Skip to content

ACCA Strategic Professional · Strategic Business Leader · Internal control and management reporting

Brightwave plc's audit committee reviewed its annual risk report and found that the risk register is updated only once a year and records risks but not whether mitigation actions are working. A major supplier failure then caused a significant loss. Which conclusion about the committee's monitoring is most appropriate?

Monitoring was inadequate. An annually updated register that does not test whether mitigations work cannot detect emerging risks. The committee should require regular reporting on key risk indicators and control effectiveness. Risk cannot be eliminated entirely, and the board cannot hand monitoring to the external auditor.

  1. AMonitoring was inadequate because it did not provide ongoing review of emerging risks and effectiveness of controls, so the committee should require regular reporting on key risk indicators and control performanceCorrect
  2. BThe failure shows risk should be eliminated entirely, so the committee should require all supplier dependencies to cease
  3. CMonitoring was adequate because a risk register existed, and the loss was unforeseeable
  4. DThe committee should leave monitoring to the external auditor, who reports annually on supplier risk

Explanation

Effective monitoring is continuous and covers both new risks and whether mitigations operate effectively, using key risk indicators and regular reports. A static annual register does not do this. Eliminating all risk is neither feasible nor the aim of risk management, and external audit does not take over board monitoring.

Did you get it right without looking?

One question tells you little. A timed set on Internal control and management reporting shows your real accuracy, how long you take and where you lose marks.

Practise Internal control and management reportingFree diagnostic mock

More Internal control and management reporting questions