Compliance Monitoring & Reporting Flashcards
7 cards from real CCT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Compliance Monitoring & Reporting flashcards as text
When a compliance monitoring test yields an exception, which is the FIRST step in proper exception management?
Answer: Document the exception and determine its root cause
Proper exception management begins with documenting the finding and performing root cause analysis to understand why the control failed before determining next steps.
A compliance officer notices that the same business unit generates 80% of all monitoring exceptions. According to risk-based principles, what is the appropriate response?
Answer: Increase monitoring intensity and frequency for that higher-risk unit
Risk-based monitoring directs more resources toward higher-risk areas; a unit generating disproportionate exceptions warrants increased monitoring attention.
Which type of audit opinion indicates that auditors found material issues that management has not adequately addressed?
Answer: Adverse opinion
An adverse opinion is issued when auditors conclude that the financial statements or controls do not fairly present the situation and material misstatements or deficiencies exist.
A regulated institution's compliance monitoring program must be 'commensurate with risk.' What does this phrase mean in practice?
Answer: Higher-risk activities should receive more frequent and intensive monitoring than lower-risk activities
'Commensurate with risk' means that monitoring resources and intensity should be proportional to the level of risk presented by each activity or business unit.
What is the primary purpose of a 'corrective action plan' (CAP) following a compliance monitoring finding?
Answer: To specify remediation steps, responsible parties, and deadlines to resolve identified deficiencies
A CAP formalizes the remediation response by assigning ownership, defining specific remediation steps, and setting target completion dates for each finding.
An organization subject to HIPAA discovers a breach affecting 600 individuals. In addition to notifying affected individuals, it must also notify which entity within 60 days of the breach?
Answer: The Department of Health and Human Services (HHS)
HIPAA's Breach Notification Rule requires covered entities to notify HHS within 60 days of discovering a breach affecting 500 or more individuals; smaller breaches are reported annually.
Which of the following BEST describes the role of a compliance monitoring 'workpaper'?
Answer: Documentation that records the scope, methodology, evidence, and conclusions of a monitoring test
Workpapers are the documented evidence of monitoring activities, capturing what was tested, how it was tested, what evidence was reviewed, and what conclusions were reached.