Risk Management & Compliance Flashcards

Under the Federal Sentencing Guidelines for Organizations, which factor can MOST significantly reduce fines imposed on a company for criminal conduct?

Answer: Existence of an effective compliance and ethics program

The Federal Sentencing Guidelines recognize an effective compliance and ethics program as a major mitigating factor that can substantially reduce culpability scores and resulting fines.

A senior specialist is reviewing an organization's risk register and notices that a risk's residual risk level still exceeds the organization's risk appetite after controls are applied. What is the APPROPRIATE next step?

Answer: Implement additional controls or escalate to leadership for a risk acceptance decision

When residual risk exceeds risk appetite, the organization must either apply additional controls to bring it within tolerance or escalate for a formal, documented risk acceptance decision by appropriate leadership.

The California Consumer Privacy Act (CCPA) grants consumers the right to opt out of which specific business activity?

Answer: The sale of their personal information to third parties

CCPA grants California consumers the right to opt out of the sale of their personal information to third parties, requiring a 'Do Not Sell My Personal Information' link on covered businesses' websites.

In ISO 31000:2018, risk is defined as the effect of uncertainty on objectives. The term 'effect' in this context can be:

Answer: Positive, negative, or both deviations from what is expected

ISO 31000 defines an effect of uncertainty as a deviation from the expected — which can be positive (opportunity), negative (threat), or both.

A compliance officer discovers that an employee has been falsifying expense reports for two years. Under whistleblower protections established by Dodd-Frank, employees who report securities law violations to the SEC may receive:

Answer: A monetary award of 10-30% of sanctions over $1 million collected by the SEC

Dodd-Frank's whistleblower program entitles eligible whistleblowers to an award of 10% to 30% of monetary sanctions exceeding $1 million that result from their original information.

Which of the following BEST describes the purpose of a compliance gap analysis?

Answer: Comparing current organizational practices against required regulatory or framework standards to identify deficiencies

A compliance gap analysis systematically compares what an organization currently does against what is required by regulations, standards, or frameworks to identify areas needing remediation.

An organization operating critical infrastructure is required by CISA to report covered cyber incidents within 72 hours and ransomware payments within 24 hours under which legislation?

Answer: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022

CIRCIA (2022) mandates that covered critical infrastructure entities report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours.