Annual IA Planning Process
What are the 5 risk assessment residual risk ratings?
High, Moderate-High, Moderate, Low-Moderate, Low
What is the document that summarizes the identified processes, risks, and controls including the test steps, conclusions, and issues identified?
Risk Control Matrix (RCM)
How many samples should be selected for a weekly control (lower risk of failure)?
5
What are the audit report ratings?
Satisfactory, Adequate, Needs Improvement, Unsatisfactory
Quarterly or every 90 days
How often should continuous monitoring be performed?
At least quarterly
What is a management identified issue called?
Self-Identified Issue
What are the TOE conclusions?
Effective and Ineffective
What are the issue ratings?
Significant, Moderate, Low, Observation
This field will contain an Executive-level current issue status update which will be leveraged by the Enterprise Risk Management (ERM) Team for Board Reporting. Engagement Owners must review language within this field as a part of Quarter-end activity.
Board Update field
How often should all significant processes be covered in an audit?
How often should client status update meetings be held?
Weekly
What are the 2 sampling methods?
Statistical and non-statistical
What is an estimate of the extent (severity or magnitude) to which the risk, if realized, would impact the organization?
Impact
Which issue status indicates management has communicated and provided documentation to review teams that it has completed its Action Plan remediation activities, but the review teams have not had an opportunity to confirm for closure.
Closed Pending Review
What risk categories (9) are assessed as part of the risk assessment process?
Credit, Liquidity, Market, Operational - Operations, Operational - Technology, Regulatory Compliance/Legal, AML/BSA Compliance, Strategic, Reputation
What are the TOD conclusions?
Adequate, Inadequate, Gap
What testing technique involves following the documents through the system, from origination or source document to final records?
Tracing
What is the probability of the risk event occurring?
Likelihood
Low/Moderate first time issue extensions should be approved by whom?
CAE
What are the 2 types of SAS engagements?
Audits and Projects
What is performed to confirm whether the control has indeed been established and put in place?
Test of One
What population details should be documented within the audit workpaper (5)?
Source, method for obtaining, population characteristics, population start/end dates, method for determining completeness.
What are the 5 C's for audit issues?
Criteria, Condition, Cause (Root Cause), Consequence (Risk/Effect), Corrective Action (Recommendation)
What testing is required to be completed for issue validation testing?
TOD and TOE testing