What Risk Remains. What Controls Failed. What’s Next.
This course is part of The Complete Guide to Risk and Internal Controls, a comprehensive training series designed to build practical knowledge and skills in identifying, assessing, managing, and responding to risks through effective internal controls.
Residual Risk & Control Improvement focuses on what happens after internal controls have been designed and evaluated. Learners begin by determining the risk that remains after considering control effectiveness and evaluating appropriate risk response strategies. The course then explores how to identify and assess control deficiencies, understand why controls fail, and use root cause analysis to move from symptoms to meaningful corrective action.
The course also introduces fraud risk as a distinct consideration in internal control design and evaluation. Learners examine how intentional misconduct, override, collusion, and control weaknesses can create fraud opportunities, and how preventive, detective, and monitoring controls can be layered to reduce those opportunities. The course concludes by connecting residual risk, control deficiencies, root causes, corrective action, and fraud risk into a broader view of continuous control improvement.
Topics Covered
• Determining residual risk
• Using a residual risk matrix
• Applying judgment to residual risk conclusions
• Risk response strategies
• Acceptance, mitigation, transfer, and avoidance
• Identifying control deficiencies
• Isolated exceptions vs. broader control deficiencies
• Design deficiencies vs. operating deficiencies
• Evaluating the significance of control weaknesses
• Symptoms, contributing causes, and root causes
• 5 Whys analysis
• Fishbone analysis
• Bowtie analysis
• Connecting root causes to corrective actions
• Corrective action and follow-up
• Fraud risk vs. error risk
• The Fraud Triangle
• Fraud opportunity and internal control weaknesses
• Asset misappropriation, corruption, and financial statement fraud
• Fraud risks in common business processes
• Preventive and detective anti-fraud controls
• Management override and collusion
• Layering anti-fraud controls
• Monitoring and identifying unusual patterns
Audit Smarter, not Harder - with Elizabeth and Audie the Internal Otteror!
Elizabeth McDowell, CPA, CIA has over 20 years of audit experience and is the founder of Audit Forward, an innovative internal audit consulting and training firm. Elizabeth is passionate about advancing and advocating for the internal audit profession and was recognized as one of the 2023 Internal Audit Beacons by Richard Chambers. Elizabeth makes auditing and training fun (no, really!) with the help of her mascot, Audie the Internal Otteror. Elizabeth’s most recent industry experience was at Achieve, where she was Sr. Director, Audit Strategy; prior to that, she held internal audit leadership roles at Elevations Credit Union, Fidelity Investments, and Xcel Energy after first starting her career at Ernst & Young.
