chap4

1. According to COSO ERM, which of the following is not an inherent challenge that arises as part of establishing strategy and business objectives?

• a. Ensuring culture is clearly articulated by the board.

• b. Possibility of strategy not aligning.

• c. Implications from the strategy chosen.

• d. Risk to achieving the strategy

2. Which of the following external events will most likely impact a defense contractor that relies on large government contracts for its success?

• a. Economic event.

• b. Natural environment event.

• c. Political event.

• d. Social event.

3. Which of the following is not an example of a risk sharing strategy?

• a. Outsourcing a noncore, high-risk area.

• b. Selling a nonstrategic business unit.

• c. Hedging against interest rate fluctuations.

• d. Buying an insurance policy to protect against adverse weather.

4. An organization tracks a website hosting anonymous blogs about its industry. Recently, anonymous posts have focused on potential legislation that could have a dramatic effect on this industry. Which of the following may create the greatest risk if this organization makes business decisions based on the information contained on this website?

• a. Appropriateness of the information.

• b. Timeliness of the information.

• c. Accessibility of the information.

• d. Accuracy and reliability of the information

5. Which of the following risk management activities is out of sequence in terms of timing?

• a. Identify, assess, and prioritize risks.

• b. Develop risk responses/treatments.

• c. Determine key organizational objectives.

• d. Monitor the effectiveness ofrisk responses/treatments.

6. Who is responsible for implementing ERM?

• a. The chief financial officer.

• b. The chief audit executive.

• c. The chief compliance officer.

• d. Management throughout the organization

7. Which of the following is not a potential value driver for implementing ERM?

• a. Financial results will improve in the short run.

• b. There will be fewer surprises from year to year.

• c. There will be better information available to make risk decisions.

• d. An organization's risk appetite can be aligned with strategic planning

8. Which of the following is the best reason for the CAE to consider the organization's strategic plan in developing the annual internal audit plan?

• a. To emphasize the importance of the internal audit function to the organization.

• b. To ensure that the internal audit plan will be approved by senior management.

• c. To make recommendations to improve the strategic plan.

• d. To ensure that the internal audit plan supports the overall business objectives.

9. When senior management accepts a level of residual risk that the CAE believes is unacceptable to the organization, the CAE should:

• a. Report the unacceptable risk level immediately to the chair of the audit committee and the independent outside audit firm partner.

• b. Resign his or her position in the organization.

• c. Discuss the matter with knowledgeable members of senior management and, if not resolved, take it to the audit committee

• d. Accept senior management's position because it establishes the risk appetite for the organization

10. The CAE is asked to lead the enterprise risk assessment as part of an organization's implementation of ERM. Which of the following would not be relevant with respect to protecting the internal audit function's independence and the objectivity of its internal auditors?

• a. A cross-section of management is involved in assessing the impact and likelihood of

  each risk.

• b. Risk owners are assigned responsibility for each key risk.

• c. A member of senior management presents the results of the risk assessment to the board and communicates that it represents the organization's risk profile.

• d. The internal audit function obtains assistance from an outside consultant in the conduct of the formal risk assessment session