COSO Risk Assessment: Significant System Changes

Answer C. Under the COSO framework, risk assessment requires management to identify and analyze risks that could prevent the entity from achieving its objectives, including risks created by significant changes in operations or the business model. The company began selling through third-party online marketplaces but did not formally evaluate new risks such as chargebacks, platform fees, and higher return rates. Because the primary failure is the lack of identification and analysis of those new risks before relying on existing controls, the deficiency is in risk assessment.

Why not A: Monitoring can detect control failures over time, but the scenario emphasizes that management did not evaluate the new risks from its changed operations, an issue of risk assessment rather than a failure of monitoring. The stem also does not state that separate evaluations were required and missing.

Why not B: This is tempting because reconciliations and approvals are control activities, but the stem states those procedures are still being performed and does not say they were ineffective or poorly designed. The more fundamental problem is that management failed to identify and analyze the new risks created by the change in sales channels.

Why not D: While changes in a sales channel may require new information flows or guidance, the stem does not indicate any breakdown in communication or missing manuals. The central issue is management's failure to identify and analyze the new risks introduced by the marketplace sales, not a lack of documentation.

Answer D. Under COSO, management must first specify suitable objectives with enough clarity for relevant risks to be identified and assessed. Here, the objective was too vague, so later risk discussions missed important financial reporting risks tied to the new program. The monitoring meetings and transaction-level control activities do not fix that foundational objective-setting weakness.

Why not A: This choice is tempting because the issue arose in connection with a newly launched program, which is a significant change. But the facts indicate management did respond to the launch by updating narratives, assigning personnel, and implementing routine controls. The clearer deficiency is not failure to notice change; it is failure to define sufficiently specific reporting objectives for the changed environment.

Why not B: This is tempting because the facts show that management overlooked several important risks. But the stem points to the earlier, more fundamental COSO failure: management never established sufficiently specific reporting objectives from which those risks should have been identified. The missed risk analysis is a downstream effect of the objective-setting problem.

Why not C: This distractor is attractive because side agreements and period-end acceleration are classic fraud-risk indicators. However, the deficiency described is broader than fraud risk alone; management's vague objective prevented proper identification of both fraudulent and nonfraudulent misstatement risks. COSO would view the lack of clear objectives as the more direct missing principle.

Answer D. Risk assessment involves identifying and analyzing risks that could prevent the entity from achieving its objectives, especially when business conditions change. Here, management identified new risks from the online platform (payment fraud, customer data, returns) and evaluated whether existing controls address those risks, which is the core activity of the COSO risk assessment component.

Why not A: This is tempting because management is involved and the control environment covers tone at the top and governance. However, the scenario focuses on identifying and analyzing new business risks rather than setting ethical tone, values, or organizational oversight.

Why not B: Monitoring involves ongoing or separate evaluations to determine whether controls continue to operate effectively. The scenario describes initial identification and analysis of new risks and assessing whether current controls address them, which is primarily risk assessment rather than monitoring.

Why not C: This distractor is plausible because the scenario mentions whether existing controls address risks. Control activities are the specific policies and procedures implemented to mitigate risks, whereas the actions described are management's identification and evaluation of risks (risk assessment), not the design or implementation of control activities.

Answer B. Management's failure to establish a process to identify and analyze risks from the new online sales platform is a direct absence of risk assessment. The risk-assessment component is specifically about identifying and analyzing risks that could affect achievement of objectives. The stem indicates other components (control activities and monitoring) are present, which helps isolate the gap.

Why not A: Control activities are the policies and procedures (for example, approvals, reconciliations) put in place to respond to assessed risks. While new control activities may be needed for an online platform, the issue described is the lack of a process to identify and analyze the risks first, which is risk assessment.

Why not C: Information and communication concern the identification, capture, and exchange of information needed for internal control. The fact pattern describes a missing risk-identification process rather than a breakdown in information flows or communication about controls.

Why not D: Monitoring activities include ongoing evaluations and internal audit follow-up to ensure controls operate effectively. The stem explicitly notes internal audit follow-up on prior findings, suggesting monitoring exists; the missing front-end activity is risk assessment.

Answer D. Under COSO, management should update its risk assessment when significant changes in operations, business model, or external relationships occur. Launching a new online sales channel and outsourcing fulfillment alters transaction flows, introduces new third-party and fraud exposures, and changes control points, so management must reassess risks and adapt controls rather than simply continue existing procedures.

Why not A: Annual acknowledgments support the control environment and compliance culture, which is important under COSO, but this is a routine activity. It does not represent a new operational or external change that would alter the entity's risk profile and require updating the risk assessment.

Why not B: This is tempting because ongoing supervisory review is an important control activity, but it is a routine monitoring procedure. Routine control activities support current controls and do not, by themselves, constitute a change that would require a fresh risk assessment.

Why not C: Candidates may focus on internal audit as evidence about control effectiveness, but a normal, clean audit result is monitoring/assurance rather than a change in circumstances. It confirms the current assessment rather than triggering a reassessment of risks.

Answer C. The new bundled product changes the revenue process in a way that directly implicates COSO's risk assessment and information-and-communication components. If the entity lacks a process to identify and communicate significant changes to accounting, the auditor cannot simply assume prior-year revenue controls remain sufficient for the revised assertions. The appropriate response is to reassess control design and implementation for the changed process and avoid planned reliance unless compensating controls are identified and supported by audit evidence.

Why not A: This is tempting because candidates often focus on whether the existing control activity still operates. But unchanged billing or shipping controls do not solve the COSO problem created by the entity's failure to identify and communicate a significant business-model change affecting revenue recognition. The auditor must reassess the control framework around the new stream before relying on prior-year controls to reduce substantive work.

Why not B: This is tempting because monthly review sounds like a higher-level control. However, the facts point more directly to weaknesses in identifying changes and communicating them to accounting, not merely monitoring results after the fact. A broad budget comparison that ignores contract terms, SSPs, and modifications is not enough to leave the planned reliance unchanged.

Why not D: This distractor appeals to candidates who remember that COSO effectiveness requires relevant principles to be present and functioning. But the auditor's planning response is not to jump automatically to a material-weakness conclusion from these facts alone, especially before identifying whether compensating controls exist and evaluating severity. The immediate audit response is to reassess control design and planned reliance, not to make an unsupported final deficiency classification.

Answer D. Management's process of identifying new risks from the online channel, estimating their likelihood and significance, and deciding whether controls need to be changed is the activity of identifying and analyzing risks and determining control responses. That activity is the heart of COSO's risk assessment component. The fact that it is done quarterly does not make it monitoring.

Why not A: This is tempting because controls are mentioned, but control activities are the specific policies and procedures implemented to address risks, not the process of identifying and analyzing the risks themselves.

Why not B: Information and communication involves obtaining and sharing the information needed to carry out internal control responsibilities. While information is gathered here, the primary task described is analyzing risks and deciding responses, which is risk assessment.

Why not C: Periodic work might sound like monitoring, but monitoring focuses on assessing whether controls are present and functioning effectively. The fact pattern centers on identifying and analyzing new business risks and deciding on control responses, which is risk assessment.