Compliance Monitoring & Auditing Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Compliance Monitoring & Auditing flashcards as text
Which of the following BEST characterizes a 'compliance risk appetite statement'?
Answer: A formal declaration of the level and types of compliance risk the organization is willing to accept in pursuit of its objectives
A risk appetite statement defines the boundaries of acceptable risk, guiding compliance monitoring priorities and resource allocation decisions.
An organization discovers during monitoring that a corrective action plan from a prior audit was implemented but the underlying compliance gap still exists. This situation MOST likely indicates:
Answer: Root cause was not properly identified or addressed during remediation
Recurring gaps after remediation typically indicate that the corrective action addressed symptoms rather than the true root cause of the control failure.
In the context of compliance auditing, what does 'independence' require of the auditor?
Answer: The auditor must be free from conditions that could impair objectivity, including auditing activities they directly manage
Auditor independence means freedom from conflicts of interest and not auditing activities for which one has operational responsibility, preserving objectivity.
Which regulatory framework requires financial institutions to maintain ongoing compliance monitoring programs that include periodic testing of internal controls?
Answer: SOX Section 404
SOX Section 404 requires management and external auditors to assess and report on the effectiveness of internal controls over financial reporting annually.
A compliance officer wants to prioritize monitoring activities using a risk-based approach. Which combination of factors BEST determines monitoring priority?
Answer: Likelihood of non-compliance and potential impact of a violation
Risk-based monitoring prioritizes activities where the probability of non-compliance and the consequences of a violation are both highest.
What is the MAIN distinction between a compliance 'review' and a compliance 'audit'?
Answer: A review typically provides limited assurance based on inquiry and analytical procedures; an audit provides a higher level of assurance through detailed testing
A compliance review provides limited assurance using inquiry and analysis, while a full audit gathers sufficient evidence through testing to provide a higher level of assurance.
When a compliance monitoring program identifies a potential violation of the Foreign Corrupt Practices Act (FCPA), what is the FIRST step the compliance team should take?
Answer: Preserve relevant evidence and initiate a privileged internal investigation
Preserving evidence and launching a privileged internal investigation are the appropriate first steps to gather facts before any decisions about disclosure or personnel actions.