ACC 474 FINAL EXAM UPDATED ACTUAL QUESTIONS
AND CORRECT ANSWERS
Question:
1. Why is it important for organizations to understand risk?
Answer:
So that they proactively identify and manage risk and engage in an optimal level
of risk-taking to maximize expected enterprise value.
Question:
2. What is Enterprise Risk Management (ERM)?
Answer:
The comprehensive process of identifying, categorizing, prioritizing, and
responding to a company's risks.
Question:
3. What is the formula to calculate risk score?
Answer:
Impact * likelihood.
Question:
4. What are the four responses to risk?
Answer:
Accept, mitigate, transfer, and avoid.
Question:
5. What is an example of accepting the risk?
Answer:
Buying a phone but not getting a case or screen protector.
Question:
6. What is an example of mitigating the risk?
Answer:
Buying a new phone and getting a phone case and a screen protector.
Question:
7. What is an example of transferring risk?
Answer:
Buying insurance for your new phone.
, Question:
8. What is an example of avoiding risk?
Answer:
Not getting a new phone.
Question:
9. What is the difference between inherent and residual
risk?
Answer:
Inherent risk is the natural level of risk in a business process, residual is the
remaining risk once a plan to respond to the risk is in place.
Question:
10. What is the difference between preventative and
detective controls?
Answer:
Preventative controls stop problems from happening, detective controls alert
management to a problem once it has already happened.
Question:
11. What type of control is segregation of duties?
Answer:
Preventative
Question:
12. What does segregation of duties entail?
Answer:
It ensures that different employees are responsible for the separate parts of a
business activity of authorizing, recording, and having custody.
Question:
13. What are ITGCs?
Answer:
IT General controls, they are controls applied to the entire technology
environment.
Question:
14. What are application controls?
Answer:
Controls applied to a specific technology application
AND CORRECT ANSWERS
Question:
1. Why is it important for organizations to understand risk?
Answer:
So that they proactively identify and manage risk and engage in an optimal level
of risk-taking to maximize expected enterprise value.
Question:
2. What is Enterprise Risk Management (ERM)?
Answer:
The comprehensive process of identifying, categorizing, prioritizing, and
responding to a company's risks.
Question:
3. What is the formula to calculate risk score?
Answer:
Impact * likelihood.
Question:
4. What are the four responses to risk?
Answer:
Accept, mitigate, transfer, and avoid.
Question:
5. What is an example of accepting the risk?
Answer:
Buying a phone but not getting a case or screen protector.
Question:
6. What is an example of mitigating the risk?
Answer:
Buying a new phone and getting a phone case and a screen protector.
Question:
7. What is an example of transferring risk?
Answer:
Buying insurance for your new phone.
, Question:
8. What is an example of avoiding risk?
Answer:
Not getting a new phone.
Question:
9. What is the difference between inherent and residual
risk?
Answer:
Inherent risk is the natural level of risk in a business process, residual is the
remaining risk once a plan to respond to the risk is in place.
Question:
10. What is the difference between preventative and
detective controls?
Answer:
Preventative controls stop problems from happening, detective controls alert
management to a problem once it has already happened.
Question:
11. What type of control is segregation of duties?
Answer:
Preventative
Question:
12. What does segregation of duties entail?
Answer:
It ensures that different employees are responsible for the separate parts of a
business activity of authorizing, recording, and having custody.
Question:
13. What are ITGCs?
Answer:
IT General controls, they are controls applied to the entire technology
environment.
Question:
14. What are application controls?
Answer:
Controls applied to a specific technology application
