Compliance Programs Flashcards

A cloud service provider's FedRAMP-authorized system has an approved POA&M. During continuous monitoring, the provider discovers that a High-severity vulnerability remediation will miss its scheduled completion date by 45 days because a vendor patch is delayed. Which action BEST aligns with a compliance program that is operating as designed?

Answer: Update the POA&M with a revised completion date, milestone changes, and justification, and report the deviation to the authorizing official, with compensating controls documented

POA&M items must be kept current. A schedule slip requires a documented revised date, a justification (e.g., vendor dependency), and notification to the authorizing official, ideally with compensating controls. Closing the item or reclassifying severity to avoid a deadline is improper, and waiting for the annual assessment violates continuous monitoring expectations.

An organization inherits a control (physical access to the data center) from a colocation provider that holds a SOC 2 Type II report. The report contains a qualified opinion on the physical access criterion and lists a Complementary User Entity Control (CUEC) requiring customers to review badge access lists quarterly. What is the MOST appropriate compliance program response?

Answer: Document the control as partially inherited, assess the exception's impact on the organization's risk, implement the CUEC, and add compensating controls or a risk decision as needed

A qualified opinion means the provider's control did not operate effectively in some respect, so inheritance cannot be taken at face value. The customer must still perform its CUEC responsibilities and evaluate the exception, applying compensating controls or documenting a risk decision. Type I does not test operating effectiveness, and removing the control from the SSP misrepresents the shared responsibility.

During an internal audit of a compliance program, the auditor finds that control testing is performed by the same team that operates the controls, and results are reported only to the control owners' manager. Which governance model change BEST addresses this weakness under the three lines of defense concept?

Answer: Move testing to an independent second-line compliance or risk function, with results reported to a risk or audit committee, and keep internal audit as a third-line assurance provider

Control owners (first line) should not be the sole testers of their own controls. Independent second-line monitoring with reporting to a governance body, plus separate third-line internal audit assurance, restores objectivity. Having internal audit do all testing compromises its independence, and increasing frequency does not address self-review bias.

A multinational organization is subject to both HIPAA and GDPR for a shared patient-data platform. A compliance program team is mapping the two regimes into a unified control framework. Which approach is MOST defensible when requirements conflict, for example on breach notification timing and data retention?

Answer: Apply the most stringent applicable requirement for each control objective, document the legal basis and any jurisdiction-specific exceptions, and obtain legal counsel review

A harmonized control set normally uses the most stringent applicable requirement per control objective (e.g., the 72-hour GDPR notification window versus HIPAA's 60 days), with documented legal rationale and counsel review for true conflicts such as retention limits versus record-keeping duties. Choosing the weaker standard risks non-compliance in the stricter jurisdiction.

A compliance program's key risk indicator (KRI) for overdue control attestations has remained green for 12 months. An independent review finds that attestations are routinely auto-approved by a workflow after 5 days with no response. What is the PRIMARY compliance program deficiency?

Answer: The metric measures completion activity rather than control effectiveness, so it provides false assurance

Auto-approval on silence makes the metric reflect process throughput, not that owners actually verified their controls. The KRI therefore gives false assurance. Effective compliance metrics should measure outcomes or evidence of effectiveness, and the attestation design should require affirmative responses.

An organization discovers that a control it has reported as compliant for two years was never actually implemented in a legacy subsystem that was excluded from scoping documentation by mistake. After containment, which action is MOST important for the compliance program to take regarding prior reporting?

Answer: Perform a root cause and impact analysis, determine whether prior attestations or regulatory submissions were materially inaccurate, and make corrective disclosures as legal and regulatory obligations require

A scoping failure that led to inaccurate compliance assertions requires root cause analysis, impact assessment on prior attestations, and corrective disclosure where obligations exist (to regulators, customers, or auditors). Retroactive rescoping, deleting records, or silent correction would compound the violation and undermine program integrity.