ACC653 Ch 4

According to COSO ERM, which of the following is not an inherent challenge that arises as part of establishing strategy and business objectives?

• a. Ensuring culture is clearly articulated by the board.

• b. Possibility of strategy not aligning.

• c. Implications from the strategy chosen.

• d. Risk to achieving the strategy.

Answer explanation

Setting and communicating culture is not part of establishing strategy and business objectives. Also, while the board has a role in setting the culture, management is primarily responsible for communicating it throughout the organization.

Which of the following risk management activities is out of sequence in terms of timing?

• a. Identify, assess, and prioritize risks.

• b. Develop risk responses/treatments.

• c. Determine key organizational objectives.

• d. Monitor the effectiveness of risk responses/treatments.

Answer explanation

Key organizational objectives must be determined before the risks that threaten

the achievement of the objectives can be identified, assessed, and prioritized.

Who is responsible for implementing ERM?

• a. The chief financial officer.

• b. The chief audit executive.

• c. The chief compliance officer.

• d. Management throughout the organization.

Answer explanation

ERM must be implemented by management throughout an organization.

Which of the following is the best reason for the CAE to consider the organization’s strategic plan in developing the annual internal audit plan?

• a. To emphasize the importance of the internal audit function to the organization.

• b. To ensure that the internal audit plan will be approved by senior management.

• c. To make recommendations to improve the strategic plan.

• d. To ensure that the internal audit plan supports the overall business objectives.

Answer explanation

It is important to align the internal audit plan with the organization’s business

objectives.

When assessing the risk associated with an activity, an internal auditor should:

• a. Determine how the risk should best be managed.

• b. Provide assurance on the management of the risk.

• c. Update the risk management process based on risk exposures.

• d. Design controls to mitigate the identified risks.

Answer explanation

Assurance services involve the internal auditor’s objective assessment of management’s risk management activities and the degree to which they are effective.

The function of the chief risk officer is most effective when he or she:

• a. Manages risk as a member of senior management.

• b. Shares the management of risk with line management.

• c. Shares the management of risk with the CAE.

• d. Monitors risk as part of the ERM team.

Answer explanation

The CRO is most effective when supported by a specific team with the necessary

expertise and experience related to organizational risk.

Enterprise risk management:

• a. Guarantees achievement of business objectives.

• b. Requires establishment of risk and control activities by internal auditors.

• c. Involves the identification of events with negative impacts on business objectives.

• d. Includes selection of best risk response for the organization.

Answer explanation

C is the best answer. A is incorrect because ERM does not guarantee business objectives can be achieved. B is incorrect because internal auditors should not take on those roles. D is incorrect because

ERM is not about selecting the best response, but rather selecting a risk response that falls within the organization’s risk appetite.