Which category best describes a risk arising from within an organization due to lack of checks and balances?

• A. Operational Risk
• B. External Risk
• C. Internal Risk
• D. Compliance Risk

Answer: (C)

Internal risk describes threats that originate inside the organization because of its own governance, people, processes, and controls. When there are insufficient checks and balances, oversight is weaker and errors, fraud, or abuse become more likely since there isn’t independent verification or proper separation of duties. This distinguishes it from external risk, which comes from outside actors or events, and from compliance risk, which focuses on failing to meet laws and regulations. Operational risk covers failures in processes, people, or systems more broadly, but the scenario specifically reflects a weakness in the internal control environment, making internal risk the most precise descriptor.