Risk Management & Compliance Flashcards

Under the COSO ERM framework, which component involves defining the desired culture and setting the tone at the top regarding risk?

Answer: Governance and Culture

The 'Governance and Culture' component of COSO ERM 2017 establishes the organization's tone, values, and oversight structures that shape risk management.

An organization discovers that a contractor has been sharing confidential client data without authorization. Under GDPR, this organization is MOST likely liable as a:

Answer: Data controller

The organization that determines the purposes and means of processing personal data is the data controller, and remains responsible for ensuring contractors (processors) comply with GDPR.

A key risk indicator (KRI) is BEST described as:

Answer: A leading metric that signals increasing risk exposure before an incident

KRIs are forward-looking metrics that provide early warning signals of rising risk levels, allowing proactive management before an event materializes.

The Children's Online Privacy Protection Act (COPPA) restricts the online collection of personal information from children under what age?

Answer: 13

COPPA prohibits websites and online services from collecting personal information from children under 13 without verifiable parental consent.

In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

Answer: The maximum tolerable downtime before significant harm occurs

The RTO specifies the maximum acceptable time allowed to restore a business process or system after a disruption before the impact becomes unacceptable.

Which regulatory requirement mandates that U.S. public companies disclose material cybersecurity incidents to the SEC within four business days?

Answer: SEC Cybersecurity Disclosure Rules (2023)

The SEC's 2023 cybersecurity disclosure rules require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality.

A senior specialist recommends implementing separation of duties for the accounts payable process. This control is designed PRIMARILY to reduce which type of risk?

Answer: Fraud and error risk

Separation of duties prevents any single individual from having enough access to commit and conceal fraud or errors, directly reducing fraud and error risk.