What is the purpose of control activities in response to identified risks?

• A. To maximize profits by reducing compliance costs.
• B. To implement preventive and detective measures addressing risks.
• C. To delegate risk management to external consultants.
• D. To eliminate risk entirely with zero tolerance.

Answer: (B)

Control activities address identified risks by putting in place preventive and detective measures within business processes. The idea is to reduce risk to an acceptable level and provide reasonable assurance that the organization will achieve its objectives, including reliable financial reporting and compliance with laws and policies. Preventive controls, such as proper segregation of duties and required approvals, aim to stop problems before they occur. Detective controls, like reconciliations and ongoing reviews, help catch issues after they arise so they can be corrected promptly. This combination ensures that risk responses are actually implemented in day-to-day operations and monitored over time.

It’s not about maximizing profits by trimming compliance costs, nor about outsourcing risk management to external consultants as a substitute for internal control. It also doesn’t promise zero risk—residual risk will always remain to some extent, but controls aim to reduce it to an acceptable level.