Governance, Risk Management, and Control

Brookvale Health has a low appetite for patient-data breaches. An auditor reviews a newly designed access-control response and confirms the design would, if operating as intended, keep breach exposure within appetite. The auditor now wants to conclude on whether the response actually keeps the risk within appetite in practice. What should the auditor do next?

• AConclude that the risk is within appetite on the strength of the design assessment, since a control designed to meet appetite will keep exposure within it once live.
• BTest whether the access controls are operating effectively over the period, because a well-designed response only keeps risk within appetite if it works in practice.check_circle Correct
• CRecommend widening the organisation's appetite for data breaches so that the current level of residual exposure comfortably falls inside the revised boundary.
• DTake ownership of the access-control monitoring going forward so the auditor can personally guarantee the response keeps breaches within appetite each month.

Why A is wrong: This confuses design with operating effectiveness; a sound design can still fail in operation, so concluding from design alone is a classic error and is wrong.

Why B is correct: Design suitability alone does not confirm the risk is controlled; testing operating effectiveness over time is what lets the auditor conclude the response actually keeps exposure within appetite, so this is correct.

Why C is wrong: Appetite is set by the board, and moving it to fit exposure is a governance decision the auditor should not drive; it also dodges the real question of whether the control works, so this is wrong.

Why D is wrong: Owning ongoing monitoring is a management activity that would impair independence and prevent objective future assurance, so this action breaches the Three Lines Model and is wrong.

At Meridian Freight, the board has set a stated risk appetite of no unplanned service outages exceeding four hours per quarter. During an assurance engagement, the internal auditor finds that management has formally accepted a residual technology risk whose worst-case outage is estimated at nine hours. What should the internal auditor do next?

• AReport that the accepted residual risk exceeds the board's stated appetite and escalate the matter to senior management and the board as the appropriate risk owners.check_circle Correct
• BDirect the IT manager to change the risk response from accept to reduce so the exposure falls back within the board's stated appetite before the engagement closes.
• CAccept management's decision without comment, because choosing to accept a risk is a legitimate response option that always sits within management's authority to make.
• DRedesign the technology control and implement the additional recovery capacity needed to bring the estimated outage below the four-hour appetite threshold.

Why A is correct: Evaluating the response against appetite and escalating an exposure that exceeds it to the accountable owners is the independent, standards-consistent action, keeping the decision with management and the board.

Why B is wrong: Selecting and changing the risk response is a first line management decision; directing it would breach the Three Lines Model and impair the auditor's objectivity, so this is wrong despite seeming decisive.

Why C is wrong: Accept is a valid response, which makes this tempting, but the auditor must still evaluate whether the accepted residual risk is consistent with the board's appetite rather than passing silently over a breach.

Why D is wrong: Designing and implementing controls is a management responsibility; taking it on would make the auditor an owner of the very control later assured, so this impairs independence and is wrong.

During a risk assessment, a team estimates the exposure from unauthorised system access assuming that no access controls are in place at all. Which type of risk are they estimating?

• AResidual risk, because it is the level of risk that remains once existing access controls have been considered.
• BTolerable risk, because it is the amount of access risk the organisation is willing to accept for the objective.
• CDetection risk, because it captures the chance that controls fail to catch an unauthorised access attempt.
• DInherent risk, because it is the exposure that exists before any controls are applied to the activity.check_circle Correct

Why A is wrong: Residual risk reflects exposure after controls operate; the team is deliberately assuming no controls exist, so this is not residual risk.

Why B is wrong: Tolerable risk describes an accepted boundary, not a measured exposure; the team is estimating exposure, not setting an acceptable limit.

Why C is wrong: Detection risk is an audit-risk-model concept about tests failing to find a problem, not the pre-control exposure the team is estimating here.

Why D is correct: Inherent risk is the exposure before considering the effect of any controls, which matches an estimate that assumes no access controls exist.

Ardglass Manufacturing controls warehouse entry with swipe-card access, yet the internal auditor confirms that inventory shrinkage is still occurring and going unnoticed. Management asks for the control most likely to DETECT the ongoing shrinkage that the access controls are not stopping. Which control should the auditor recommend?

• APeriodic independent physical stock counts reconciled against the recorded inventory balances to surface discrepancies.check_circle Correct
• BRestricting warehouse entry to swipe-card holders and locking the store whenever it is left unattended.
• CWriting off the value of missing inventory to the income statement as an adjustment at the year end.
• DInstalling additional camera coverage and posting extra security staff at every warehouse exit around the clock.

Why A is correct: Counting stock and reconciling it to the records reveals unexplained differences after they arise, which is the detective control matched to the residual shrinkage risk.

Why B is wrong: Tightening entry restrictions is preventive and repeats the type of control that has already failed to stop the shrinkage, so it does not detect the losses that are still slipping through.

Why C is wrong: A year-end write-off records the financial effect of losses already suffered, making it a corrective accounting step rather than a control that detects shrinkage as it happens.

Why D is wrong: More cameras and guards aim to deter and prevent removal rather than detect losses in the records, and the round-the-clock coverage is disproportionate to the exposure described.

At Verdanta Foods, a new national food-labelling law takes effect next year, and management is concerned that products whose labels fail to meet the new legal requirements could attract fines and enforcement action from the regulator. During a risk assessment, the internal auditor must classify the exposure that arises specifically from failing to adhere to this law. Which risk category best describes this exposure?

• AOperational risk
• BReputational risk
• CStrategic risk
• DCompliance riskcheck_circle Correct

Why A is wrong: Applying labels is part of the production process, which makes operational risk tempting, but the exposure here is driven by breaching a legal requirement rather than by a process breakdown, so the category is wrong.

Why B is wrong: A public fine could indeed damage the brand, which makes this plausible, but reputational harm would be a secondary consequence; the primary exposure the auditor is classifying is the legal penalty for non-adherence.

Why C is wrong: Strategic risk concerns high-level objectives and market or business-model choices, not conformance with a specific law, so it does not capture the penalty exposure being classified here.

Why D is correct: Compliance risk is the exposure to penalties, fines, or sanctions arising from failing to adhere to laws, regulations, or internal policies, which is exactly the exposure the new labelling law creates.