Risk Monitoring and Control

Treasury policies, procedures and controls (SOX, SSAE 18, SOC reports), policy drafting, payment and internal fraud, benchmarking, counterparty risk, business continuity, merchant services programs and regulatory compliance reporting.

5 minutes 5 Questions

In the Certified Treasury Professional (CTP) body of knowledge, Risk Monitoring and Control is the ongoing stage of the enterprise risk management (ERM) process that follows risk identification, measurement, and the selection of risk responses. Its purpose is to ensure that the organization's expos…

Concepts covered
Investment Policy Statement DraftingBank Fee BenchmarkingPCI DSS, Chargebacks and Card Data RetentionTreasury Policy Structure and ApprovalAML, KYC and Sanctions ScreeningBackup Balance Reporting and Funds TransferSupply Chain and Customer Counterparty RiskPolicy Compliance Monitoring and Exception ReportingCounterparty Exposure Measurement and LimitsHedging and Risk Management Policy DraftingCompliance Reporting and EscheatmentPayment Fraud Controls: Positive Pay and Debit BlocksTreasury Internal Controls FrameworkBank and Dealer Counterparty Risk AssessmentTreasury Business Continuity PlanningDerivatives Regulation and ReportingSSAE 18, SOC 1 and SOC 2 ReportsForeign Account Reporting (FBAR)Continuity Plan Testing and MaintenanceSarbanes-Oxley and Treasury ControlsMerchant Card Acceptance and InterchangeTreasury Performance Benchmarking and KPIsPayment Fraud Types and Business Email CompromiseCredit Approval Policy and Limit ComplianceInternal Fraud and Segregation of DutiesBanking and Payments Regulation Overview
Test mode:
Start practice test

CTP - Risk Monitoring and Control Example Questions

Test your knowledge of Risk Monitoring and Control

Question 1

Under Sarbanes-Oxley internal control reporting, what term describes a control deficiency that creates a reasonable possibility that a material misstatement of the financial statements will go unprevented or undetected on a timely basis?

Correct Answer: Material weakness

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. Management cannot conclude that controls are effective if one exists.
A significant deficiency is less severe than a material weakness but still important enough to merit the attention of those overseeing financial reporting. Reportable condition is outdated pre-SOX auditing terminology that was replaced by these terms. Audit exception is a general term for a test discrepancy, not a defined SOX severity level.
Key concept: SOX Section 404 control deficiency classifications by severity.

Question 2

What is the primary purpose of the standardized service codes that banks assign to individual line items on their account analysis statements?

Correct Answer: Grouping like services under common labels for cross-bank fee comparison

AFP Service Codes give similar bank services a common code and description, so treasury professionals can compare fees across banks on a like-for-like basis even when each bank names its services differently.
The codes do not set uniform pricing. Each bank sets its own rates, and fee standardization would raise antitrust concerns. Separating balance-based from fee-based charges is not the codes' purpose, since that split comes from the statement's balance and compensation sections. Linking fees to the earnings credit rate is also wrong, because the ECR applies to balances as a whole, not to individual service codes.
Key concept: AFP Service Codes standardize account analysis statements for bank fee comparison and analysis.

Question 3

A company's SOX testing relies on a SOC 1 Type 2 report from its cloud payment platform provider. The report carries an unqualified opinion, but it presents the third-party data center that hosts the platform using the carve-out method. Internal audit asks the treasury analyst how the company will gain assurance over the hosting controls that support financial reporting. What is the best response?

Correct Answer: Obtain the data center's own SOC 1 report and evaluate its controls

Under the carve-out method, the platform's SOC 1 report excludes the subservice organization's controls from its scope and opinion, so the company must obtain the data center's own SOC 1 report and evaluate those controls, including any complementary user entity controls.
A SOC 3 report is a general-use summary of Trust Services Criteria. It lacks the detailed control descriptions and test results needed for SOX reliance. The platform's clean opinion does not cover carved-out hosting controls. A bridge letter only addresses the gap period between a report's end date and the company's fiscal year-end. It does not cover controls excluded from scope.
Key concept: SOC 1 carve-out versus inclusive method for subservice organizations.

More Risk Monitoring and Control questions
543 questions (total)
Practice 100 questions
One session at a time, always new questions