CCM Regulatory Frameworks and Legal Compliance 2 — Questions and Answers
Question 1: Under the Foreign Corrupt Practices Act (FCPA), which of the following payments is explicitly permitted as a 'facilitating payment' exception?
- Payments to foreign officials to influence a government contract award
- Small payments to low-level officials to expedite routine non-discretionary government actions (Correct answer)
- Gifts to foreign government ministers to retain existing business
- Payments to customs officials to reduce import tariffs
Correct answer: Small payments to low-level officials to expedite routine non-discretionary government actions
The FCPA's facilitating payment exception applies only to small payments made to expedite or secure routine, non-discretionary government actions such as processing permits or utilities.
Question 2: A compliance officer discovers that a subsidiary in another country follows local laws that conflict with the parent company's U.S. regulatory obligations. The best approach is to:
- Allow the subsidiary to follow only local law since it operates in that jurisdiction
- Require the subsidiary to follow U.S. law exclusively, regardless of local requirements
- Apply the stricter of the two standards and document the conflict for legal review (Correct answer)
- Seek a waiver from U.S. regulators before addressing the local conflict
Correct answer: Apply the stricter of the two standards and document the conflict for legal review
When conflicts exist between home and host country laws, compliance programs generally apply the stricter standard and document conflicts for legal counsel to resolve.
Question 3: The Graham-Leach-Bliley Act (GLBA) primarily imposes compliance obligations on which type of organization?
- Healthcare providers and their business associates
- Financial institutions that offer financial products or services to consumers (Correct answer)
- Public companies with securities listed on U.S. exchanges
- Federal contractors handling sensitive government data
Correct answer: Financial institutions that offer financial products or services to consumers
GLBA applies to financial institutions — including banks, insurance companies, and investment firms — requiring them to protect consumers' nonpublic personal financial information.
Question 4: Which legal doctrine holds that a corporation can be held criminally liable for the acts of its employees if those acts were performed within the scope of their employment and at least in part to benefit the corporation?
- Respondeat superior (Correct answer)
- Piercing the corporate veil
- Vicarious liability per se
- Strict liability doctrine
Correct answer: Respondeat superior
Respondeat superior is the legal doctrine under which an employer is held liable for wrongful acts committed by employees acting within the scope of their employment.
Question 5: The concept of 'regulatory capture' in compliance refers to:
- A company successfully influencing regulation in its favor through lobbying
- A situation where a regulatory agency advances the interests of the industry it regulates rather than the public (Correct answer)
- The process by which compliance officers internalize regulatory requirements
- An enforcement action that targets a company's entire regulatory program
Correct answer: A situation where a regulatory agency advances the interests of the industry it regulates rather than the public
Regulatory capture occurs when an agency meant to act in the public interest instead promotes the commercial or political interests of the industry it oversees.
Question 6: Under the Dodd-Frank Act's whistleblower provisions, the SEC can award monetary compensation to whistleblowers who provide original information resulting in sanctions exceeding:
- $500,000
- $1 million (Correct answer)
- $1.5 million
- $2 million
Correct answer: $1 million
Dodd-Frank Section 21F authorizes the SEC to pay awards of 10–30% of sanctions collected when the total sanctions exceed $1 million.
Question 7: A company operating in the EU must appoint a Data Protection Officer (DPO) under GDPR in which of the following circumstances?
- Whenever the company processes any personal data of EU residents
- Only when the company has more than 250 employees
- When core activities involve large-scale systematic monitoring of individuals or processing of special category data (Correct answer)
- Only if the company has suffered a prior data breach
Correct answer: When core activities involve large-scale systematic monitoring of individuals or processing of special category data
GDPR Article 37 requires a DPO when core activities involve large-scale systematic monitoring, large-scale processing of special category data, or when the controller is a public authority.
CCM Regulatory Frameworks and Legal Compliance 2
Under the Foreign Corrupt Practices Act (FCPA), which of the following payments is explicitly permitted as a 'facilitating payment' exception?