- Legitimate roles with safeguards: for example facilitating risk workshops, coaching management, coordinating ERM activities, consolidated reporting on risks, maintaining the ERM framework and championing the establishment of ERM.
- Roles internal audit should not undertake: for example setting risk appetite, imposing risk management processes, taking decisions on risk responses, implementing responses on management's behalf, and being accountable for risk management.