Compliance Monitoring and Reporting Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Compliance Monitoring and Reporting flashcards as text
A compliance officer is preparing an annual report for the board's audit committee. Which element is MOST important to include beyond a list of findings?
Answer: An assessment of the overall effectiveness of the compliance program with trend data and forward-looking risk areas
Board-level reports must synthesize findings into an effectiveness assessment with trend context so directors can fulfill their oversight obligations and allocate resources appropriately.
Under COSO's Internal Control – Integrated Framework, which component specifically addresses ongoing evaluations and reporting of deficiencies?
Answer: Monitoring Activities
The Monitoring Activities component of COSO requires organizations to conduct ongoing and separate evaluations of internal controls and communicate deficiencies to responsible parties.
What is 'continuous control monitoring' (CCM) and how does it differ from traditional periodic testing?
Answer: CCM automates the analysis of 100% of transactions in near real-time, while periodic testing reviews samples at fixed intervals
CCM uses automated tools to analyze every transaction continuously rather than sampling a subset at scheduled intervals, enabling earlier detection of exceptions.
When a compliance monitoring team identifies a potential violation that could constitute a material breach of a consent order, who should be notified FIRST within the organization?
Answer: Senior legal counsel and executive leadership before any external disclosure
Potential consent order breaches carry significant legal and regulatory consequences, requiring immediate notification to legal counsel and senior leadership to determine disclosure obligations and response strategy.
A compliance monitoring report uses the term 'open items aging report.' What does this track?
Answer: The length of time that identified compliance findings have been open without resolution
An aging report tracks how long each identified finding has remained unresolved, helping management identify stalled remediations and hold accountable parties responsible for timely closure.
Which sampling methodology is MOST appropriate when a compliance officer suspects that high-dollar transactions carry a disproportionately higher risk of violations?
Answer: Risk-based or stratified sampling targeting high-value transactions
Risk-based or stratified sampling concentrates testing resources on transaction strata—such as high-dollar amounts—where the probability or impact of violations is greatest.
What does 'management response' mean in the context of a compliance monitoring report?
Answer: A formal written commitment by responsible management to address each finding, including corrective actions and target dates
A management response is a formal written acknowledgment of each finding with specific corrective actions and deadlines, creating accountability for remediation.