CPA Bar Quiz: Identify And Evaluate Business Risks

What this quiz covers

This quiz focuses on Identify And Evaluate Business Risks, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Bar.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Establishing controls over data quality, privacy, and human review to prevent inappropriate disclosures and service errors (correct answer)
2. Increasing investment income by shifting reserves into higher-volatility securities
3. Reducing program spending to improve the current-year operating surplus
4. Changing the method used to allocate overhead to programs

Explanation: The concept of business risk analysis being tested is prioritizing internal controls for AI deployment in not-for-profit services. Key facts include an AI chatbot for triage using sensitive case notes, with expected cost reductions but data privacy concerns. The correct answer aligns with business analysis principles by emphasizing controls to prevent disclosures and errors, per data governance frameworks. Choice B is incorrect as it addresses investment volatility not related to AI, while C focuses on spending reductions overlooking privacy risks in COSO principles. Choice D is an allocation method not mitigating the core internal data risks in assessments. A framework for evaluating such risks includes data privacy impact assessments and control designs. Management should prioritize by testing controls and ensuring compliance with ethical standards.

Question 2

1. Low priority, because the event is unlikely to occur.
2. High priority, because the potential impact threatens the organization's viability. (correct answer)
3. Moderate priority, to be addressed after all high-likelihood risks are mitigated.
4. It should be accepted without action, as the probability is low.

Explanation: The correct answer is B. Risk evaluation is a function of both likelihood and impact. Even if an event has a low probability of occurring, a catastrophic impact requires that it be treated as a high-priority risk. These types of risks can threaten the ongoing survival of the business and must be managed carefully. A, C, and D are incorrect because they inappropriately dismiss the severity of the potential impact, which is a critical component of risk assessment.

Question 3

1. Pressure
2. Opportunity (correct answer)
3. Rationalization
4. Incentive

Explanation: The correct answer is B. Opportunity refers to the circumstances that allow fraud to occur. In this case, the weak internal control—specifically, the lack of segregation of duties and independent review—creates an opportunity for the clerk to commit fraud, such as creating a fictitious vendor and paying fraudulent invoices. A and D are incorrect because pressure (or incentive) refers to an individual's motivation for committing fraud, such as financial hardship. C is incorrect because rationalization is the mindset or justification an individual uses to make their fraudulent actions seem acceptable.

Question 4

1. Physical theft of on-premise servers.
2. Business disruption due to dependency on a single vendor. (correct answer)
3. Data entry errors by company employees.
4. Non-compliance with internal software development standards.

Explanation: The correct answer is B. This scenario describes vendor concentration risk. By relying on a single provider for critical functions, the company is vulnerable to major business disruptions if that provider experiences a significant outage, a security breach, a drastic price increase, or goes out of business. This is a key risk to evaluate in vendor management. A is incorrect because the servers are no longer on-premise. C is an operational risk but is not directly created by the outsourcing decision. D is an IT governance risk unrelated to the use of a third-party infrastructure provider.

Question 5

1. To detail the specific internal control procedures to be performed for every process.
2. To completely eliminate the possibility of financial losses.
3. To satisfy a mandatory SEC reporting requirement for all public companies.
4. To guide strategic planning and decision-making by defining the level of risk the entity is willing to accept. (correct answer)

Explanation: The correct answer is D. A risk appetite statement defines the amount and type of risk that an organization is willing to pursue or accept in the pursuit of its objectives. It serves as a high-level guide for management, helping to align strategy, resource allocation, and infrastructure with the board's risk philosophy. A is incorrect because a risk appetite statement is a high-level guide, not a detailed procedural manual. B is incorrect as it is impossible to eliminate all risks. C is incorrect because while risk disclosure is required, a specific formal risk appetite statement is a leading practice, not a universal SEC mandate.

Question 6

1. $500,000
2. $25,000 (correct answer)
3. $5,000
4. $2,500

Explanation: The correct answer is B. Expected loss is a quantitative risk assessment technique calculated as the product of the potential loss and the probability of occurrence. In this case, the calculation is: Expected Loss = Potential Loss × Probability Expected Loss = $500,000 × 5% = $25,000. A is the total potential loss, not the expected annual loss. C and D are incorrect calculations.

Question 7

1. The organization selects, develops, and performs ongoing and/or separate evaluations of internal controls.
2. The organization demonstrates a commitment to attract, develop, and retain competent individuals.
3. The organization considers the potential for fraud in assessing risks to the achievement of objectives. (correct answer)
4. The organization selects and develops general control activities over technology.

Explanation: The correct answer is C. Principle 8 of the COSO framework, which falls under the Risk Assessment component, explicitly states that the organization should consider the potential for fraud when assessing risks. This involves evaluating incentives, pressures, opportunities, and rationalizations for fraud. A is a principle of the Monitoring Activities component. B is a principle of the Control Environment component. D is a principle of the Control Activities component.

Question 8

1. Risk reduction
2. Risk sharing
3. Risk acceptance
4. Risk avoidance (correct answer)

Explanation: The correct answer is D. Risk avoidance is a response strategy that involves deciding not to become involved in, or to withdraw from, a risk situation. By canceling the project, the company is avoiding the associated risks altogether. A (reduction or mitigation) would involve implementing controls to lower the risk. B (sharing or transfer) would involve actions like buying insurance or partnering with another company. C (acceptance) would mean proceeding with the project despite the identified risks.

Question 9

1. All risks can eventually be eliminated through proper controls.
2. Risks are often interrelated and can have cascading impacts across different categories. (correct answer)
3. External risks are always more impactful than internal risks.
4. Risk evaluation is a one-time process that does not require ongoing monitoring.

Explanation: The correct answer is B. This scenario highlights that a single risk event, like a cybersecurity failure, rarely exists in isolation. It can trigger a chain reaction, leading to impacts in various other risk categories (operational, compliance, reputational, financial). Effective risk evaluation requires understanding these interrelationships. A is incorrect because not all risks can be eliminated. C is an invalid generalization; the impact of internal vs. external risks varies. D is incorrect as risk evaluation is a continuous, dynamic process.

Question 10

1. Failure to obtain volume discounts on software licenses.
2. Inefficient use of hardware resources.
3. Unauthorized or improperly tested changes disrupting business operations. (correct answer)
4. Delays in the initial development of new applications.

Explanation: The correct answer is C. This practice violates the principle of segregation of duties between development, testing, and production environments. A fundamental IT general control is change management, which ensures that all changes are authorized, tested, and properly deployed. Allowing developers direct production access bypasses these controls, increasing the risk of introducing errors, malicious code, or other disruptions. A, B, and D are potential IT issues, but they are not the primary risk created by this specific control weakness.

Question 11

1. Foreign currency risk
2. Credit risk
3. Interest rate risk (correct answer)
4. Commodity price risk

Explanation: The correct answer is C. Interest rate risk is the potential for loss that can result from changes in interest rates. Since the company's debt has a variable interest rate, an increase in benchmark rates will lead to higher interest payments, reducing profitability and cash flow. A is incorrect as the debt is in the company's home currency. B is incorrect because this refers to the risk that the company's customers won't pay, not the risk related to its own debt. D is incorrect as the risk is not tied to raw material prices.

Question 12

1. Opportunity
2. Collusion
3. Rationalization
4. Pressure/Incentive (correct answer)

Explanation: The correct answer is D. Pressure, also referred to as incentive or motivation, is what causes an individual to commit fraud. In this case, both the personal financial problems (a classic pressure) and the aggressive bonus structure (a strong incentive) provide the motivation for the manager to engage in fraudulent activity to meet the target. A, opportunity, is represented by the manager's authority to approve payments without review. C, rationalization, is the internal justification the manager might use, which is not described. B, collusion, is not a component of the fraud triangle.

Question 13

1. A bottom-up risk assessment focused on process-level controls in the accounting department.
2. A compliance audit against current industry regulations.
3. A top-down strategic risk assessment involving senior leadership and the board. (correct answer)
4. A review of IT help desk tickets to identify recurring system issues.

Explanation: The correct answer is C. A top-down approach begins at the entity level with the organization's objectives and strategies. It is ideal for identifying the high-level, significant risks that could impede the achievement of those long-term goals. This aligns perfectly with the board's focus on strategic threats. A and D are examples of bottom-up approaches that identify more granular, operational risks but would likely miss the major strategic risks. B is too narrow, focusing only on compliance risk.

Question 14

1. Reputational risk
2. Compliance risk (correct answer)
3. Market risk
4. Strategic risk

Explanation: The correct answer is B. Compliance risk is the risk of legal or regulatory sanctions, financial loss, or loss to reputation an organization may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organization standards, and codes of conduct. The FDA regulations are a clear example of this. A is incorrect because reputational damage would be a consequence of a compliance failure, but the root cause is compliance risk. C and D are incorrect as the risk stems directly from adherence to specific external rules, not from market movements or high-level strategic choices.

Question 15

1. DuPont analysis
2. Sensitivity analysis (correct answer)
3. Common-size financial statement analysis
4. Activity-based costing

Explanation: The correct answer is B. Sensitivity analysis is a risk assessment technique used in capital budgeting to determine how the NPV (or other outcomes) will change in response to a given change in a single input variable, holding all others constant. This allows management to identify the variables that have the most impact on the outcome and understand the project's vulnerability to forecasting errors. A is used to analyze return on equity. C is used to compare financial statements across periods or companies. D is a method for allocating overhead costs.

Question 16

1. High impact, high likelihood quadrant.
2. Low impact, high likelihood quadrant.
3. High impact, low likelihood quadrant. (correct answer)
4. Low impact, low likelihood quadrant.

Explanation: The correct answer is C. A risk with very low probability of occurring corresponds to 'low likelihood.' A moderate financial loss would typically be classified as 'high impact' on a standard risk heat map that divides risks into high/low categories, as it represents a significant financial consequence even if not catastrophic. A is for critical risks that are both severe and likely. B is for risks that occur frequently but have minor consequences. D is for risks that are both unlikely and have minimal impact when they occur.

Question 17

1. Inherent risk
2. Control risk
3. Residual risk (correct answer)
4. Detection risk

Explanation: The correct answer is C. Residual risk is the risk that remains after management has taken action to mitigate it, such as implementing an internal control. It is the net risk after considering the effectiveness of controls. A is incorrect because inherent risk is the level of risk before any controls or mitigation strategies are applied. B is incorrect because control risk is the risk that a control will fail to prevent or detect a misstatement. D is incorrect because detection risk is the risk that an auditor's procedures will not detect a material misstatement.

Question 18

1. Credit risk
2. Liquidity risk
3. Operational risk (correct answer)
4. Market risk

Explanation: The correct answer is C. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events. The potential for failure of a critical piece of machinery is a classic example of an internal systems failure that falls under operational risk. A, B, and D are all types of financial risk. Credit risk relates to a counterparty's failure to pay, liquidity risk relates to the inability to meet short-term obligations, and market risk relates to losses from factors that affect the entire market, like interest rate changes.

Question 19

1. Operational risk
2. Financial risk
3. Compliance risk
4. Strategic risk (correct answer)

Explanation: The correct answer is D. Strategic risk relates to the high-level decisions that affect an organization's ability to achieve its goals and objectives. Entering a new, competitive market is a major strategic decision with significant uncertainty, directly impacting the company's long-term direction and viability. A is incorrect because operational risk relates to failures in internal processes, people, and systems. B is incorrect because while the venture has financial implications, the root risk is strategic; financial risk is more specific, such as interest rate or credit risk. C is incorrect because compliance risk relates to violations of laws and regulations, which is a factor but not the primary classification for the entire market entry decision.

Question 20

1. Reviewing the prior year's internal audit findings.
2. Interviewing only the Chief Financial Officer and the Chief Executive Officer.
3. Conducting facilitated risk assessment workshops with cross-functional teams. (correct answer)
4. Using a generic manufacturing industry risk checklist from an external consultant.

Explanation: The correct answer is C. Facilitated workshops with cross-functional teams bring together diverse perspectives from different parts of the business. This collaborative approach is highly effective for identifying a comprehensive range of risks (operational, strategic, etc.) and promotes a culture of shared responsibility for risk management. A is too narrow, focusing only on past issues. B is a top-down approach that would likely miss granular operational risks. D is a useful starting point but lacks the specific context of the company and may not uncover unique or emerging risks.