Risk Governance, Compliance and Internal Control

Introduction and Context

Organisations pursue opportunity under conditions of uncertainty. A new market, acquisition, digital platform, supplier relationship or product launch may create value, but each also exposes the organisation to financial, operational, legal, technological, reputational and ethical risks. Risk governance is the system through which the board and management direct, oversee and control these uncertainties in accordance with the organisation’s purpose, strategy, values and obligations.

Risk governance is broader than risk management. Risk management identifies, assesses, responds to and monitors risk. Risk governance determines who has authority, what risks are acceptable, how accountability is assigned, how information reaches decision-makers and how the organisation assures stakeholders that risks are being managed responsibly. Compliance and internal control are important components of this system, but neither is a substitute for ethical judgement or effective leadership.

A mature approach integrates enterprise risk management (ERM), risk appetite, the Three Lines Model, internal control, anti-bribery safeguards, fraud prevention, conflicts-of-interest management, third-party due diligence and compliance monitoring. The objective is not to eliminate all risk. Risk elimination is usually impossible and may prevent legitimate innovation. The objective is to take informed, proportionate and transparent risks while preventing misconduct and preserving organisational resilience.

Learning Objectives

By the end of this chapter, learners should be able to:

1. Explain the relationship between risk governance, ERM, compliance and internal control.
2. Construct and interpret a risk appetite statement and risk limits.
3. Apply the Three Lines Model to clarify accountability and assurance.
4. Design preventive, detective and corrective internal controls.
5. Evaluate anti-bribery, fraud, conflicts-of-interest and third-party risk controls.
6. Develop a risk-based compliance monitoring programme.
7. Critically assess the limitations and ethical implications of control systems.
8. Recommend governance improvements in a complex organisational case.

1. Foundations of Risk Governance

1.1 Risk, uncertainty and opportunity

Risk is commonly understood as the effect of uncertainty on objectives. The effect may be negative, positive or both. This definition is more useful than treating risk solely as a threat because strategic decisions involve uncertainty about both outcomes and consequences.

Important risk categories include:

• Strategic risk: failure of strategy, inappropriate strategic choices or inability to adapt.
• Financial risk: liquidity, credit, market, capital, investment or reporting risk.
• Operational risk: failures of people, processes, systems or external events.
• Compliance and legal risk: breach of law, regulation, licence conditions, contract or internal policy.
• Conduct and ethical risk: behaviour that harms customers, employees, communities or organisational integrity.
• Technology and cyber risk: unauthorised access, system failure, data loss, algorithmic error or digital dependency.
• Reputational risk: loss of trust arising from actual or perceived misconduct or poor performance.
• Environmental and social risk: exposure to climate, human-rights, labour, community and ecological effects.

These categories overlap. A cyber incident may produce operational disruption, regulatory penalties, financial loss and reputational damage. Risk registers should therefore avoid treating categories as isolated silos.

1.2 Governance responsibilities

The board has ultimate responsibility for the organisation’s direction, oversight and control environment. It normally approves strategy, risk appetite, major policies and the internal audit mandate. It should challenge management’s assumptions and ensure that risk information is timely, reliable and sufficiently independent.

Senior management translates board-approved direction into objectives, risk responses, controls, resources and reporting. Managers own risks arising from the activities they control. The chief risk officer, compliance officer, general counsel and internal audit function provide specialist support and challenge, but responsibility should not be transferred to these functions.

A useful governance principle is that authority and accountability should be aligned. A manager who can approve a supplier, influence a payment and override a control has significant risk responsibility. If accountability is assigned to a person who lacks authority, resources or information, the governance design is defective.

1.3 Risk culture

Risk culture is the pattern of shared assumptions and behaviours concerning risk-taking, escalation, challenge and accountability. A strong risk culture does not mean that employees avoid all risk. It means that people understand objectives, act within agreed boundaries, speak up about concerns and expect fair but meaningful consequences for misconduct.

Leadership signals risk culture through incentive design, promotion decisions, responses to bad news and treatment of whistleblowers. A policy stating “zero tolerance” for bribery is not credible if high-performing employees who generate revenue are excused for improper payments. Ethical leadership therefore requires consistency between formal rules and actual decisions.

2. Enterprise Risk Management and Risk Appetite

2.1 The ERM cycle

ERM integrates risk considerations into strategy, planning, operations and performance management. A practical ERM cycle contains the following activities:

1. Establish context: clarify objectives, stakeholders, legal obligations and operating conditions.
2. Identify risks: determine events, causes and consequences that could affect objectives.
3. Analyse risks: assess likelihood, velocity, interconnectedness and impact.
4. Evaluate risks: compare exposure with appetite, tolerance and available capacity.
5. Treat risks: avoid, reduce, transfer, share, accept or pursue risk.
6. Monitor and review: track changes, controls, incidents, indicators and emerging risks.
7. Communicate and consult: provide information to affected decision-makers and stakeholders.

Risk assessment should combine quantitative and qualitative evidence. Historical loss data may be useful for recurring operational events, while scenario analysis and expert judgement are necessary for novel threats such as geopolitical disruption or emerging technology.

2.2 Inherent, residual and target risk

Inherent risk is the exposure before considering controls. Residual risk is the exposure remaining after controls and other responses. Target risk is the level management intends to achieve after planned improvements. The distinction prevents an organisation from claiming that a risk is low merely because controls have been assumed to work.

A basic expected-loss estimate can support prioritisation:

Here, EL is expected loss over a defined period, p is the probability of the event during that period, and L is the financial loss if the event occurs. The formula assumes that probability and loss are reasonably estimable and that the event definition is clear. It is a prioritisation aid, not a complete measure of risk: it does not capture uncertainty in estimates, timing, extreme events, non-financial harm or correlations among risks.

For example, if a control failure has an estimated annual probability of 0.04 and a potential direct loss of $500,000, the expected direct loss is:

A decision-maker should not conclude that the organisation may simply budget $20,000. A low-probability event may threaten a licence, injure stakeholders or cause catastrophic reputational harm. Scenario severity, control effectiveness and risk concentration must also be considered.

2.3 Risk appetite and tolerance

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. A risk appetite statement should be connected to strategy, capital, liquidity, stakeholder commitments and legal obligations. It should include both qualitative boundaries and measurable limits.

• Appetite: broad willingness to accept exposure.
• Tolerance: acceptable variation around an objective or limit.
• Limit: a specific threshold requiring action or escalation.
• Capacity: the maximum exposure the organisation can withstand before viability or obligations are threatened.

For example, an organisation may have a moderate appetite for innovation but no appetite for bribery, deliberate financial misstatement or retaliation against whistleblowers. “Zero appetite” should be used carefully. It may express a principle, but absolute prevention cannot be guaranteed; the control system must still address detection, reporting and response.

A sound risk appetite statement answers four questions:

1. What outcomes are unacceptable?
2. What risks may be accepted to achieve strategic objectives?
3. What indicators and limits reveal that exposure is approaching tolerance?
4. Who must act, and how quickly, when a limit is breached?

Risk appetite should influence investment approvals, remuneration, delegated authority and management information. If it appears only in a board document and not in operating decisions, it is symbolic rather than operational.

3. The Three Lines Model

The Three Lines Model, associated with the Institute of Internal Auditors, clarifies how responsibility and assurance are organised. It should not be interpreted as three rigid organisational departments.

First line: management and operational ownership

The first line owns risks and controls. Business and operational managers identify risks, design and operate controls, maintain evidence, correct deficiencies and escalate incidents. A process owner cannot avoid responsibility by stating that compliance or risk staff “own” the process.

Second line: expertise, support, monitoring and challenge

The second line provides risk, compliance, legal, information security, quality, financial control and similar expertise. It helps establish frameworks, advises management, monitors exposure and challenges first-line decisions. Its independence is important, but it generally remains part of management rather than an independent assurance provider.

Third line: independent assurance

Internal audit provides independent, risk-based assurance and advice on governance, risk management and control. It should have sufficient authority, competence and access to the board or audit committee. Internal audit should not design or operate controls that it later evaluates, because doing so creates self-review risk.

Governing body and external assurance

The governing body is not a “fourth line”; it has ultimate oversight responsibility. External auditors, regulators, certification bodies and other external providers may provide additional assurance, but their roles and scope differ. Reliance on external assurance does not remove the board’s responsibility.

Figure: The Three Lines Model clarifies ownership, support and independent assurance while recognising interaction among roles.

4. Internal Control as an Ethical and Operational System

Internal control is a process effected by the board, management and personnel to provide reasonable assurance regarding operations, reporting and compliance objectives. “Reasonable assurance” recognises that controls have limitations, including human error, collusion, management override, cost constraints and changing conditions.

A widely used control framework identifies five mutually related components:

1. Control environment: integrity, ethical values, competence, authority, accountability and oversight.
2. Risk assessment: identification and analysis of threats to objectives.
3. Control activities: approvals, reconciliations, segregation of duties, access controls, validations and physical safeguards.
4. Information and communication: reliable information delivered to those who need it, including escalation channels.
5. Monitoring activities: ongoing and periodic evaluation of control design and operation.

4.1 Control design and operation

A control is effective only when it is appropriately designed and actually operates. Design effectiveness asks whether the control could prevent or detect the relevant risk. Operating effectiveness asks whether it was performed consistently by an appropriately authorised person, at the required frequency, with evidence and appropriate follow-up.

Controls may be:

• Preventive: stop an undesirable event, such as approval before payment.
• Detective: identify an event after or while it occurs, such as exception reporting.
• Corrective: remedy the condition and prevent recurrence, such as access removal and root-cause remediation.
• Directive: encourage desired behaviour, such as training and codes of conduct.
• Compensating: reduce exposure when a primary control is unavailable, such as independent review.

Segregation of duties is a central preventive principle. Ideally, different individuals authorise a transaction, record it and have custody of the related asset. In small organisations this may be impractical; compensating controls such as owner review, transaction limits and independent bank reconciliation become important.

A control matrix should link each risk to its objective, control, owner, frequency, evidence, system dependency and testing method. This prevents “control overpopulation”, in which numerous low-value controls obscure the few controls that address critical risks.

5. Anti-Bribery, Fraud and Conflicts Management

5.1 Anti-bribery controls

Bribery involves offering, promising, giving, requesting or accepting an improper advantage to influence a decision or obtain an improper benefit. Relevant laws differ by jurisdiction, but ethical governance should address both public- and private-sector corruption, direct and indirect payments, facilitation payments, gifts, hospitality, political contributions, charitable donations, recruitment and sponsorships.

An effective anti-bribery programme includes:

• clear board-approved policy and visible leadership commitment;
• risk assessment based on geography, sector, transaction type and business model;
• proportionate due diligence on intermediaries and partners;
• approval and recording requirements for gifts, hospitality and donations;
• accurate books and records, with no off-book funds or disguised payments;
• training tailored to roles and risk exposure;
• confidential reporting and non-retaliation protections;
• investigation, disciplinary and remediation procedures; and
• periodic monitoring and independent review.

A payment labelled “consulting fee” is not legitimate merely because an invoice exists. The organisation should assess whether services were actually provided, whether compensation is reasonable, whether the intermediary is connected to a decision-maker and whether payment terms create concealment risk.

5.2 Fraud risk management

Fraud is intentional deception or concealment for personal or organisational gain. Fraud risk often arises where three conditions combine: pressure or incentive, opportunity and rationalisation. This “fraud triangle” is a useful diagnostic, not a complete causal theory. Organisational culture, capability, collusion and technological access may also be decisive.

Fraud prevention should include risk assessment, strong access controls, anomaly detection, job rotation where appropriate, mandatory leave in sensitive roles, independent reconciliations, whistleblowing channels and investigation protocols. Data analytics can identify duplicate vendors, round-dollar payments, unusual timing, split purchases or changes to master data. Analytics produces leads, not proof; human investigation and procedural fairness remain necessary.

5.3 Conflicts of interest

A conflict of interest exists when personal, relational, financial or outside interests could improperly influence professional judgement, or reasonably appear to do so. A conflict is not necessarily misconduct. The ethical obligation is to disclose it, assess it and manage it.

Management responses may include recusal, independent approval, reassignment, divestment, restricted access to information or, where appropriate, documented acceptance of a manageable conflict. Disclosure registers should be updated periodically and when circumstances change. Conflicts involving senior executives or directors require independent oversight because ordinary reporting lines may be inadequate.

6. Third-Party Due Diligence

Outsourcing does not outsource accountability. Agents, distributors, consultants, contractors, suppliers, joint-venture partners and technology providers may expose an organisation to bribery, sanctions, labour, privacy, cybersecurity, quality, environmental and reputational risks.

A risk-based due-diligence process generally includes:

1. Pre-engagement screening: ownership, beneficial owners, sanctions, adverse media, qualifications and conflicts.
2. Risk classification: country, service, interaction with officials, payment method, access to data and contract value.
3. Enhanced review: further investigation for higher-risk relationships, including references and source-of-funds questions.
4. Contractual controls: compliance obligations, audit rights, record retention, training, subcontracting restrictions, termination rights and reporting duties.
5. Payment controls: verified services, reasonable compensation, approved bank accounts and no unexplained cash payments.
6. Ongoing monitoring: certification updates, transaction testing, performance review, incident reporting and re-screening.
7. Exit management: access removal, data return, records preservation and unresolved-issue escalation.

Due diligence should be proportionate. Treating every supplier identically wastes resources and may encourage superficial checklist completion. Conversely, relying on a simple questionnaire for a high-risk intermediary is inadequate.

7. Compliance Monitoring and Assurance

Compliance monitoring is the systematic process of assessing whether activities, transactions and controls conform to applicable requirements and internal standards. It differs from training or policy publication. Monitoring should produce evidence, identify root causes and trigger corrective action.

A risk-based monitoring plan begins with a universe of obligations and processes. Each area is assessed according to impact, likelihood, regulatory attention, change, history of incidents, control maturity and management information. The plan should specify scope, population, sample or testing method, responsible reviewer, frequency, evidence standard and escalation route.

Useful monitoring methods include:

• transaction and exception testing;
• thematic reviews across business units;
• control self-assessments validated by second-line staff;
• regulatory change tracking;
• interviews and culture surveys;
• complaints and whistleblowing analysis;
• data analytics and continuous controls monitoring; and
• internal audit or external independent review.

Monitoring results should distinguish isolated errors from systemic failures. A breach-rate measure may be calculated as:

If 12 breaches are found in a sample of 240 transactions, the observed breach rate is 5%. This is not automatically the true population rate. Interpretation depends on the sampling design, selection bias, testing quality and whether transactions are independent. Management should also consider severity, repeat findings and whether the sample was risk-based.

A strong issue-management process records the condition, criterion, cause, consequence, owner, due date, interim action and validation evidence. Closure should mean that remediation has been implemented and tested, not merely that a management response has been written.

8. Technology, AI and Emerging Risk

Technology can strengthen governance through automated approvals, continuous monitoring, access analytics, immutable records and real-time alerts. However, automation can also amplify errors, conceal accountability and create new risks involving privacy, cybersecurity, model bias, explainability and third-party dependency.

AI-enabled monitoring systems require governance over data quality, model purpose, thresholds, false positives, human review, access, retention and documented decisions. An alert should not be treated as proof of misconduct. Employees must have fair opportunities to explain unusual activity, and investigators must avoid discriminatory profiling.

Boards should ask whether management understands critical technology dependencies, whether automated decisions can be overridden safely, whether model performance is independently validated and whether incident response has been tested. Digital resilience is now part of risk governance rather than a narrow information-technology concern.

9. Illustrative Case: Meridian Health Supplies

Background

Meridian Health Supplies, a fictional regional distributor, seeks a major public-sector contract in a new country. A local consultant offers to “accelerate approvals” and requests a success fee paid to an offshore account. The sales director argues that the consultant is essential and that competitors use similar arrangements. The consultant has not completed the standard due-diligence questionnaire.

Problem

The proposal creates potential bribery, inaccurate-records, sanctions, conflicts and reputational risks. The sales director’s incentive plan is based heavily on contract acquisition. The compliance officer is informed only after the draft contract has been negotiated, and the board receives no risk report because management classifies the matter as a commercial opportunity.

Analysis

The first-line business owner should identify and escalate the risk rather than treating compliance as a late-stage approval function. The second line should classify the consultant as high risk because of public-sector interaction, unexplained success fees, offshore payment arrangements and pressure to bypass due diligence. The board or an appropriate committee should determine whether the opportunity fits the organisation’s risk appetite.

The proposed success fee is not necessarily unlawful solely because it is contingent, but the combination of indicators requires enhanced review. Meridian should verify beneficial ownership, qualifications, actual services, references, political exposure, conflicts and payment destination. It should require transparent compensation, accurate invoices, approved banking arrangements and a contract containing audit, recordkeeping, anti-bribery and termination provisions.

Approach and solution

Meridian should pause engagement until enhanced due diligence is complete. The consultant should not contact officials on Meridian’s behalf during the review. Legal and compliance staff should document the assessment, while the sales director should disclose the incentive conflict and recuse themself from final approval. If the consultant refuses transparency or insists on unexplained payment terms, Meridian should decline the relationship.

The board should receive a concise report describing the opportunity, risk indicators, proposed controls and residual risk. Internal audit need not approve the transaction, but it may later review whether the governance process operated effectively. Any allegation of attempted bribery should be handled through the organisation’s investigation protocol, with preservation of records and protection against retaliation.

Outcome

In this illustrative case, enhanced review reveals that the consultant has no relevant technical capability and is connected to an official involved in procurement. Meridian declines the engagement, documents the decision and strengthens its third-party screening and incentive controls. Although it loses a possible contract, it avoids potentially severe legal, financial and reputational consequences.

Learning points

1. Commercial urgency is not a justification for bypassing controls.
2. Red flags are cumulative; each must be assessed in context.
3. Accountability remains with Meridian even if the consultant is independent.
4. Conflicts should be disclosed and managed before approval.
5. Risk appetite must influence actual decisions, not merely reports.
6. Effective compliance may require refusing attractive opportunities.

10. Challenges and Critical Evaluation

Risk governance systems face several limitations. First, risk registers can create false precision. Scores such as “likelihood 4, impact 5” may hide disagreement and uncertainty. Second, controls may become ceremonial if employees complete forms without meaningful review. Third, excessive controls can delay legitimate activity, encourage workarounds and concentrate authority in informal channels.

Fourth, independence is difficult to balance. A compliance function that is too close to commercial management may lack challenge; one that is isolated may lack operational understanding. Fifth, assurance providers may duplicate work while leaving important risks unexamined. Assurance mapping and clear role definitions help address this problem.

Sixth, incentive systems may undermine ethical policies. Targets that reward revenue without adjusting for conduct create pressure to take unacceptable risks. Balanced scorecards, clawbacks where legally appropriate, conduct assessments and promotion criteria should reinforce responsible behaviour.

Finally, no framework replaces judgement. Boards and executives must consider uncertainty, vulnerable stakeholders, distributional effects and long-term consequences. A technically compliant decision may still be unethical if it exploits information asymmetry, shifts harm to communities or undermines trust.

Best-Practice Implementation Road Map

A practical implementation sequence is:

1. Confirm board oversight, committee mandates and reporting channels.
2. Map strategic objectives, critical processes and legal obligations.
3. Define risk appetite, tolerances, escalation triggers and ownership.
4. Assess inherent and residual risks, including interconnected and emerging risks.
5. Document key controls and test both design and operation.
6. Establish proportionate anti-bribery, fraud, conflict and third-party processes.
7. Build a compliance monitoring plan linked to risk, not merely calendar frequency.
8. Integrate incident, complaint, whistleblowing and audit information.
9. Review incentives, culture and management responses to bad news.
10. Report trends, overdue actions, breaches and emerging risks to the governing body.
11. Validate remediation and revise the framework after incidents, strategy changes or regulatory developments.

Chapter Summary

Risk governance aligns uncertainty-taking with organisational purpose, strategy, values and stakeholder obligations. Enterprise risk management provides a structured process for identifying, analysing, treating and monitoring risk, while risk appetite translates strategic intent into boundaries and escalation requirements. The Three Lines Model clarifies that operational management owns risks, specialist functions support and challenge management, and internal audit provides independent assurance.

Internal control is a process rather than a checklist. Effective controls require a sound ethical environment, reliable information, appropriate preventive and detective activities, and continuous monitoring. Anti-bribery, fraud prevention, conflict management and third-party due diligence must be risk-based, documented and supported by credible consequences. Compliance monitoring should test actual behaviour and control performance, distinguish isolated errors from systemic weaknesses and verify remediation.

Technology and AI can improve detection and reporting but introduce risks involving data, bias, accountability and automation. Ultimately, frameworks are effective only when leaders align incentives, protect challenge, respond consistently to misconduct and exercise judgement about consequences that cannot be reduced to a numerical score.

Key Terms

Risk governance: Direction, oversight and accountability for managing uncertainty in relation to organisational objectives.

Enterprise risk management: Integrated management of risks across strategy, operations, reporting and compliance.

Risk appetite: The amount and type of risk an organisation is willing to accept in pursuit of objectives.

Risk tolerance: Permitted variation around an objective, exposure or limit.

Risk capacity: Maximum exposure an organisation can withstand without threatening viability or obligations.

Inherent risk: Exposure before considering controls or other responses.

Residual risk: Exposure remaining after controls and risk responses.

Control environment: Ethical, organisational and accountability conditions that influence control effectiveness.

Preventive control: A control intended to stop an undesirable event before it occurs.

Detective control: A control intended to identify an event or error after or while it occurs.

Corrective control: A control intended to remedy a problem and prevent recurrence.

Three Lines Model: A model distinguishing operational ownership, management support and challenge, and independent assurance.

Compliance monitoring: Systematic assessment of conformity with laws, regulations, policies and obligations.

Bribery: Offering, giving, requesting or accepting an improper advantage to influence conduct or obtain a benefit.

Fraud: Intentional deception or concealment for gain or advantage.

Conflict of interest: A personal or external interest that could improperly influence, or appear to influence, professional judgement.

Third-party due diligence: Risk-based investigation and monitoring of external parties acting for or supplying an organisation.

Management override: Deliberate circumvention of established controls by authorised personnel.

Residual risk acceptance: A documented decision to retain risk after considering controls and responses.

Review Questions

Short Answer Questions

1. Distinguish risk governance from risk management.
2. Define risk appetite, risk tolerance and risk capacity.
3. What is the principal responsibility of the first line in the Three Lines Model?
4. Explain the difference between preventive and detective controls.
5. Why does outsourcing not eliminate an organisation’s accountability for third-party conduct?

Long Answer Questions

1. Explain how ERM should be integrated with strategy, performance management and board oversight.
2. Evaluate the strengths and limitations of the Three Lines Model in a complex multinational organisation.
3. Discuss how an organisation can design an anti-bribery programme that is proportionate to risk.
4. Analyse the relationship between organisational culture, incentives and fraud risk.
5. Explain how compliance monitoring can distinguish isolated control failures from systemic weaknesses.

Analytical / Application Questions

1. A company has a moderate appetite for commercial risk but no appetite for bribery. A sales manager proposes using an intermediary who demands a large success fee and refuses to disclose beneficial ownership. Apply the risk appetite concept, Three Lines Model and third-party due-diligence principles to recommend a decision.
2. A monitoring review finds a 5% breach rate in payment approvals, but all breaches occurred in a high-value business unit and two involved senior managers. Explain why the percentage alone is insufficient and design an escalation and remediation response.
3. Design a control matrix for a procurement process that includes risks of conflicts of interest, fictitious suppliers, unauthorised purchases and bribery. Specify at least one preventive, detective and corrective control for each risk.

Multiple Choice Questions with Answers

Question 1

Which statement best describes risk appetite?

A. The maximum loss that has already occurred

B. The amount and type of risk an organisation is willing to accept in pursuit of objectives

C. The probability that a control will fail

D. The total number of risks recorded in a risk register

Correct Answer: B. The amount and type of risk an organisation is willing to accept in pursuit of objectives

Question 2

In the Three Lines Model, who primarily owns and operates business controls?

A. The first line

B. The second line

C. The third line

D. External auditors

Correct Answer: A. The first line

Question 3

Which is an example of a preventive control?

A. A post-transaction exception report

B. An internal audit investigation

C. Approval required before a payment is released

D. A root-cause review after a loss

Correct Answer: C. Approval required before a payment is released

Question 4

If the probability of an event is 0.04 and its direct loss is $500,000, what is the expected direct loss?

A. $2,000

B. $20,000

C. $50,000

D. $200,000

Correct Answer: B. $20,000

Question 5

Which fact is the strongest third-party bribery red flag?

A. The supplier submits invoices electronically

B. The supplier requests transparent payment to a verified business account

C. The intermediary refuses beneficial-ownership disclosure and requests an unexplained offshore payment

D. The supplier agrees to compliance training

Correct Answer: C. The intermediary refuses beneficial-ownership disclosure and requests an unexplained offshore payment

Question 6

What is the appropriate general response to a manageable conflict of interest?

A. Conceal it unless a loss occurs

B. Disclose and manage it through measures such as recusal or independent approval

C. Automatically dismiss the person involved

D. Transfer responsibility to internal audit

Correct Answer: B. Disclose and manage it through measures such as recusal or independent approval

Question 7

Which statement about internal audit is most accurate?

A. It should own all operational risks

B. It should design and operate every key control

C. It provides independent, risk-based assurance

D. It replaces the governing body’s oversight responsibility

Correct Answer: C. It provides independent, risk-based assurance

Question 8

A breach rate calculated from a sample is best interpreted as:

A. Automatically the exact population breach rate

B. A useful indicator whose meaning depends on sampling and testing conditions

C. Proof that every transaction is defective

D. A measure of financial loss only

Correct Answer: B. A useful indicator whose meaning depends on sampling and testing conditions

Question 9

Why is a zero-appetite statement not sufficient by itself to prevent misconduct?

A. It eliminates the need for controls

B. It guarantees that no incident can occur

C. It expresses a boundary but must be supported by prevention, detection, reporting and response

D. It applies only to financial risks

Correct Answer: C. It expresses a boundary but must be supported by prevention, detection, reporting and response

Question 10

Which action best reflects the responsibility of the first line?

A. Operating controls, identifying issues and escalating risks

B. Providing only independent assurance to the audit committee

C. Replacing the board in setting strategy

D. Avoiding documentation because compliance owns the process

Correct Answer: A. Operating controls, identifying issues and escalating risks