CCT Regulatory Frameworks & Compliance Standards 4 — Questions and Answers
Question 1: Which element is NOT typically considered one of the seven components of an effective compliance program under the U.S. Federal Sentencing Guidelines?
- Standards and procedures
- High-level oversight by governing authority
- Mandatory arbitration clause for employees (Correct answer)
- Consistent enforcement through disciplinary mechanisms
Correct answer: Mandatory arbitration clause for employees
The seven elements of an effective compliance program under the Federal Sentencing Guidelines do not include mandatory arbitration; they focus on prevention, detection, and response.
Question 2: The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule primarily requires financial institutions to do which of the following?
- Conduct annual penetration testing of all systems
- Develop and maintain a written information security program (Correct answer)
- Encrypt all customer data at rest and in transit
- Obtain explicit consent before sharing any customer data
Correct answer: Develop and maintain a written information security program
GLBA's Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive written information security program to protect customer information.
Question 3: Under EPA's RCRA regulations, a Conditionally Exempt Small Quantity Generator (CESQG) generates how much hazardous waste per month?
- Less than 100 kg (Correct answer)
- Between 100 and 1,000 kg
- Between 1,000 and 10,000 kg
- More than 10,000 kg
Correct answer: Less than 100 kg
CESQGs (now called Very Small Quantity Generators) generate less than 100 kg of hazardous waste per month and have the least stringent requirements.
Question 4: A company discovers a data breach affecting 600 California residents. Under California's CCPA/CPRA, which action is required?
- No notification required for fewer than 1,000 residents
- Notify affected consumers without unreasonable delay (Correct answer)
- Only notify the California Attorney General
- Wait for a regulatory investigation before notifying consumers
Correct answer: Notify affected consumers without unreasonable delay
California's data breach notification law requires businesses to notify affected California residents without unreasonable delay when unencrypted personal information is breached.
Question 5: The SEC's Regulation FD (Fair Disclosure) prohibits public companies from doing which of the following?
- Filing late financial reports with the SEC
- Selectively disclosing material nonpublic information to select investors before the public (Correct answer)
- Hiring compliance officers who previously worked for the SEC
- Issuing earnings guidance more than once per quarter
Correct answer: Selectively disclosing material nonpublic information to select investors before the public
Reg FD requires that when a public company discloses material nonpublic information to certain individuals, it must make public disclosure simultaneously or promptly.
Question 6: Which COSO framework component addresses the policies and procedures that help ensure management directives related to risk mitigation are carried out?
- Control Environment
- Risk Assessment
- Control Activities (Correct answer)
- Monitoring Activities
Correct answer: Control Activities
Control Activities in the COSO framework are the policies and procedures that help ensure management's risk responses are effectively carried out.
Question 7: Under the Fair Labor Standards Act (FLSA), which type of employee is exempt from overtime pay requirements?
- Any employee earning more than $35,000 annually
- Employees meeting both salary level and duties tests for executive, administrative, or professional exemptions (Correct answer)
- Part-time employees working fewer than 30 hours per week
- Employees who voluntarily waive overtime in writing
Correct answer: Employees meeting both salary level and duties tests for executive, administrative, or professional exemptions
FLSA exemptions require employees to meet both a minimum salary level threshold and specific duties tests related to executive, administrative, professional, or other recognized categories.
CCT Regulatory Frameworks & Compliance Standards 4
Which element is NOT typically considered one of the seven components of an effective compliance program under the U.S.
Federal Sentencing Guidelines?