Deck 2: Risks and Risk Assessments

Question 1

________ is propelling massive and fast-paced changes in how businesses function.

A) Technology
B) Accounting
C) Sales
D) Service

Answer 1

Technology

Question 2

Internal audit departments perform formal risk assessments when

A) using technology.
B) creating audit plans.
C) preparing financial statements.
D) preparing budgets.

Answer 2

creating audit plans.

Question 3

Financial accountants implement controls including ________ to address risk.

A) technology
B) general guidelines
C) specific procedures
D) operational perspective

Answer 3

specific procedures

Question 4

Choose the best description of risk.

A) The estimation of damage that could be caused
B) The estimated probability of occurrence
C) The high-level business area or department
D) The likelihood of an unfavorable event occurring

Question 5

A risk-aware culture at a business is characterized by

A) leadership setting a risk-awareness tone at the top.
B) management that encourages employees to discuss risks openly.
C) an alignment of risks across all corporate initiatives.
D) all the above.

Question 6

Organize the three tasks below when performing risk assessment.

A) Identify, categorize and prioritize
B) Prioritize, identify and categorize
C) Categorize, prioritize and identify
D) Identify, prioritize and categorize

Question 7

The three primary types of business processes that make up a basic business model include

A) acquisition and payment processes.
B) conversion processes.
C) marketing, sales and collection processes.
D) all the above.

Question 8

A business function is a high-level ________ or ________ that performs business processes to achieve company goals.

A) Business area, customer
B) Business area, department
C) Vendor, department
D) Vendor, customer

Question 9

A business function is a high-level business area or department that performs ________ to achieve company goals.

A) financial statement reporting
B) auditing
C) business processes
D) information technology

Question 10

A business function is a high-level business area or department that performs business processes to achieve

A) accounting goals.
B) revenue.
C) profit.
D) company goals.

Question 11

Just as risk can exist at different levels, ________ can be performed at different levels of the company.

A) risk identification
B) risk statements
C) likelihood
D) impact

Question 12

Just as risk can exist at different levels, risk identification can be performed at ________ of the company.

A) the top-level
B) different levels
C) the bottom level
D) the board of directors' level

Question 13

Choose from the following the best description of enterprise risk management (ERM).

A) A narrow process of identifying, categorizing, prioritizing, and ignoring a company's risk
B) A narrow process of identifying, grouping, prioritizing, and ignoring a company's risk
C) A comprehensive process of identifying, categorizing, prioritizing, and responding to a company's risk
D) A comprehensive process of listing, prioritizing, and responding to a company's risk

Question 14

Choose from the following the best definition of risk identification.

A) Decide how the company will address the prioritized risks
B) Select which risks are most likely to occur or will have the largest impact
C) Categorizing risks based on their types
D) Identifying existing risks and their outcomes

Question 15

Choose from the following the best definition of risk response.

A) Decide how the company will address the prioritized risks
B) Select which risks are most likely to occur or will have the largest impact
C) Categorizing risks based on their types
D) Identifying existing risks and their outcomes

Question 16

Choose from the following the best definition of risk prioritization.

A) Decide how the company will address the prioritized risks
B) Select which risks are most likely to occur or will have the largest impact
C) Categorizing risks based on their types
D) Identifying existing risks and their outcomes

Question 17

Choose from the following the best definition of risk categorization.

A) Decide how the company will address the prioritized risks
B) Select which risks are most likely to occur or will have the largest impact
C) Categorizing risks based on their types
D) Identifying existing risks and their outcomes

Question 18

A risk statement contains two parts

A) the improvement and the solution.
B) the improvement and the possible outcome.
C) the issue and the solution.
D) the issue and the possible outcome.

Question 19

Complete the following statement: A company that takes on significant risk may have a(an) ________ over a company that avoids risk.

A) competitive advantage
B) unambitious advantage
C) competitive handicap
D) significant cost advantage

Question 20

What are some common keywords used in risk statements?

A) Because
B) Caused
C) Possible
D) All the above

Question 21

Complete the following statement: "It is essential for accounting professionals to understand risk - including ________ in risk management.

A) emerging trends
B) gradual trends
C) emerging directions
D) gradual directions

Question 22

The second step of ERM is

A) categorizing risks based on their type.
B) identifying risks.
C) responding to a company's risk.
D) categorizing risks based on response.

Question 23

An accountant would call the categorization of a risk, external or internal, the ________ of the risk.

A) solution
B) source
C) explanation
D) level

Question 24

Complete the following statement: "Identified risks are most useful when they are mapped to

A) external risks."
B) internal risks."
C) one source category."
D) both internal and external categories."

Question 25

Complete the following statement: "If a risk feels like it can be classified as both internal and external, companies fine-tune their risk statement to make it more ________ until it maps clearly to one source".

A) soft
B) hard
C) smooth
D) granular

Question 26

How many major internal risk categories are there?

A) 3
B) 4
C) 5
D) 6

Question 27

Choose from the following list a major internal risk category.

A) Compliance risk
B) Financial risk
C) Strategic risk
D) Physical risk

Question 28

Choose from the following list a major internal risk category.

A) Compliance risk
B) Strategic risk
C) Operational risk
D) Physical risk

Question 29

Choose from the following list a major internal risk category.

A) Compliance risk
B) Strategic risk
C) Physical risk
D) Reputational risk

Question 30

Choose from the following list the most important type of risk for an AIS.

A) Operational risk
B) Financial risk
C) Strategic risk
D) Physical risk

Question 31

Choose from the following list the best definition of technology risk.

A) When technology failures have the potential of improving business
B) When technology failures have the potential of disrupting business
C) When technology is deployed to solve business problems
D) When technology is removed from business operations

Question 32

Choose from the following list the best definition of cyber risks.

A) A common type of technology risk relating to an internal party accessing the company's financial records
B) When technology failures have the potential of disrupting business
C) A unique type of technology risk relating to an external party accessing the company's technology assets
D) When technology is removed from business operations

Question 33

Choose from the following list the best definition of financial risk.

A) Causes a breakdown in business operations
B) When the good name of a company is damaged
C) Refers to the potential gain of a substantial sum of money
D) Refers to the potential loss of a substantial sum of money

Question 34

Choose from the following list the best definition of reputational risks.

A) Causes a breakdown in business operations
B) When the good name of a company is damaged
C) Refers to the potential gain of a substantial sum of money
D) Refers to the potential loss of a substantial sum of money

Question 35

With reputational risk comes financial loss through a(n)

A) loss of customers and revenue.
B) decrease in expenses.
C) increase in stock price.
D) increase in customers and revenues.

Question 36

Why has reputation risk grown in importance?

A) Fewer people are shopping in stores.
B) Fewer people are shopping on-line.
C) More people are using and accessing social media.
D) More people are shopping on-line.

Question 37

Choose from the following list a major external risk category.

A) Compliance risk
B) Operational risk
C) Financial risk
D) Reputational risk

Question 38

Choose from the following list a major external risk category.

A) Operational risk
B) Strategic risk
C) Financial risk
D) Reputational risk

Question 39

Choose from the following list a major external risk category.

A) Operational risk
B) Financial risk
C) Physical risk
D) Reputational risk

Question 40

Choose from the following list the best definition of compliance risk.

A) Causes a breakdown in business operations
B) The threat of adverse weather, crimes, or physical damage
C) Is the inevitable risk that comes from a strategy becoming less effective
D) It occurs when a company fails to follow regulation and legislation and is subjected to legal penalties, including fines.

Question 41

Choose from the following list the best definition of strategic risk.

A) Causes a breakdown in business operations
B) The threat of adverse weather, crimes, or physical damage
C) Is the inevitable risk that comes from a strategy becoming less effective
D) It occurs when a company fails to follow regulation and legislation and is subjected to legal penalties, including fines.

Question 42

In September 2000, the CEO of Blockbuster was given the option to purchase Netflix for $50 million. At the time, Netflix was losing money and worried about bankruptcy. The Blockbuster CEO turned down the opportunity. This is an example of what type of risk?

A) Strategic risk
B) Compliance risk
C) Physical risk
D) Operational risk

Question 43

Choose from the following list the best definition of physical risk.

A) Causes a breakdown in business operations
B) The threat of adverse weather, crimes, or physical damage
C) Is the inevitable risk that comes from a strategy becoming less effective
D) It occurs when a company fails to follow regulation and legislation and is subjected to legal penalties, including fines.

Question 44

While ________ is the easiest to understand, it is one of the most important types of risk a company identifies because the impact is usually high.

A) strategic risk
B) compliance risk
C) physical risk
D) operational risk

Question 45

Choose from the following list the best definition of a risk inventory.

A) Causes a breakdown in business operations
B) The threat of adverse weather, crimes, or physical damage
C) Is the inevitable risk that comes from a strategy becoming less effective
D) A listing of all the business' known risks

Question 46

Founded in 1852, Wells Fargo is one of the largest banks in the United States. When internal fraud at Wells Fargo was exposed to the public in September 2016, what type of risk was increased at Wells Fargo due to this fraud?

A) Reputational risk
B) Compliance risk
C) Physical risk
D) Operational risk

Question 47

Choose the best definition of risk severity from the list below.

A) It is the likelihood of risks occurring and the potential impact on the company.
B) It is the estimated probability of a risk occurrence.
C) It is the estimation of damage that could be caused if the risk occurs.
D) It is an estimation of the loss of goodwill.

Question 48

Choose the best definition of likelihood from the list below.

A) Prioritizes risks by ranking their likelihood of occurring and the potential impact on the company
B) It is the estimated probability of a risk occurrence.
C) It is the estimation of damage that could be caused if the risk occurs.
D) It is an estimation of the loss of goodwill.

Question 49

Choose the best definition of impact from the list below.

A) Prioritizes risks by ranking their likelihood of occurring and the potential impact on the company
B) It is the estimated probability of a risk occurrence.
C) It is the estimation of damage that could be caused if the risk occurs.
D) It is an estimation of the loss of goodwill.

Question 50

Complete the following sentence: "Companies use different methods to calculate likelihood, but likelihood is always ranked on a

A) fixed level."
B) sliding level."
C) fixed scale."
D) sliding scale."

Question 51

Complete this sentence: "In different industries, likelihood can be described as

A) probability."
B) scarcity."
C) insufficient."
D) abundant."

Question 52

What is the abbreviation for Medium High?

A) MH
B) M
C) ML
D) H

Question 53

What is the abbreviation for High?

A) MH
B) M
C) ML
D) H

Question 54

What is the abbreviation for Medium Low?

A) MH
B) M
C) ML
D) H

Question 55

What is the abbreviation for Low?

A) MH
B) L
C) ML
D) H

Question 56

What is the abbreviation for Medium?

A) M
B) L
C) ML
D) H

Question 57

What is the risk calculation if a company assigns a likelihood of 4 to a particular risk and an impact of 3 to the risk?

A) 7
B) 12
C) 4
D) 3

Question 58

What is the risk calculation if a company assigns a likelihood of 1 to a particular risk and an impact of 5 to the risk?

A) 1
B) 3
C) 5
D) 6

Question 59

If a company identifies four risks with a risk score as follows: $\begin{array}{|l|c|}\hline \text{ Risk } &\text{ Risk Score} \\\hline\text{ An oven fire may result in the destruction of a store.} & 5 \\\hline \text{ A cybersecurity attack may result in the theft of customer data.} & 15 \\\hline\text{ A store employee getting sick may result in them backing out of their shift} \\\text{ last minute.} & 4 \\\hline\text{ An employee stealing from a cash register may result in loss of cash.} & 6 \\\hline\end{array}$

A) An oven fire may result in the destruction of a store.
B) A cybersecurity attack may result in theft of customer data.
C) A store employee getting sick may result in them backing out of their shift last minute.
D) An employee stealing from a cash register may result in loss of cash.

Question 60

If a company identifies four risks with a risk score:
$\begin{array}{|l|c|}\hline \text{ Risk } &\text{ Risk Score} \\\hline\text{ An oven fire may result in the destruction of a store.} & 5 \\\hline \text{ A cybersecurity attack may result in the theft of customer data.} & 15 \\\hline\text{ A store employee getting sick may result in them backing out of their shift} \\\text{ last minute.} & 4 \\\hline\text{ An employee stealing from a cash register may result in loss of cash.} & 6 \\\hline\end{array}$

A) An oven fire may result in the destruction of a store.
B) A cybersecurity attack may result in theft of customer data.
C) A store employee getting sick may result in them backing out of their shift last minute.
D) An employee stealing from a cash register may result in loss of cash.

Question 61

Choose the best definition of risk matrices from the list below.

A) Risk matrices give a clear picture through the assignment of values to the data.
B) Risk matrices are the estimated probability of a risk occurrence.
C) Risk matrices are the estimation of damage that could be caused if the risk occurs.
D) Risk matrices are an estimation of the loss of goodwill.

Question 62

Choose the best definition of a heat map from the list below.

A) A heat map is the estimated probability of a risk occurrence.
B) A heat map uses different colors to represent values of data in a map or diagram format.
C) A heat map is the estimation of damage that could be caused if the risk occurs.
D) A heat map is an estimation of the loss of goodwill.

Question 63

Referencing the following risk scale:
What likelihood score would you assign to a risk with an annual occurrence of 7%?

A) 1
B) 2
C) 3
D) 4

Question 64

Referencing the following risk scale:
What likelihood score would you assign to a risk with an annual occurrence of 3%?

A) 1
B) 2
C) 3
D) 4

Question 65

Consider the following risk matrix.
What score would a risk have with an impact of M and a likelihood of L?

A) 3
B) 4
C) 6
D) 8

Question 66

Consider the following risk matrix.
What score would a risk have with an impact of M and a likelihood of H?

A) 3
B) 5
C) 15
D) 16

Question 67

Consider the following risk matrix.
What score would a risk have with an impact of M and a likelihood of M?

A) 3
B) 6
C) 8
D) 9

Question 68

If a company identifies four risks with a risk scores as follows:

$\begin{array}{|l|c|}\hline \text{ Risk } &\text{ Risk Score} \\\hline\text{ An oven fire may result in the destruction of a store.} & 5 \\\hline \text{ A cybersecurity attack may result in the theft of customer data.} & 15 \\\hline\text{ A store employee getting sick may result in them backing out of their shift} \\\text{ last minute.} & 4 \\\hline\text{ An employee stealing from a cash register may result in loss of cash.} & 6 \\\hline\end{array}$

Question 69

How can someone determine how risky a risk is?

Question 70

The U.S. Bureau of Labor and Statistics anticipates a ________ percent growth in jobs with the focus of "risk management" between 2018-2026.

A) 10
B) 15
C) 18
D) 19

Question 71

Accounting professionals are uniquely qualified to work in risk management due to their training in ________, risk identification, and ________.

A) budgeting, financial statement preparation
B) business processes, tax preparation
C) business processes, holistic business operations
D) tax preparation, holistic business operations

Question 72

What is the first step of ERM?

A) Risk Identification
B) Risk Categorization
C) Risk Prioritization
D) Risk Response

Question 73

What is the second step of ERM?

A) Risk Identification
B) Risk Categorization
C) Risk Prioritization
D) Risk Response

Question 74

What is the third step of ERM?

A) Risk Identification
B) Risk Categorization
C) Risk Prioritization
D) Risk Response

Question 75

What is the last step of ERM?

A) Risk Identification
B) Risk Categorization
C) Risk Prioritization
D) Risk Response

Question 76

Choose the best definition of risk appetite from the list below.

A) Risk appetite is the amount of risk a company is willing to take on at that time.
B) Risk appetite uses different colors to represent values of data in a map or diagram format.
C) Risk appetite is the estimation of damage that could be caused if the risk occurs.
D) Risk appetite is an estimation of the loss of goodwill.

Question 77

Choose the phrase that most accurately completes this sentence. "Risk appetite is part of

A) a weak manager."
B) a company's culture."
C) a satisfied customer."
D) a strong employee."

Question 78

Choose the best definition of inherent risk.

A) Inherent risk is the risk to a business process of a cybersecurity leak.
B) Inherent risk is the remaining risk posed by a process or activity once a plan to respond to the risk is in place.
C) Inherent risk is the natural level of risk in a business process if there are no risk responses in place.
D) Inherent risk is the risk to a business process of a natural disaster, such as a fire or earthquake.

Question 79

Inherent risks consist of two parts: ________ and ________.

A) severity, financial
B) severity, impact
C) likelihood, financial
D) likelihood, impact

Question 80

Choose the best definition of residual risk.

A) Residual risk is the risk to a business process of a cybersecurity leak.
B) Residual risk is the remaining risk posed by a process or activity once a plan to respond to the risk is in place.
C) Residual risk is the natural level of risk in a business process if there are no risk responses in place.
D) Residual risk is the risk to a business process of a natural disaster, such as a fire or earthquake.