CCM Compliance Monitoring & Auditing 2 — Questions and Answers
Question 1: During a compliance audit, an auditor discovers that an employee bypassed a control but the outcome was still compliant. What is the BEST course of action?
- Close the finding since the outcome was compliant
- Document a control deficiency and recommend remediation regardless of outcome (Correct answer)
- Escalate immediately to law enforcement
- Ignore the bypass if it happened only once
Correct answer: Document a control deficiency and recommend remediation regardless of outcome
Control bypasses represent process risks and must be documented even if the specific instance produced a compliant outcome.
Question 2: Which sampling method selects every nth item from a population and is commonly used in compliance testing?
- Judgmental sampling
- Systematic sampling (Correct answer)
- Cluster sampling
- Stratified random sampling
Correct answer: Systematic sampling
Systematic sampling selects every nth item and is widely used because it is simple and spreads coverage across the population.
Question 3: What does a 'heat map' in a compliance monitoring dashboard primarily communicate?
- Geographic distribution of employees
- Concentration and severity of compliance risks across the organization (Correct answer)
- IT network traffic patterns
- Financial performance by business unit
Correct answer: Concentration and severity of compliance risks across the organization
Compliance heat maps visually represent risk concentration and severity, enabling management to prioritize remediation efforts.
Question 4: A continuous monitoring program differs from periodic auditing primarily because it:
- Requires external auditors to lead all reviews
- Provides near-real-time detection of compliance gaps (Correct answer)
- Is only applicable to financial controls
- Eliminates the need for any manual testing
Correct answer: Provides near-real-time detection of compliance gaps
Continuous monitoring uses automated tools to detect issues in near real time, unlike periodic audits that review historical data at set intervals.
Question 5: When setting a compliance monitoring scope, which factor is MOST important to consider first?
- Budget available for the monitoring program
- Risk level and regulatory significance of the area (Correct answer)
- Preferences of department managers
- Number of employees in the department
Correct answer: Risk level and regulatory significance of the area
Risk-based scoping prioritizes areas with the highest regulatory significance and potential impact, ensuring resources are directed where they matter most.
Question 6: Which of the following BEST describes a 'substantive test' in a compliance audit?
- Testing to verify that controls exist and are designed properly
- Testing transactions and balances to detect material misstatements or violations (Correct answer)
- Reviewing policies to ensure they meet regulatory standards
- Interviewing staff about their awareness of compliance requirements
Correct answer: Testing transactions and balances to detect material misstatements or violations
Substantive tests examine actual transactions and records to verify that violations or misstatements have not occurred.
Question 7: What is the primary purpose of issuing a 'management response' in a compliance audit report?
- To challenge the auditor's findings and dismiss them
- To formally acknowledge findings and document planned corrective actions with owners and timelines (Correct answer)
- To request that regulators review the audit findings
- To delay implementation of remediation until the next audit cycle
Correct answer: To formally acknowledge findings and document planned corrective actions with owners and timelines
Management responses document accountability by assigning owners, timelines, and specific corrective actions for each audit finding.
CCM Compliance Monitoring & Auditing 2
During a compliance audit, an auditor discovers that an employee bypassed a control but the outcome was still compliant.
What is the BEST course of action?