Which of the following would be the most appropriate first step for the board to take when developing an effective system of governance?

• A. Delegate authority to members of senior management.
• B. Establish a governance committee.
• C. Determine the organization's overall risk appetite.
• D. Identify key stakeholders and their expectations.

Which of the following statements about COBIT is not true?

• A. COBIT provides management with the capability to conduct self-assessments against industry best practices.
• B. Management needs to determine the cost-benefit ratio of adopting COBIT control objectives.
• C. COBIT control objectives are specific to various IT platforms and help determine minimum controls.
• D. COBIT helps management understand and manage the risks associated with information technology (IT) processes.

Which of the following is not a common feature of cumulative preferred stock?

• A. Priority over common stock with regard to dividend payment.
• B. Priority over common stock with regard to earnings.
• C. Priority over common stock with regard to assets.
• D. Priority over common stock with regard to dilution of shares.

Which of the following are typical responsibilities for operational management within a risk management program?
1. Implementing corrective actions to address process deficiencies.
2. Identifying shifts in the organization's risk management environment.
3. Providing guidance and training on risk management processes.
4. Assessing the impact of mitigation strategies and activities.

• A. 1 and 2 only
• B. 2 and 3 only
• C. 1 and 4 only
• D. 3 and 4 only

Which of the following is most likely to function as a directive control?

• A. Alert employees.
• B. Security dogs.
• C. Cycle counts.
• D. Insurance claims.