Excel VBA Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A VBA workbook is used in GxP (Good Practice) pharmaceutical manufacturing. Which version control practice is required?
- Saving over the same file each time changes are made
- Maintaining a numbered version history with change descriptions, author, date, and approval status in a controlled log (Correct answer)
- Using OneDrive version history as the sole record
- Renaming the file with the date when changes are made
Correct answer: Maintaining a numbered version history with change descriptions, author, date, and approval status in a controlled log
GxP regulations require documented version control with change descriptions and approvals to ensure validated systems remain in a known, controlled state.
Question 2: Under the EU AI Act's transparency requirements, a VBA tool that uses AI-generated risk scores to make lending decisions must:
- Keep the scoring algorithm completely confidential
- Inform users that AI is being used to generate scores and provide an explanation of the key factors (Correct answer)
- Apply AI scores without human review for efficiency
- Store AI outputs only in hidden worksheets
Correct answer: Inform users that AI is being used to generate scores and provide an explanation of the key factors
The EU AI Act requires transparency about AI use in high-risk applications, including informing affected persons and explaining AI decision factors.
Question 3: A VBA solution must comply with NERC CIP-007 (Systems Security Management) for a utility company. Which control applies?
- Disabling all macro security warnings for convenience
- Implementing VBA-enforced session timeouts that lock the workbook after a defined period of inactivity (Correct answer)
- Sharing login credentials among control room operators
- Using AutoSave to ensure no data is lost during sessions
Correct answer: Implementing VBA-enforced session timeouts that lock the workbook after a defined period of inactivity
NERC CIP-007 requires session management controls for systems accessing BES Cyber Systems, including automatic session termination after inactivity.
Question 4: Which VBA technique supports GDPR Article 25 (Data Protection by Design and by Default)?
- Collecting all available data fields to support future analysis needs
- Designing the data entry form to collect only the minimum personal data fields required and defaulting optional fields to empty (Correct answer)
- Pre-populating all optional fields with placeholder values
- Requiring users to fill all fields before saving
Correct answer: Designing the data entry form to collect only the minimum personal data fields required and defaulting optional fields to empty
GDPR Article 25 requires that only necessary personal data is collected by default; VBA forms should be designed to minimize data collection from the start.
Question 5: A VBA macro automates fund transfer calculations for a money services business regulated under FinCEN. Which compliance feature is essential?
- Rounding all amounts to the nearest dollar for simplicity
- Flagging and logging any transaction at or above $10,000 for potential Currency Transaction Report (CTR) filing (Correct answer)
- Aggregating all small transactions to avoid reporting thresholds
- Suppressing alerts for transactions from regular customers
Correct answer: Flagging and logging any transaction at or above $10,000 for potential Currency Transaction Report (CTR) filing
FinCEN requires Currency Transaction Reports for cash transactions of $10,000 or more; VBA must flag these automatically to support BSA compliance.
Question 6: For a VBA application subject to SSAE 18 (SOC 2) Type II audit, which control demonstrates continuous monitoring?
- Running a manual audit check at year end
- Generating automated daily exception reports that flag any out-of-range values or unauthorized access attempts (Correct answer)
- Keeping a paper binder of monthly printouts
- Performing spot checks when auditors request them
Correct answer: Generating automated daily exception reports that flag any out-of-range values or unauthorized access attempts
SOC 2 Type II audits evaluate whether controls operate effectively over a period of time; automated daily exception reporting demonstrates continuous monitoring.
Question 7: A VBA developer is asked to implement controls for a system subject to the FCPA (Foreign Corrupt Practices Act). Which feature is most relevant?
- Blocking all international currency conversions
- Logging and flagging payments to government officials or third-party agents in foreign countries for compliance review (Correct answer)
- Restricting the workbook to English-language inputs only
- Converting all amounts to USD before saving
Correct answer: Logging and flagging payments to government officials or third-party agents in foreign countries for compliance review
The FCPA prohibits bribing foreign government officials; VBA controls that flag and log payments to foreign officials or agents support anti-corruption compliance.
Excel VBA Regulatory Frameworks & Compliance 4
A VBA workbook is used in GxP (Good Practice) pharmaceutical manufacturing.
Which version control practice is required?