Compliance Monitoring and Reporting Flashcards

Which of the following BEST describes the concept of 'control testing' within a compliance monitoring program?

Answer: Evaluating whether specific controls operate effectively in practice to mitigate identified risks

Control testing verifies that controls actually function as intended—not merely that they are documented—by examining evidence of their operation over a defined period.

In the three lines of defense model, which line is primarily responsible for day-to-day compliance monitoring of business operations?

Answer: Business unit management and staff (first line)

The first line of defense—business unit managers and employees—owns day-to-day risk management and compliance monitoring within their own processes.

A compliance report shows that 8% of loan files reviewed are missing required disclosures, compared to a 2% threshold. How should the compliance officer categorize this result?

Answer: A significant exception requiring escalation and corrective action

Exceeding a defined threshold by 400% constitutes a significant exception that must be escalated and remediated regardless of the absolute file count.

Which reporting structure is MOST effective for preserving compliance function independence?

Answer: The Chief Compliance Officer reports directly to the CEO or board of directors

Reporting directly to the CEO or board provides independence from business unit pressures and ensures compliance findings receive unfiltered attention at the highest level.

What is a 'heat map' used for in compliance monitoring and reporting?

Answer: Visually representing the likelihood and impact of identified compliance risks to prioritize monitoring efforts

A heat map plots risks on a likelihood-vs-impact matrix using color coding, enabling compliance teams to visually prioritize where monitoring resources should be concentrated.

When a compliance monitoring program identifies a systemic control failure affecting multiple business lines, what is the MOST appropriate corrective action approach?

Answer: Design an enterprise-wide remediation plan that addresses the root cause across all affected areas simultaneously

Systemic failures require enterprise-wide remediation targeting the root cause; piecemeal fixes leave the underlying control weakness intact across the organization.

Which of the following is an example of a LEADING compliance indicator, as opposed to a lagging indicator?

Answer: Percentage of employees who completed annual compliance training this quarter

Training completion rates are leading indicators because they measure inputs that influence future compliance behavior, whereas fines, enforcement actions, and complaints reflect past failures.