Regulatory Compliance & Audit Standards Flashcards

A verification agent is asked to re-verify a former employee's credentials for rehire. Which I-9 rule applies if the employee was terminated less than 3 years ago and their original I-9 is still valid?

Answer: The employer may complete a new I-9 or complete Section 3 of the original I-9

For rehires within 3 years of the original I-9 completion date, employers may either complete Section 3 of the original I-9 or complete a new I-9 form.

Under the Equal Credit Opportunity Act (ECOA), creditors must notify applicants of adverse action within how many days of receiving a completed credit application?

Answer: 30 days

ECOA requires creditors to notify applicants of adverse action within 30 days of receiving a completed credit application.

In a compliance audit, 'materiality' is best defined as:

Answer: The threshold above which a misstatement could influence the decisions of a reasonable user of financial statements

Materiality is the concept that defines the magnitude of omissions or misstatements that could influence the economic decisions of users of financial statements.

Which federal law prohibits employers from discriminating against job applicants based on citizenship status or national origin during the employment eligibility verification process?

Answer: Immigration and Nationality Act (INA) Section 274B

INA Section 274B prohibits document abuse, citizenship status discrimination, and national origin discrimination during the I-9 employment eligibility verification process.

A CVA reviewing a financial institution's AML program finds no formal process for reviewing and updating the risk assessment. Under FinCEN guidance, AML risk assessments should be:

Answer: Reviewed and updated periodically, especially when business conditions change

FinCEN guidance requires AML risk assessments to be living documents that are periodically reviewed and updated to reflect changes in the institution's risk profile or business activities.

Which of the following is a key control that a CVA should verify exists in an organization's background screening program to ensure FCRA compliance?

Answer: Obtaining written authorization from the applicant before procuring a consumer report

The FCRA requires employers to obtain written authorization from applicants before obtaining consumer reports for employment purposes.

An internal audit finds that a company's SOX controls documentation has not been updated for two years despite significant system changes. This finding represents a:

Answer: Significant deficiency that may become a material weakness

Outdated controls documentation following significant system changes represents a significant deficiency that could escalate to a material weakness if left unremediated under SOX requirements.