Regulatory Framework & Requirements Flashcards

Which principle from the COSO Internal Control — Integrated Framework addresses the board's responsibility to oversee the development and performance of internal controls?

Answer: Principle 2: Oversight Responsibility

COSO Principle 2 (Oversight Responsibility) establishes that the board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

A U.S. company exports controlled dual-use technology without the required license. Which agency has primary enforcement jurisdiction?

Answer: Department of Commerce — Bureau of Industry and Security (BIS)

BIS administers the Export Administration Regulations (EAR), which govern commercial dual-use items, and has primary enforcement authority over unlicensed exports of such technology.

Under the False Claims Act, which element is NOT required to establish a violation?

Answer: The government suffered actual monetary damages

The FCA does not require proof of actual monetary damages; liability attaches when a false or fraudulent claim is knowingly submitted and is material to the government's payment decision.

Which FFIEC guidance document establishes expectations for financial institutions regarding cybersecurity risk management and incident response?

Answer: FFIEC Information Security Booklet

The FFIEC Information Security Booklet, part of the IT Examination Handbook, sets comprehensive expectations for financial institution cybersecurity programs, including risk assessment and incident response.

Which of the following best describes 'regulatory arbitrage' in a compliance context?

Answer: Structuring activities to exploit gaps or differences between regulatory regimes

Regulatory arbitrage refers to exploiting differences in regulatory frameworks — across jurisdictions or product categories — to circumvent requirements while achieving equivalent economic outcomes.

Under the Americans with Disabilities Act (ADA), Title III obligations apply primarily to which type of entity?

Answer: Places of public accommodation and commercial facilities

ADA Title III prohibits discrimination by places of public accommodation and commercial facilities, requiring accessible goods, services, facilities, and communications for individuals with disabilities.

A compliance officer at a healthcare company is designing a risk assessment. Which approach best reflects the OIG's recommended methodology for healthcare compliance risk prioritization?

Answer: Assessing likelihood and impact of each risk area and focusing resources on highest-risk activities

The OIG's compliance guidance recommends a risk-based approach that evaluates both the likelihood of a compliance failure and its potential impact, directing resources toward the highest-risk areas.