Question

A risk practitioner is designing the ongoing monitoring plan for a portfolio of internal controls. Management wants an efficient approach that focuses testing effort where it matters most. Which factor should PRIMARILY determine how frequently each control is tested?

Accepted Answer

The criticality of the risk the control addresses and the control's historical failure rate

Answer

The number of staff members involved in operating the control

Answer

The date the control was most recently implemented or modified

Answer

The preference of the control owner regarding audit disruption