CCT Compliance Monitoring & Reporting 5 — Questions and Answers
Question 1: When a compliance monitoring test yields an exception, which is the FIRST step in proper exception management?
- Immediately report the exception to the regulator
- Document the exception and determine its root cause (Correct answer)
- Terminate the employee responsible
- Suspend the related business line activities indefinitely
Correct answer: Document the exception and determine its root cause
Proper exception management begins with documenting the finding and performing root cause analysis to understand why the control failed before determining next steps.
Question 2: A compliance officer notices that the same business unit generates 80% of all monitoring exceptions. According to risk-based principles, what is the appropriate response?
- Reduce monitoring frequency for the unit since you already know the issues
- Increase monitoring intensity and frequency for that higher-risk unit (Correct answer)
- Transfer all unit employees to other departments
- Report the unit to regulators without further internal review
Correct answer: Increase monitoring intensity and frequency for that higher-risk unit
Risk-based monitoring directs more resources toward higher-risk areas; a unit generating disproportionate exceptions warrants increased monitoring attention.
Question 3: Which type of audit opinion indicates that auditors found material issues that management has not adequately addressed?
- Unqualified opinion
- Qualified opinion
- Adverse opinion (Correct answer)
- Disclaimer of opinion
Correct answer: Adverse opinion
An adverse opinion is issued when auditors conclude that the financial statements or controls do not fairly present the situation and material misstatements or deficiencies exist.
Question 4: A regulated institution's compliance monitoring program must be 'commensurate with risk.' What does this phrase mean in practice?
- All business units must receive identical monitoring regardless of their activities
- Higher-risk activities should receive more frequent and intensive monitoring than lower-risk activities (Correct answer)
- Monitoring costs must be proportional to company revenue
- Each employee must be monitored the same number of hours per year
Correct answer: Higher-risk activities should receive more frequent and intensive monitoring than lower-risk activities
'Commensurate with risk' means that monitoring resources and intensity should be proportional to the level of risk presented by each activity or business unit.
Question 5: What is the primary purpose of a 'corrective action plan' (CAP) following a compliance monitoring finding?
- To document who was blamed for the control failure
- To specify remediation steps, responsible parties, and deadlines to resolve identified deficiencies (Correct answer)
- To notify customers of the compliance issue
- To calculate the financial penalty owed to the regulator
Correct answer: To specify remediation steps, responsible parties, and deadlines to resolve identified deficiencies
A CAP formalizes the remediation response by assigning ownership, defining specific remediation steps, and setting target completion dates for each finding.
Question 6: An organization subject to HIPAA discovers a breach affecting 600 individuals. In addition to notifying affected individuals, it must also notify which entity within 60 days of the breach?
- The FBI
- The Department of Health and Human Services (HHS) (Correct answer)
- The FTC
- The Department of Justice
Correct answer: The Department of Health and Human Services (HHS)
HIPAA's Breach Notification Rule requires covered entities to notify HHS within 60 days of discovering a breach affecting 500 or more individuals; smaller breaches are reported annually.
Question 7: Which of the following BEST describes the role of a compliance monitoring 'workpaper'?
- A marketing document describing the company's compliance commitments to customers
- Documentation that records the scope, methodology, evidence, and conclusions of a monitoring test (Correct answer)
- A regulatory form submitted to government agencies
- An employee handbook section on compliance expectations
Correct answer: Documentation that records the scope, methodology, evidence, and conclusions of a monitoring test
Workpapers are the documented evidence of monitoring activities, capturing what was tested, how it was tested, what evidence was reviewed, and what conclusions were reached.
CCT Compliance Monitoring & Reporting 5
When a compliance monitoring test yields an exception, which is the FIRST step in proper exception management?