Which GAO standard would you use to identify risks to achieving agency objectives?

Which GAO standard would you use to identify risks to achieving agency objectives?

• A. Risk Assessment
• B. Control Activities
• C. Information and Communication
• D. Monitoring

Answer: (A)

Risk assessment is the process of identifying and analyzing risks that could prevent achieving objectives. In the GAO internal control framework, this step is where you look for where things could go wrong, gauge how likely those risks are and how big an impact they would have, and consider changes in the environment that might create new risks. This identification and analysis is what guides where controls are needed and how to prioritize them. Control activities come next, as the actions put in place to mitigate the identified risks. Information and Communication focuses on ensuring the right information flows to the right people so decisions are well-informed. Monitoring involves ongoing evaluation of how well the controls work over time. So, to pinpoint risks to reaching agency objectives, risk assessment is the appropriate standard.

Risk assessment is the process of identifying and analyzing risks that could prevent achieving objectives. In the GAO internal control framework, this step is where you look for where things could go wrong, gauge how likely those risks are and how big an impact they would have, and consider changes in the environment that might create new risks. This identification and analysis is what guides where controls are needed and how to prioritize them.

Control activities come next, as the actions put in place to mitigate the identified risks. Information and Communication focuses on ensuring the right information flows to the right people so decisions are well-informed. Monitoring involves ongoing evaluation of how well the controls work over time. So, to pinpoint risks to reaching agency objectives, risk assessment is the appropriate standard.