nerdexam
Isaca

CRISC · Question #600

During a risk assessment of a financial institution, a risk practitioner discovers that tellers can initiate and approve transactions of significant value. This team is also responsible for ensuring…

The correct answer is C. Implement separation of duties. The scenario describes a situation where a single individual has control over multiple critical transaction functions, which is a significant control weakness. The best recommendation to mitigate this risk is to implement separation of duties, ensuring that no single person can…

Submitted by carter_n· Apr 18, 2026Risk Response and Reporting

Question

During a risk assessment of a financial institution, a risk practitioner discovers that tellers can initiate and approve transactions of significant value. This team is also responsible for ensuring transactions are recorded and balances are reconciled by the end of the day. Which of the following is the risk practitioner's BEST recommendation to mitigate the associated risk?

Options

  • AImplement continuous monitoring.
  • BRequire a second level of approval.
  • CImplement separation of duties.
  • DRequire a code of ethics.

How the community answered

(37 responses)
  • A
    16% (6)
  • B
    8% (3)
  • C
    73% (27)
  • D
    3% (1)

Why each option

The scenario describes a situation where a single individual has control over multiple critical transaction functions, which is a significant control weakness. The best recommendation to mitigate this risk is to implement separation of duties, ensuring that no single person can complete a transaction end-to-end without independent checks.

AImplement continuous monitoring.

While continuous monitoring detects issues after they occur or as they happen, separation of duties is a preventative control designed to stop fraudulent activity from occurring in the first place, which is a stronger mitigation for this specific risk.

BRequire a second level of approval.

Requiring a second level of approval addresses one aspect of the problem (authorization), but it doesn't fully mitigate the risk of the same person initiating, recording, and reconciling, which comprehensive separation of duties does.

CImplement separation of duties.Correct

The scenario describes a single person performing multiple conflicting functions (initiating, approving, recording, and reconciling transactions), which creates a high risk of fraud or error. Implementing separation of duties ensures that different individuals are responsible for different stages of a process, thereby introducing checks and balances and significantly reducing the risk of misuse or mistakes.

DRequire a code of ethics.

A code of ethics is a foundational control that guides behavior and promotes integrity, but it is not a technical or procedural control designed to prevent the specific operational risks arising from conflicting duties.

Concept tested: Separation of duties (SoD)

Source: https://learn.microsoft.com/en-us/microsoft-365/compliance/separation-of-dues

Topics

#Separation of Duties#Internal Controls#Risk Mitigation#Operational Risk

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice