Certified Internal Auditor Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which of the following best describes a 'gap analysis' in the context of regulatory compliance?
- A review of competitor compliance practices
- A comparison of current practices against regulatory requirements to identify deficiencies (Correct answer)
- An assessment of fines paid versus industry benchmarks
- A projection of future regulatory changes
Correct answer: A comparison of current practices against regulatory requirements to identify deficiencies
A gap analysis systematically compares an organization's existing controls and practices against required standards to identify where compliance is deficient.
Question 2: Under the Americans with Disabilities Act (ADA), which of the following is a covered employer's primary obligation?
- Hiring a minimum percentage of disabled workers
- Providing reasonable accommodations unless it causes undue hardship (Correct answer)
- Eliminating all physical barriers in the workplace immediately
- Paying disabled workers at least 125% of minimum wage
Correct answer: Providing reasonable accommodations unless it causes undue hardship
The ADA requires covered employers to provide reasonable accommodations to qualified individuals with disabilities unless doing so would impose undue hardship.
Question 3: An internal auditor assessing OSHA compliance would primarily review which of the following?
- Workers' compensation claims history only
- Workplace safety standards adherence, hazard communication, and recordkeeping (Correct answer)
- Employee performance appraisals related to safety
- Insurance policy coverage limits
Correct answer: Workplace safety standards adherence, hazard communication, and recordkeeping
OSHA audits focus on compliance with safety standards, proper hazard communication (GHS/SDS), and accurate recordkeeping of workplace injuries and illnesses.
Question 4: Which concept describes a company's self-imposed standards that go beyond minimum legal and regulatory requirements?
- Regulatory arbitrage
- Ethics-based compliance (Correct answer)
- Voluntary compliance
- Defensive compliance
Correct answer: Ethics-based compliance
Ethics-based compliance refers to an organization adopting standards driven by values and integrity rather than merely meeting the minimum requirements of law.
Question 5: A multinational company is subject to both the US FCPA and the UK Bribery Act. Which statement correctly identifies a key difference?
- The FCPA covers private-to-private bribery; the UK Bribery Act does not
- The UK Bribery Act covers facilitation payments; the FCPA permits them in limited circumstances (Correct answer)
- The FCPA applies to UK subsidiaries; the UK Bribery Act does not apply to US entities
- Both laws have identical enforcement thresholds and penalties
Correct answer: The UK Bribery Act covers facilitation payments; the FCPA permits them in limited circumstances
A key difference is that the UK Bribery Act prohibits facilitation (grease) payments absolutely, while the FCPA has historically permitted small facilitation payments.
Question 6: When evaluating the design effectiveness of a compliance control, an internal auditor should ask:
- Has the control ever failed in the past?
- Is the control capable of preventing or detecting the targeted compliance risk? (Correct answer)
- How long has the control been in place?
- Who is responsible for executing the control?
Correct answer: Is the control capable of preventing or detecting the targeted compliance risk?
Design effectiveness testing determines whether a control, if operating as designed, can adequately address the identified compliance risk.
Question 7: Under the Community Reinvestment Act (CRA), federal banking regulators evaluate institutions on their efforts to:
- Maximize shareholder returns in low-income markets
- Meet the credit needs of the communities they serve, including low- and moderate-income areas (Correct answer)
- Limit lending to prevent systemic risk
- Report suspicious transactions in underserved communities
Correct answer: Meet the credit needs of the communities they serve, including low- and moderate-income areas
The CRA requires federally insured depository institutions to help meet the credit needs of all communities they serve, with particular emphasis on low- and moderate-income neighborhoods.
Certified Internal Auditor Regulatory Frameworks & Compliance 5
Which of the following best describes a 'gap analysis' in the context of regulatory compliance?