Section: Volume B
Explanation:
The COSO ERM (Enterprise Risk Management) frame work is a 3-dimensional model. The dimensions and their components include:
* Strategic Objectives - includes strategic, operations, reporting, and compliance.
* Risk Components - includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring.
* Organizational Levels - include subsidiary, business unit, division, and entity-level.
The COSO ERM framework contains eight risk components:
* Internal Environment
* Objective Settings
* Event Identification
* Risk Assessment
* Risk Response
* Control Activities
* Information and Communication
* Monitoring
Section 404 of the Sarbanes-Oley act specifies a three dimensional model- COSO ERM, comprised of Internal control components, Internal control objectives, and organization entities. All the items listed are components except Financial reporting which is an internal control objective.
Incorrect Answers:
A, C, D: They are the Internal control components, not the Internal control objectives.

is incorrect. The act of spending money to reduce a risk probability and impact is known as mitigation. Answer: D is incorrect. Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Answer: C is incorrect. When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.

Section: Volume D

Section: Volume D
Explanation