IIA-CRMA Exam - Topic 3 Question 101 Discussion

Actual exam question for IIA's IIA-CRMA exam

Question #: 101
Topic #: 3

An internal auditor is conducting an assessment of the organization's fraud prevention program using the COSO enterprise risk management framework. According to this framework, which of the following activities would fall under the control environment component for preventing fraud?

1. The organization uses an automated authority approval matrix to control payments.

2. The organization has a whistleblower hotline that is available to employees.

3. Annually, every manager completes a comprehensive fraud assessment of his or her department.

4. Annually, the organization reviews and communicates the code of expected behavior.

A1 and 2.

B1 and 3.

C2 and 3.

D2 and 4.

Show Suggested Answer

Suggested Answer: D

by Elliot at Apr 30, 2025, 12:52 AM

Limited Time Offer

25%

Off

Get Premium IIA-CRMA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ellsworth

4 months ago

Wait, how does an approval matrix prevent fraud? Seems off.

upvoted 0 times

...

Tambra

4 months ago

Definitely think 2 and 4 are key for fraud prevention!

upvoted 0 times

...

Lemuel

4 months ago

The control environment includes ethical values and integrity.

upvoted 0 times

...

Avery

5 months ago

I thought annual assessments were more about risk than control.

upvoted 0 times

...

Marvel

5 months ago

I agree, a whistleblower hotline is super important!

upvoted 0 times

...

Desiree

5 months ago

I’m a bit confused about the automated approval matrix. It seems more like a control activity rather than part of the control environment, right?

upvoted 0 times

...

Alease

5 months ago

I practiced a similar question where we discussed the importance of communication in the control environment. I feel like option 4 is key here.

upvoted 0 times

...

Ashanti

6 months ago

I'm not entirely sure, but I think the whistleblower hotline is definitely part of the control environment. The other options seem more like specific controls.

upvoted 0 times

...

Desirae

6 months ago

I remember that the control environment is all about the tone at the top and organizational culture, so I think options 2 and 4 might be relevant.

upvoted 0 times

...

Josephine

6 months ago

I'm a little confused by the wording of the question. Is it asking which activities would be part of the control environment specifically for fraud prevention, or just in general? I want to make sure I'm interpreting that correctly before I answer.

upvoted 0 times

...

Selma

6 months ago

I've got this! The control environment is all about the organization's commitment to integrity, ethical values, and competence. So activities like communicating the code of conduct and having a whistleblower hotline would definitely fall under that component.

upvoted 0 times

...

German

6 months ago

Okay, let's think this through. The control environment is about the overall tone and culture of the organization when it comes to internal controls and risk management. So I'm guessing the activities that promote that kind of environment would be the right answer.

upvoted 0 times

...

Chantell

6 months ago

Hmm, I'm a bit unsure about this one. The COSO framework has a lot of different components, and I want to make sure I understand which ones are relevant for fraud prevention. I'll need to review my notes carefully.

upvoted 0 times

...

Aleshia

7 months ago

This question seems straightforward. The COSO framework has specific components, and the control environment is one of them. I think I can identify which activities would fall under that component.

upvoted 0 times

...

Skye

10 months ago

Ha! Looks like the auditors are trying to trip us up with this one. I bet they're sitting back and chuckling, waiting to see who falls for the wrong answer. But I'm going with D - gotta keep those whistles blowing and the behavioral standards high!

upvoted 0 times

...

Hannah

10 months ago

Hmm, I don't know. The automated approval matrix sounds like a good control, but I'm not sure if it falls under the control environment. I'll have to think this one through a bit more.

upvoted 0 times

...

Albina

10 months ago

I'm not sure about that. While the whistleblower hotline is definitely part of the control environment, I think the annual fraud assessment by managers is also an important control activity. Maybe B is the way to go?

upvoted 0 times

Janae

9 months ago

Yes, that's correct. It's important to have a combination of control activities to effectively prevent fraud.

upvoted 0 times

...

Rolland

9 months ago

So, we are all in agreement that the correct answer is B, which includes activities 1 and 3.

upvoted 0 times

...

Zona

10 months ago

I agree. The annual fraud assessment by managers is also crucial in maintaining a strong control environment.

upvoted 0 times

...

Lenna

10 months ago

I think B is a good choice. The automated authority approval matrix and the whistleblower hotline are both important for fraud prevention.

upvoted 0 times

...

Goldie

10 months ago

I agree with Twanna, the control environment component for preventing fraud includes activities like automated approval matrix and comprehensive fraud assessment.

upvoted 0 times

...

Twanna

11 months ago

I think the answer is B) 1 and 3 because both activities are related to controlling fraud.

upvoted 0 times

...

Theron

11 months ago

The control environment is all about the organization's culture and the tone at the top, so I think option D is the best choice here. Having a whistleblower hotline and communicating the code of expected behavior are both crucial for fostering an ethical environment.

upvoted 0 times