Free CAFS sample questions

Correct answer: Owning and managing risks within operational activities

The First Line of Defense consists of business unit management and operational staff who own and manage risks day-to-day. They are responsible for implementing corrective actions and maintaining effective internal controls. The Second Line (Risk/Compliance) establishes frameworks, and the Third Line (Audit) provides independent assurance. flowchart TD L1[First Line: Business Operations] -->|Owns Risk| Risk{Risk Mgmt} L2[Second Line: Risk & Compliance] -->|Monitors| Risk L3[Third Line: Internal Audit] -->|Audits| Risk

Correct answer: The risk remaining after controls are applied to the inherent risk

Residual Risk is the risk that remains after management has implemented internal controls to mitigate the Inherent Risk. In this scenario, a High Inherent Risk mitigated by Strong controls would likely result in a Low or Medium Residual Risk. It is calculated as: Inherent Risk - Control Effectiveness = Residual Risk.

Correct answer: Preventive Control

Password management and access restrictions are Preventive Controls designed to stop fraud before it occurs. Sharing passwords undermines the preventive measure of authentication and accountability, making it impossible to enforce segregation of duties effectively.

Correct answer: The amount and type of fraud risk an organization is willing to pursue or retain in pursuit of its strategic objectives.

Risk Appetite is a broad, strategic statement defining the amount of risk an organization is willing to accept to achieve its goals. It differs from Risk Tolerance, which is more granular and specific (e.g., specific dollar thresholds). Risk Appetite guides the overall strategy.

Correct answers: Roles and responsibilities for reporting and investigating suspected fraud; Definition of what constitutes fraud and prohibited behavior

The policy must say who reports suspected fraud, usually every employee, and who may investigate it. Clear roles give a structured response to each suspicion.

A fraud policy must define what the organization treats as fraud and state that this behavior is prohibited. This gives the legal and HR basis for action.

Correct answer: False

False. Segregation of Duties is a PREVENTIVE control. By ensuring that no single individual has control over all aspects of a transaction (e.g., authorizing and recording), it prevents fraud from happening or requires collusion, which is harder to orchestrate.