FCRA Compliance Management & Risk Mitigation 5 — Questions and Answers
Question 1: A creditor uses a credit score in making an adverse decision and is required to disclose it. Under FCRA Section 615(a), which score-related item is NOT required in the adverse action notice?
- The score itself
- The range of possible scores under the model used
- The full score model algorithm and its weighting factors (Correct answer)
- The key factors that adversely affected the score
Correct answer: The full score model algorithm and its weighting factors
The creditor must disclose the score, score range, and key factors, but is not required to reveal the proprietary model algorithm or its internal weights.
Question 2: Which scenario would constitute 'willful noncompliance' with FCRA, exposing a creditor to statutory and punitive damages under Section 616?
- An isolated clerical error in an adverse action letter's mailing address
- A creditor that knows its adverse action notices omit the required CRA contact information but continues issuing them without correction (Correct answer)
- A technical system error that briefly prevented dispute acknowledgment letters from being sent
- A CRA that takes 32 days to complete an investigation due to an unexpected staffing shortage
Correct answer: A creditor that knows its adverse action notices omit the required CRA contact information but continues issuing them without correction
Willful noncompliance requires knowing or reckless disregard of FCRA requirements; continuing a known violation without correction meets that standard.
Question 3: A compliance manager is building an FCRA risk register. Which risk should be categorized as an 'inherent' rather than 'residual' risk?
- Risk of a dispute volume spike overwhelming the reinvestigation team after a data breach (Correct answer)
- Risk remaining after the company has implemented its dispute-tracking software and staff training
- Risk of an employee making an error that is caught by the compliance checklist
- Risk measured after quarterly audits have been completed
Correct answer: Risk of a dispute volume spike overwhelming the reinvestigation team after a data breach
Inherent risk is the exposure that exists before any controls are applied; a post-breach dispute spike is an inherent risk scenario, not a post-control residual risk.
Question 4: Under FCRA's employment purposes provisions, an employer that takes adverse action based wholly or partly on a consumer report must wait how long after providing the pre-adverse action notice before finalizing the decision?
- Immediately upon delivering the notice
- A reasonable period—commonly interpreted as 5 business days—to allow the consumer to dispute inaccuracies (Correct answer)
- 30 calendar days
- The employer must obtain written acknowledgment from the consumer before proceeding
Correct answer: A reasonable period—commonly interpreted as 5 business days—to allow the consumer to dispute inaccuracies
While FCRA does not specify an exact waiting period, regulators and courts interpret 'reasonable time' as approximately 5 business days for the consumer to respond.
Question 5: A compliance audit reveals that a CRA's dispute data is not being forwarded to furnishers in standardized e-OSCAR format. What FCRA risk does this create?
- Risk of violating Section 609 consumer disclosure requirements
- Risk that furnishers do not receive sufficient information to conduct a complete reinvestigation, undermining the accuracy mandate (Correct answer)
- Risk of violating the Gramm-Leach-Bliley Act's safeguarding rules
- Risk that dispute acknowledgment letters are delayed beyond 5 days
Correct answer: Risk that furnishers do not receive sufficient information to conduct a complete reinvestigation, undermining the accuracy mandate
If dispute information forwarded to furnishers is incomplete or non-standardized, furnishers cannot perform a meaningful investigation, defeating the reinvestigation system's purpose.
Question 6: Which FCRA provision specifically prohibits a CRA from including in a consumer report any information that a CRA has reasonable grounds to believe is inaccurate?
- Section 607(b) — Reasonable procedures for assuring maximum possible accuracy (Correct answer)
- Section 605 — Obsolescence rules
- Section 613 — Public record information for employment purposes
- Section 616 — Civil liability for willful noncompliance
Correct answer: Section 607(b) — Reasonable procedures for assuring maximum possible accuracy
Section 607(b) requires CRAs to follow reasonable procedures designed to ensure maximum possible accuracy of consumer report information.
Question 7: A large financial institution is implementing an enterprise-wide FCRA compliance program. Which governance structure element is MOST critical for program effectiveness?
- A dedicated FCRA webpage on the company intranet
- Clear ownership with a designated FCRA compliance officer who has authority to escalate issues to senior management and the board (Correct answer)
- Annual third-party FCRA audits without internal follow-up
- A shared mailbox for consumer complaints labeled 'FCRA'
Correct answer: Clear ownership with a designated FCRA compliance officer who has authority to escalate issues to senior management and the board
Effective compliance programs require designated ownership with escalation authority to ensure issues reach decision-makers who can allocate resources and mandate change.
FCRA Compliance Management & Risk Mitigation 5
A creditor uses a credit score in making an adverse decision and is required to disclose it.
Under FCRA Section 615(a), which score-related item is NOT required in the adverse action notice?