Regulatory Frameworks & Compliance Flashcards

A VBA workbook is used in GxP (Good Practice) pharmaceutical manufacturing. Which version control practice is required?

Answer: Maintaining a numbered version history with change descriptions, author, date, and approval status in a controlled log

GxP regulations require documented version control with change descriptions and approvals to ensure validated systems remain in a known, controlled state.

Under the EU AI Act's transparency requirements, a VBA tool that uses AI-generated risk scores to make lending decisions must:

Answer: Inform users that AI is being used to generate scores and provide an explanation of the key factors

The EU AI Act requires transparency about AI use in high-risk applications, including informing affected persons and explaining AI decision factors.

A VBA solution must comply with NERC CIP-007 (Systems Security Management) for a utility company. Which control applies?

Answer: Implementing VBA-enforced session timeouts that lock the workbook after a defined period of inactivity

NERC CIP-007 requires session management controls for systems accessing BES Cyber Systems, including automatic session termination after inactivity.

Which VBA technique supports GDPR Article 25 (Data Protection by Design and by Default)?

Answer: Designing the data entry form to collect only the minimum personal data fields required and defaulting optional fields to empty

GDPR Article 25 requires that only necessary personal data is collected by default; VBA forms should be designed to minimize data collection from the start.

A VBA macro automates fund transfer calculations for a money services business regulated under FinCEN. Which compliance feature is essential?

Answer: Flagging and logging any transaction at or above $10,000 for potential Currency Transaction Report (CTR) filing

FinCEN requires Currency Transaction Reports for cash transactions of $10,000 or more; VBA must flag these automatically to support BSA compliance.

For a VBA application subject to SSAE 18 (SOC 2) Type II audit, which control demonstrates continuous monitoring?

Answer: Generating automated daily exception reports that flag any out-of-range values or unauthorized access attempts

SOC 2 Type II audits evaluate whether controls operate effectively over a period of time; automated daily exception reporting demonstrates continuous monitoring.

A VBA developer is asked to implement controls for a system subject to the FCPA (Foreign Corrupt Practices Act). Which feature is most relevant?

Answer: Logging and flagging payments to government officials or third-party agents in foreign countries for compliance review

The FCPA prohibits bribing foreign government officials; VBA controls that flag and log payments to foreign officials or agents support anti-corruption compliance.