CRA Regulatory and Compliance Standards 3

Question 1

Under the Sarbanes-Oxley Act, which section requires management to assess and report on the effectiveness of internal controls over financial reporting (ICFR)?

Accepted Answer

Section 404

Answer

SOX Section 404 mandates that management assess ICFR effectiveness annually, and requires external auditors to attest to that assessment.

Question 2

Which regulatory body oversees the enforcement of the Foreign Corrupt Practices Act (FCPA) for securities-related violations?

Accepted Answer

Securities and Exchange Commission (SEC)

Answer

The SEC enforces FCPA's anti-bribery and accounting provisions for issuers of securities, while the DOJ handles criminal enforcement.

Question 3

The FFIEC Cybersecurity Assessment Tool (CAT) maps to which NIST framework as its primary reference?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The FFIEC CAT aligns its maturity domains and assessment categories directly to the five core functions of the NIST Cybersecurity Framework.

Question 4

Under HIPAA, what is the maximum civil monetary penalty per violation category for organizations that demonstrate willful neglect and fail to correct the violation?

Accepted Answer

$1,900,000

Answer

HIPAA's highest penalty tier—willful neglect not corrected—carries a maximum of $1.9 million per violation category per year (adjusted for inflation).

Question 5

Which international standard provides a framework for establishing, implementing, and maintaining an Information Security Management System (ISMS)?

Accepted Answer

ISO 27001

Answer

ISO/IEC 27001 specifies requirements for an ISMS and is the globally recognized certification standard for information security management.

(CRA) Certified Risk Architect Practice Test

(CRA) Certified Risk Architect Practice Test

CRA Regulatory and Compliance Standards 3