Certified Internal Auditor Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Under the IIA's International Standards, an internal audit function must be independent from the activities it audits. This independence is primarily achieved through:
- Rotating audit staff annually
- Organizational reporting relationships (Correct answer)
- Using external consultants
- Limiting audit scope to financial matters
Correct answer: Organizational reporting relationships
Organizational independence is achieved when the chief audit executive reports functionally to the board (or audit committee), free from management interference.
Question 2: A company operating in multiple states must comply with varying data privacy laws. Which US state law is most often used as a baseline due to its broad scope?
- New York SHIELD Act
- Virginia Consumer Data Protection Act
- California Consumer Privacy Act (CCPA) (Correct answer)
- Illinois BIPA
Correct answer: California Consumer Privacy Act (CCPA)
The CCPA (and its amendment CPRA) is the most comprehensive US state privacy law and is widely used as a baseline for multi-state compliance programs.
Question 3: An auditor reviews a company's export control compliance program. Which US agency administers the Export Administration Regulations (EAR)?
- State Department (DDTC)
- Treasury Department (OFAC)
- Commerce Department (BIS) (Correct answer)
- Homeland Security (CBP)
Correct answer: Commerce Department (BIS)
The Bureau of Industry and Security (BIS) within the Commerce Department administers and enforces the Export Administration Regulations.
Question 4: Which element is NOT typically included in a regulatory change management process?
- Monitoring regulatory publications and updates
- Assessing impact of new requirements on current processes
- Updating policies and controls to address new requirements
- Filing comments on proposed regulations (Correct answer)
Correct answer: Filing comments on proposed regulations
Filing comments on proposed regulations is a lobbying/advocacy activity, not a standard element of an internal regulatory change management process.
Question 5: Under SEC Regulation FD (Fair Disclosure), companies are prohibited from:
- Issuing earnings guidance without board approval
- Selectively disclosing material nonpublic information to certain investors (Correct answer)
- Filing financial statements late
- Trading company stock during blackout periods
Correct answer: Selectively disclosing material nonpublic information to certain investors
Reg FD prohibits selective disclosure of material nonpublic information to certain investors or analysts without simultaneous public disclosure.
Question 6: A compliance officer finds that management is overriding established controls to meet financial targets. The MOST appropriate internal audit response is to:
- Document the override and include it in the next annual report
- Immediately report the override to the external auditor
- Report the override to the audit committee as a significant deficiency (Correct answer)
- Advise management to document their rationale for the override
Correct answer: Report the override to the audit committee as a significant deficiency
Management override of controls is a significant finding that must be escalated to the audit committee, as it undermines the control environment.
Question 7: The Office of Inspector General (OIG) model compliance program guidance for healthcare organizations emphasizes which of the following as the cornerstone of an effective program?
- Financial penalties avoidance
- Commitment by senior and middle management (Correct answer)
- Annual external audits
- Real-time regulatory monitoring technology
Correct answer: Commitment by senior and middle management
OIG guidance consistently identifies management commitment and a strong ethical culture as the foundation upon which all other compliance elements depend.
Certified Internal Auditor Regulatory Frameworks & Compliance 4
Under the IIA's International Standards, an internal audit function must be independent from the activities it audits.
This independence is primarily achieved through: