Free CAFS sample questions

Correct answer: Control Environment

The Control Environment is the foundation of the COSO framework. It sets the tone of the organization, influencing the control consciousness of its people. It includes governance, integrity, ethical values, and the operating style of management. Without a strong control environment, other components (like risk assessment or monitoring) cannot function effectively.

Correct answer: Owning and managing risks within operational activities

The First Line of Defense consists of business unit management and operational staff who own and manage risks day-to-day. They are responsible for implementing corrective actions and maintaining effective internal controls. The Second Line (Risk/Compliance) establishes frameworks, and the Third Line (Audit) provides independent assurance. flowchart TD L1[First Line: Business Operations] -->|Owns Risk| Risk{Risk Mgmt} L2[Second Line: Risk & Compliance] -->|Monitors| Risk L3[Third Line: Internal Audit] -->|Audits| Risk

Correct answer: The risk remaining after controls are applied to the inherent risk

Residual Risk is the risk that remains after management has implemented internal controls to mitigate the Inherent Risk. In this scenario, a High Inherent Risk mitigated by Strong controls would likely result in a Low or Medium Residual Risk. It is calculated as: Inherent Risk - Control Effectiveness = Residual Risk.

Correct answer: Preventive Control

Password management and access restrictions are Preventive Controls designed to stop fraud before it occurs. Sharing passwords undermines the preventive measure of authentication and accountability, making it impossible to enforce segregation of duties effectively.

Correct answer: The amount and type of fraud risk an organization is willing to pursue or retain in pursuit of its strategic objectives.

Risk Appetite is a broad, strategic statement defining the amount of risk an organization is willing to accept to achieve its goals. It differs from Risk Tolerance, which is more granular and specific (e.g., specific dollar thresholds). Risk Appetite guides the overall strategy.

Correct answers: Definition of what constitutes fraud and prohibited behavior; Roles and responsibilities for reporting and investigating suspected fraud

Definition of what constitutes fraud and prohibited behavior: A fraud policy must clearly define what the organization considers fraud and explicitly state that such behavior is prohibited. This provides the legal and HR basis for action. Roles and responsibilities for reporting and investigating suspected fraud: The policy must clearly outline who is responsible for reporting suspicions (usually all employees) and who is authorized to investigate them, ensuring a structured response.

Definition of what constitutes fraud and prohibited behavior: A fraud policy must clearly define what the organization considers fraud and explicitly state that such behavior is prohibited. This provides the legal and HR basis for action. Roles and responsibilities for reporting and investigating suspected fraud: The policy must clearly outline who is responsible for reporting suspicions (usually all employees) and who is authorized to investigate them, ensuring a structured response.