CMC CMC Quality & Compliance 2 — Questions and Answers
Question 1: A consulting firm discovers mid-engagement that the client's internal controls have a significant gap that was not part of the original scope. What is the CMC's most appropriate response?
- Ignore it to stay within scope
- Document and disclose the gap to client leadership immediately (Correct answer)
- Fix the gap without informing anyone
- Terminate the engagement
Correct answer: Document and disclose the gap to client leadership immediately
CMCs have a professional duty to disclose material control deficiencies discovered during an engagement, even if outside the original scope.
Question 2: Which quality management principle emphasizes understanding and managing interrelated processes as a system to achieve objectives effectively and efficiently?
- Customer focus
- Leadership
- Process approach (Correct answer)
- Continual improvement
Correct answer: Process approach
The process approach principle in ISO 9001 recognizes that managing interrelated activities as a system improves effectiveness and efficiency.
Question 3: Under the ICMCI Code of Professional Conduct, a CMC must maintain objectivity. Which scenario MOST directly threatens objectivity?
- Billing hourly instead of on retainer
- Accepting a success fee tied to the client's financial outcomes (Correct answer)
- Working with a client in a new industry
- Using proprietary frameworks
Correct answer: Accepting a success fee tied to the client's financial outcomes
Success fees create a financial incentive that can bias a consultant's recommendations, directly compromising objectivity.
Question 4: A CMC is auditing a client's compliance program and finds that policies exist but are rarely enforced. This gap between policy and practice is best described as a failure in:
- Policy design
- Compliance culture and operationalization (Correct answer)
- Regulatory knowledge
- Documentation standards
Correct answer: Compliance culture and operationalization
When policies exist but are not enforced, the root cause is typically a weak compliance culture and failure to operationalize controls into daily practice.
Question 5: In Six Sigma methodology, the DMAIC phase where root causes of defects are identified is:
- Define
- Measure
- Analyze (Correct answer)
- Improve
Correct answer: Analyze
The Analyze phase in DMAIC uses data and tools like fishbone diagrams and regression analysis to identify root causes of defects.
Question 6: A client asks a CMC to certify that their organization is fully SOX compliant based solely on a brief walkthrough. The CMC should:
- Issue the certification to maintain the client relationship
- Decline and explain that adequate evidence gathering is required before any certification (Correct answer)
- Certify with a disclaimer
- Delegate the certification to the client's CFO
Correct answer: Decline and explain that adequate evidence gathering is required before any certification
Issuing a compliance certification without sufficient evidence gathering violates professional standards and exposes both parties to legal and reputational risk.
Question 7: Which of the following is the PRIMARY purpose of a management review in an ISO 9001 quality management system?
- Conducting product inspections
- Ensuring top management evaluates QMS suitability, adequacy, and effectiveness (Correct answer)
- Training new employees on quality procedures
- Identifying customer complaints
Correct answer: Ensuring top management evaluates QMS suitability, adequacy, and effectiveness
ISO 9001 requires top management to periodically review the QMS to ensure its continued suitability, adequacy, effectiveness, and alignment with strategic direction.
CMC CMC Quality & Compliance 2
A consulting firm discovers mid-engagement that the client's internal controls have a significant gap that was not part of the original scope.
What is the CMC's most appropriate response?