PRM – M8

Inspection is an example of:

How much risk the organization is willing to accept is based on:

When you buy down or control risk, the remaining risk is called:

When residual risk is greater than your risk tolerance, what statement is most accurate?

What is usually NOT considered a control?

If your organization is ‘risk sensitive’, what is the most accurate statement?

What is the best thing to do if the residual risk is greater than your risk threshold?

Segregation of duties is usually considered a key:

Risk evaluation is based on what of the following;

Controls are designed to provide reasonable assurance that:

What are the most critical controls?

1. Hard controls
2. Procedural controls
3. Discretionary controls
4. Soft controls

What is NOT an element of a system of internal control?