A. Anonymity should be afforded only when the issue raised is of minor importance.

B. Anonymity should only be afforded to stakeholders who are not employees of the organization.

C. Anonymity should never be afforded, as it encourages false reporting.

D. Anonymity should be afforded where legally permitted or required.

A. Individualized Incentives

B. Management Incentives

C. Economic Incentives

D. Social Incentives

A. To provide incentives to employees for favorable conduct

B. To compound and accelerate the impact of favorable events

C. To address allegations or indications of unfavorable events and respond to external inquiries and investigations

D. To ensure timely and consistent reporting to applicable stakeholders

A. To ensure that notifications are handled by the right organizational units or roles based on topic, type, and severity

B. To ensure that notifications are only sent to the CEO and board of directors, or to the General Counsel if a legal issue is raised

C. To provide the right to respond before any follow-up actions or investigations are started

D. To prevent employees from receiving any notifications that may cause stress unnecessarily

A. Assurance is the practice of monitoring and controlling the organization's financial performance and reporting

B. Assurance is the establishment of policies and procedures to ensure compliance with applicable laws and regulations

C. Assurance is the act of objectively and competently evaluating subject matter to provide justified conclusions and confidence that statements and beliefs about the subject matter are true

D. Assurance is the process of identifying and mitigating risks that could negatively impact the organization's objectives

A. A hazard affects the likelihood of an event, while an obstacle is a hazard with significant impact on objectives.

B. A hazard is a type of obstacle, while an obstacle is an overarching category of threat.

C. A hazard is a cause that has the potential to eventually result in harm, while an obstacle is an event that may have a negative effect on objectives.

D. A hazard is a measure of the negative impact on the organization, while an obstacle is a state of conditions that create a hazard.

A. To comply with industry regulations regarding stakeholder management.

B. To prevent stakeholders from forming alliances against the organization.

C. To address the requests, wants, or expectations of stakeholders and inform the mission, vision, and objectives of the organization.

D. To ensure that all stakeholders receive equal consideration.

A. Effectiveness, Efficiency, Responsiveness, and Resilience

B. Quality, Productivity, Flexibility, and Durability

C. Compliance, Consistency, Adaptability, and Robustness

D. Accuracy, Precision, Speed, and Stability

A. KRIs are subjective measures that are not based on any specific risk assessments or data so they only provide a high-level assessment of threats

B. KRIs are only relevant for governmental entities and have no role in commercial enterprises

C. KRIs are indicators that help govern, manage, and provide assurance about risk related to an objective

D. KRIs are used to evaluate the performance of the risk management and compliance departments

A. The negative, unfavorable effect of uncertainty on objectives

B. The rate of return on investment and capital allocation

C. The level of innovation and technological advancement

D. The quality of products and services offered to customers

A. Indicators are used to calculate the return on investment for various projects and initiatives.

B. Indicators are used to determine if the objectives must be changed in response to changes in the external or internal context.

C. Indicators are used to evaluate the appropriateness of the organization's selection of objectives.

D. Indicators measure quantitative or qualitative progress toward an objective.

A. Level 3 - Consistent

B. Level 2 - Managed

C. Level 1 - Initial

D. Level 4 - Measured

A. Through the use of both technology and physical actions and controls to recover from negative conduct and conditions, correct identified weaknesses, and establish barriers to future misconduct.

B. Through focusing on promoting positive behavior and establishing reward systems for employees who identify weaknesses in the systems of control.

C. Through the application of responsive actions and controls that recover from unfavorable conduct, events, and conditions; correct identified weaknesses; execute necessary discipline; recognize and reinforce favorable conduct; and deter future undesired conduct or conditions.

D. Through open and transparent acknowledgment of the identified unfavorable conduct or events and acceptance of responsibility by the CEO.

A. All communication should take place through formal communication methods to ensure the organization has met all of its communication requirements established by regulations

B. The organization does not need to maintain a detailed record of every aspect of how communications are managed but should have a record of the content of any formal internal communications to employees as part of their training

C. Action and control owners in the same, or related process should be able to manage their communications individually to ensure they get and deliver needed information

D. Not all communication takes place through formal methods, so informal communications also should be used as they may have more impact