Regulatory Framework & Requirements Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Framework & Requirements flashcards as text
An organization's compliance officer is evaluating third-party vendor risk. Which regulatory framework most directly requires documented third-party due diligence for financial institutions?
Answer: OCC Third-Party Risk Management Guidance (2023)
The OCC's 2023 interagency Third-Party Risk Management Guidance provides comprehensive expectations for banks to conduct due diligence and oversight of all third-party relationships.
Which of the following scenarios would most likely trigger a mandatory breach notification under the HIPAA Breach Notification Rule?
Answer: An employee accidentally emails unencrypted PHI of 600 patients to the wrong provider
Emailing unencrypted PHI to an unauthorized recipient constitutes a breach of unsecured PHI affecting 600 individuals, triggering notification to affected individuals, HHS, and media (if 500+ in a state).
The concept of 'reasonable foreseeability' in compliance risk management is most closely associated with which legal doctrine?
Answer: Negligence
Negligence law uses reasonable foreseeability to determine whether a defendant should have anticipated and guarded against a particular harm, a concept central to compliance risk assessment.
Which enforcement mechanism allows the CFPB to take action against a company that is NOT a bank or credit union for engaging in unfair, deceptive, or abusive acts or practices (UDAAP)?
Answer: Supervisory examination and civil enforcement authority under Dodd-Frank Title X
Dodd-Frank Title X granted the CFPB broad supervisory and enforcement authority over non-bank financial companies, including the ability to bring civil actions for UDAAP violations.
In EU competition law, which article of the Treaty on the Functioning of the European Union (TFEU) prohibits agreements between undertakings that restrict competition?
Answer: Article 101 TFEU
Article 101 TFEU prohibits agreements, decisions, and concerted practices between undertakings that have as their object or effect the prevention, restriction, or distortion of competition within the EU.
Under the California Consumer Privacy Act (CCPA), businesses that sell personal information must provide consumers with which specific right?
Answer: The right to opt out of the sale of their personal information
CCPA grants California consumers the right to opt out of the sale of their personal information, requiring businesses to display a 'Do Not Sell My Personal Information' link.
A multinational corporation discovers that a subsidiary in a high-risk jurisdiction made payments to a government official to 'expedite' a routine customs clearance. Under the FCPA, how are 'facilitating payments' treated?
Answer: They are a narrow exception only for payments to secure routine governmental actions
The FCPA contains a limited exception for facilitating payments made to expedite routine, non-discretionary governmental actions such as customs clearances, though this exception is narrowly construed and many companies prohibit such payments entirely.