ITPEC IP October 2025 Question 65

Internal control — its five components are control environment, risk assessment, control activities, information and communication, and monitoring activities.

Internal control is the process built into a company's operations to give reasonable assurance that its objectives are met. The COSO framework, on which most internal-control rules are based, names four objectives (effective and efficient operations, reliable financial reporting, compliance with laws and regulations relating to business activities, and safeguarding of assets) and the five components listed in the question. The control environment is the foundation; the other four identify risks, respond to them, pass on information and check that the controls keep working.

Answer (c)

Why not others:

• •(a) CMMI — a maturity model that rates and improves development processes in five levels
• •(b) ITIL — a collection of best practices for IT service management
• •(d) Risk management — identifies, analyses, evaluates and treats risks; risk assessment is only one of the five components of internal control, not the framework made of all five

Key rule: Five components (environment, risk assessment, control activities, information and communication, monitoring) plus compliance as an objective identify internal control.

System Audit · AI-written, may contain errors