What Risk Remains. What Controls Failed. What’s Next.
This course is part of The Complete Guide to Risk and Internal Controls, a comprehensive training series designed to build practical knowledge and skills in identifying, assessing, managing, and responding to risks through effective internal controls.
Residual Risk & Control Improvement focuses on what happens after internal controls have been designed and evaluated. Learners begin by determining the risk that remains after considering control effectiveness and evaluating appropriate risk response strategies. The course then explores how to identify and assess control deficiencies, understand why controls fail, and use root cause analysis to move from symptoms to meaningful corrective action.
The course also introduces fraud risk as a distinct consideration in internal control design and evaluation. Learners examine how intentional misconduct, override, collusion, and control weaknesses can create fraud opportunities, and how preventive, detective, and monitoring controls can be layered to reduce those opportunities. The course concludes by connecting residual risk, control deficiencies, root causes, corrective action, and fraud risk into a broader view of continuous control improvement.
Topics Covered
• Determining residual risk
• Using a residual risk matrix
• Applying judgment to residual risk conclusions
• Risk response strategies
• Acceptance, mitigation, transfer, and avoidance
• Identifying control deficiencies
• Isolated exceptions vs. broader control deficiencies
• Design deficiencies vs. operating deficiencies
• Evaluating the significance of control weaknesses
• Symptoms, contributing causes, and root causes
• 5 Whys analysis
• Fishbone analysis
• Bowtie analysis
• Connecting root causes to corrective actions
• Corrective action and follow-up
• Fraud risk vs. error risk
• The Fraud Triangle
• Fraud opportunity and internal control weaknesses
• Asset misappropriation, corruption, and financial statement fraud
• Fraud risks in common business processes
• Preventive and detective anti-fraud controls
• Management override and collusion
• Layering anti-fraud controls
• Monitoring and identifying unusual patterns
Audit Smarter, not Harder - with Elizabeth and Audie the Internal Otteror!
Elizabeth McDowell, CPA, CIA has over 20 years of audit experience and is the founder of Audit Forward, an innovative internal audit consulting and training firm. Elizabeth is passionate about advancing and advocating for the internal audit profession and was recognized as one of the 2023 Internal Audit Beacons by Richard Chambers. Elizabeth makes auditing and training fun (no, really!) with the help of her mascot, Audie the Internal Otteror. Elizabeth’s most recent industry experience was at Achieve, where she was Sr. Director, Audit Strategy; prior to that, she held internal audit leadership roles at Elevations Credit Union, Fidelity Investments, and Xcel Energy after first starting her career at Ernst & Young.
Provincial regulators of CPAs in Canada do not require that independent providers of CPD be approved to offer courses. Instead, individual CPAs are responsible for assessing whether a CPD activity meets their requirements, and may take activities from any source provided those requirements are met.
Every course offered on LearnFormula is delivered by a qualified subject matter expert or learning organization, and advances learning objectives that are relevant to the responsibilities or professional competencies of Canadian CPAs. All activities on LearnFormula are quantifiable in terms of hours, and are also verifiable, in that users receive documented evidence of their attendance via a certificate of completion after finishing a course (and this certificate is stored by LearnFormula indefinitely). Nearly 100,000 Canadian CPAs successfully satisfy their CPD requirements via LearnFormula on an annual basis.
