CSC Regulatory Compliance & Guidelines 2 — Questions and Answers
Question 1: Under the Sarbanes-Oxley Act (SOX), which section requires management to assess the effectiveness of internal controls over financial reporting?
- Section 302
- Section 404 (Correct answer)
- Section 802
- Section 906
Correct answer: Section 404
SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting annually.
Question 2: A senior consultant discovers that a client's data retention policy keeps personal health information (PHI) for 10 years beyond the required HIPAA minimum. What is the most appropriate guidance?
- Recommend immediate deletion of all excess PHI
- Advise that longer retention increases breach risk and compliance burden without added benefit (Correct answer)
- Confirm HIPAA has no maximum retention period so the policy is acceptable
- Escalate to the HHS Office for Civil Rights immediately
Correct answer: Advise that longer retention increases breach risk and compliance burden without added benefit
While HIPAA sets minimum retention periods, retaining PHI beyond necessity increases risk and is inconsistent with the minimum necessary standard.
Question 3: Which regulatory framework governs anti-money laundering (AML) program requirements for U.S. financial institutions?
- Gramm-Leach-Bliley Act (GLBA)
- Bank Secrecy Act (BSA) (Correct answer)
- Fair Credit Reporting Act (FCRA)
- Electronic Funds Transfer Act (EFTA)
Correct answer: Bank Secrecy Act (BSA)
The Bank Secrecy Act establishes AML program requirements, including customer due diligence and suspicious activity reporting.
Question 4: A company subject to CCPA (California Consumer Privacy Act) receives a consumer request to delete their personal data. Which scenario would allow the company to DENY the request?
- The data is more than two years old
- The data is necessary to complete a transaction the consumer initiated (Correct answer)
- The consumer has previously submitted a deletion request
- The data is stored in an encrypted format
Correct answer: The data is necessary to complete a transaction the consumer initiated
CCPA allows businesses to deny deletion requests when the data is necessary to complete an ongoing transaction or service.
Question 5: Under the Foreign Corrupt Practices Act (FCPA), which of the following payments is considered a permissible 'facilitating payment'?
- A payment to a foreign official to win a government contract
- A modest payment to a customs official to expedite routine customs clearance (Correct answer)
- A gift given to a foreign minister during holiday season
- A donation to a foreign official's preferred charity
Correct answer: A modest payment to a customs official to expedite routine customs clearance
The FCPA permits facilitating payments for routine governmental actions like customs clearance, though this exception is narrowly applied.
Question 6: When conducting a GDPR compliance assessment for a U.S. company processing EU residents' data, which requirement is unique to GDPR compared to most U.S. state privacy laws?
- The right to access personal data
- Mandatory data breach notification within 72 hours to supervisory authorities (Correct answer)
- Prohibition on selling personal data without consent
- The right to opt out of targeted advertising
Correct answer: Mandatory data breach notification within 72 hours to supervisory authorities
GDPR requires notification to supervisory authorities within 72 hours of discovering a data breach, a stricter timeline than most U.S. laws.
Question 7: A senior consultant is advising a publicly traded company on Regulation FD (Fair Disclosure). Which action would violate Reg FD?
- Posting quarterly earnings results on the company website
- Sharing material non-public information with a select group of analysts before public disclosure (Correct answer)
- Holding an investor conference call open to all investors
- Filing an 8-K with the SEC before a material announcement
Correct answer: Sharing material non-public information with a select group of analysts before public disclosure
Regulation FD prohibits selective disclosure of material non-public information to market professionals without simultaneous public disclosure.
CSC Regulatory Compliance & Guidelines 2
Under the Sarbanes-Oxley Act (SOX), which section requires management to assess the effectiveness of internal controls over financial reporting?