CGRC Compliance Programs 3 — Questions and Answers
Question 1: Which regulatory framework requires publicly traded US companies to establish internal controls over financial reporting and have management assess their effectiveness?
- HIPAA
- Sarbanes-Oxley Act Section 404 (Correct answer)
- Gramm-Leach-Bliley Act
- Federal Trade Commission Act
Correct answer: Sarbanes-Oxley Act Section 404
SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting, with external auditor attestation.
Question 2: A compliance program gap analysis compares which two elements?
- Current policies and proposed new regulations
- Actual compliance posture and required compliance standards (Correct answer)
- Employee awareness levels and training completion rates
- Compliance budget and actual expenditures
Correct answer: Actual compliance posture and required compliance standards
A gap analysis compares an organization's current compliance posture against the required standard or regulation to identify deficiencies that must be remediated.
Question 3: Which of the following best describes a 'compliance management system' (CMS)?
- A software tool for tracking regulatory filings
- An integrated framework of policies, processes, and controls to meet compliance obligations (Correct answer)
- A database of all applicable laws and regulations
- A reporting dashboard for senior management
Correct answer: An integrated framework of policies, processes, and controls to meet compliance obligations
A CMS is an integrated framework encompassing policies, procedures, training, monitoring, and corrective action processes that together manage compliance obligations.
Question 4: Under which circumstance is attorney-client privilege most likely to protect a compliance investigation report?
- When the report is shared with all employees
- When conducted at the direction of legal counsel for the purpose of providing legal advice (Correct answer)
- When the compliance officer holds a law degree
- When the report is marked 'confidential'
Correct answer: When conducted at the direction of legal counsel for the purpose of providing legal advice
Attorney-client privilege protects investigation reports when they are conducted at the direction of counsel for the purpose of rendering legal advice to the organization.
Question 5: Which metric is MOST useful for measuring the effectiveness of a compliance training program?
- Percentage of employees who completed training
- Pre/post knowledge assessments and subsequent incident rates (Correct answer)
- Total training hours delivered
- Training cost per employee
Correct answer: Pre/post knowledge assessments and subsequent incident rates
Pre/post assessments measure knowledge change, and tracking incident rates after training provides evidence of behavioral impact, the true measure of effectiveness.
Question 6: When an organization identifies a conflict between a company policy and an applicable law or regulation, which takes precedence?
- Company policy, as it is more specific to the business
- The applicable law or regulation (Correct answer)
- The standard with the more lenient requirements
- Whichever was established most recently
Correct answer: The applicable law or regulation
Laws and regulations are legally binding and always take precedence over internal company policies when a conflict exists.
Question 7: Which body typically has ultimate oversight responsibility for an organization's compliance program?
- The Chief Compliance Officer
- The board of directors or its designated committee (Correct answer)
- The internal audit department
- The chief executive officer
Correct answer: The board of directors or its designated committee
The board of directors, or a designated committee such as the audit committee, holds ultimate fiduciary oversight responsibility for the organization's compliance program.
CGRC Compliance Programs 3
Which regulatory framework requires publicly traded US companies to establish internal controls over financial reporting and have management assess their effectiveness?