Regulatory Compliance & Risk Management Flashcards
7 cards from real CBO practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Risk Management flashcards as text
Which regulatory framework specifically governs the privacy of protected health information (PHI) in the United States?
Answer: HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting the privacy and security of protected health information.
A business identifies that a critical supplier has no business continuity plan. This represents which type of risk?
Answer: Third-party or supply chain risk
Supply chain or third-party risk arises when an external vendor's failure or disruption can negatively impact the company's own operations.
Which document outlines the procedures employees must follow to report suspected compliance violations?
Answer: Code of Conduct or Ethics Hotline Policy
A code of conduct or ethics hotline policy details how employees should report suspected violations, including anonymous reporting options.
Under the Equal Employment Opportunity (EEO) laws, which of the following is NOT a protected class at the federal level?
Answer: Political affiliation
Federal EEO laws protect race, color, religion, sex, national origin, age, disability, and genetic information, but political affiliation is not a federally protected class.
What is the purpose of a compliance risk assessment?
Answer: To identify, evaluate, and prioritize regulatory and legal risks facing the business
A compliance risk assessment systematically identifies and evaluates the legal and regulatory risks an organization faces so resources can be allocated appropriately.
A company's board of directors sets the organization's 'risk appetite.' What does this term mean?
Answer: The amount and type of risk the organization is willing to accept in pursuit of its objectives
Risk appetite is the level and type of risk an organization is prepared to accept, tolerate, or be exposed to in pursuit of its strategic goals.
Which of the following best describes a 'key risk indicator' (KRI)?
Answer: A metric that provides an early warning signal that risk is increasing
KRIs are forward-looking metrics that signal when risk levels are rising, enabling proactive management before a risk event occurs.