A risk/control matrix has five columns, the last of which is labeled "comments." Which of the following statements is most true?
A)Because it is part of a risk/control matrix, the "comments" column is a control activity.
B)Because it is part of a risk/control matrix, the "comments" column is a tool for risk assessment.
C)If the comments are written by a department manager, they are part of establishing a strong control environment.
D)Although the "comments" column may not align directly with one of the five elements of the COSO framework, including it in the risk/control matrix is a good idea.

Question

Quizplus · Accepted Answer

The "comments" column in a risk/control matrix, while not directly aligning with the five elements of the COSO framework (control environment, risk assessment, control activities, information and communication, and monitoring activities), serves as a valuable tool for providing additional context, insights, or clarifications. This can enhance the understanding and effectiveness of the risk management process, making its inclusion a good practice.

A Risk/control Matrix Has Five Columns, the Last of Which