CCT Regulatory Frameworks & Compliance Standards 5 — Questions and Answers
Question 1: Which scenario best illustrates a conflict of interest that a compliance program should address?
- An employee takes a vacation during a product launch
- A procurement officer approves a contract with a vendor owned by a family member (Correct answer)
- A manager promotes an employee who exceeds performance metrics
- An accountant uses company software for personal tax calculations
Correct answer: A procurement officer approves a contract with a vendor owned by a family member
A conflict of interest exists when a personal relationship or financial interest could improperly influence a business decision, such as awarding a contract to a relative's company.
Question 2: The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into which five core functions?
- Plan, Protect, Detect, Respond, Recover
- Identify, Protect, Detect, Respond, Recover (Correct answer)
- Assess, Protect, Monitor, Respond, Report
- Identify, Assess, Control, Monitor, Report
Correct answer: Identify, Protect, Detect, Respond, Recover
The NIST CSF's five core functions are Identify, Protect, Detect, Respond, and Recover, providing a strategic view of cybersecurity risk management.
Question 3: Under the False Claims Act, a qui tam relator (whistleblower) who files a successful lawsuit against a government contractor may receive what percentage of the government's recovery?
- 1-5%
- 15-30% (Correct answer)
- 35-50%
- 51-75%
Correct answer: 15-30%
The False Claims Act allows qui tam relators to receive between 15% and 30% of the government's recovery depending on the circumstances of the case.
Question 4: A financial institution's Customer Identification Program (CIP) under the USA PATRIOT Act must collect which minimum set of information from individual customers?
- Name, address, and credit score
- Name, date of birth, address, and identification number (Correct answer)
- Name, employer, income, and Social Security number
- Name, phone number, email, and government ID copy
Correct answer: Name, date of birth, address, and identification number
CIP regulations require collection of name, date of birth, address, and an identification number (such as SSN for U.S. persons) for individual customers.
Question 5: Which principle distinguishes a rules-based compliance approach from a principles-based compliance approach?
- Rules-based compliance focuses on the spirit of the law while principles-based focuses on specific mandates
- Rules-based compliance requires adherence to specific detailed requirements while principles-based relies on general standards and judgment (Correct answer)
- Principles-based compliance is used only in criminal law while rules-based applies to civil regulations
- Rules-based compliance is voluntary while principles-based compliance is mandatory
Correct answer: Rules-based compliance requires adherence to specific detailed requirements while principles-based relies on general standards and judgment
Rules-based compliance specifies exact requirements to follow, while principles-based compliance sets broad standards and relies on organizations to exercise judgment in meeting them.
Question 6: Under OSHA's General Duty Clause (Section 5(a)(1)), employers are required to do which of the following?
- Provide workers' compensation insurance for all injuries
- Furnish a workplace free from recognized hazards likely to cause death or serious physical harm (Correct answer)
- Conduct mandatory annual safety audits by certified third parties
- Maintain OSHA 300 logs for all recordable incidents regardless of company size
Correct answer: Furnish a workplace free from recognized hazards likely to cause death or serious physical harm
The General Duty Clause requires employers to provide a workplace free from recognized hazards causing or likely to cause death or serious physical harm to employees.
Question 7: A company's compliance program uses 'tone at the top' as a foundational element. What does this concept primarily refer to?
- Posting compliance notices prominently in the workplace
- Senior leadership's commitment to ethical conduct setting the cultural standard for the organization (Correct answer)
- Requiring top-level managers to pass annual compliance certification exams
- The practice of reporting compliance violations directly to the board without management filter
Correct answer: Senior leadership's commitment to ethical conduct setting the cultural standard for the organization
Tone at the top refers to the ethical atmosphere that senior leadership creates through their words, actions, and commitment to compliance, which cascades throughout the organization.
CCT Regulatory Frameworks & Compliance Standards 5
Which scenario best illustrates a conflict of interest that a compliance program should address?