Control Design and Implementation CRISC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm has a control requiring dual authorization for all wire transfers above $10,000. Due to a temporary staffing shortage, the operations manager requests a 30-day waiver to allow single authorization for transfers up to $25,000. What is the most appropriate first step for the risk manager?

   • APerform a risk assessment and obtain formal risk acceptance from the appropriate authority
   • BDeny the request and require the manager to hire temporary staff immediately
   • CGrant the waiver and document it in the risk register
   • DImplement a detective control to monitor all single-authorized transfers during the period
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An auditor is testing a control that requires two employees to sign off on all cash disbursements. To verify that the control is operating effectively, the auditor selects a sample of disbursements and examines the signed approval forms. Which testing method is the auditor using?

   • AInquiry
   • BInspection
   • CRe-performance
   • DObservation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of an exception to a control requirement?

   • ATo document that a control is not needed
   • BTo allow a temporary deviation from a control requirement under specific conditions
   • CTo permanently eliminate the control requirement
   • DTo avoid the need for risk acceptance
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is selecting a control to mitigate the risk of unauthorized access to its customer database. The risk is high, but the budget is limited. Which control selection is most appropriate?

   • AImplement a simple password policy without MFA
   • BImplement a strong password policy and multi-factor authentication
   • CImplement a state-of-the-art biometric access control system
   • DImplement no additional control and accept the risk
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of collecting evidence during control testing?

   • ATo support the conclusions drawn from the testing
   • BTo satisfy the preferences of the auditor
   • CTo replace the need for testing
   • DTo increase the cost of the audit
   Reveal Solution Discussion Select an answer first