GPHR (GPHR) Global Risk and Compliance 5 — Questions and Answers
Question 1: A global company is assessing third-party vendor risk for HR data processing. Which contractual mechanism is REQUIRED under GDPR when sharing EU employee data with a vendor?
- A non-disclosure agreement (NDA)
- A Data Processing Agreement (DPA) meeting GDPR Article 28 requirements (Correct answer)
- A general service level agreement (SLA)
- An indemnification clause in the master service agreement
Correct answer: A Data Processing Agreement (DPA) meeting GDPR Article 28 requirements
GDPR Article 28 mandates a Data Processing Agreement with any processor handling personal data, specifying the scope, nature, and purpose of processing.
Question 2: When a global HR team discovers that a host country requires works council consultation before implementing a workforce reduction, failure to consult creates which type of risk?
- Reputational risk
- Legal and regulatory risk (Correct answer)
- Operational risk
- Strategic risk
Correct answer: Legal and regulatory risk
Bypassing mandatory works council consultation violates statutory labor law, exposing the company to legal challenges, injunctions, and financial penalties.
Question 3: Which international standard provides a framework for occupational health and safety management systems that a global HR function might adopt?
- ISO 9001
- ISO 45001 (Correct answer)
- ISO 31000
- ISO 27001
Correct answer: ISO 45001
ISO 45001 is the international standard for occupational health and safety management systems, replacing the earlier OHSAS 18001.
Question 4: A global HR director is building a risk register for people operations. Which risk would MOST likely be categorized under 'political risk'?
- Currency devaluation reducing real wages
- A government nationalization decree that forces local ownership of the business (Correct answer)
- A talent shortage in a key skill area
- Employee turnover exceeding 20% annually
Correct answer: A government nationalization decree that forces local ownership of the business
Nationalization decrees and government-imposed ownership changes are classic examples of political risk that can directly disrupt workforce and HR operations.
Question 5: Under the US Foreign Corrupt Practices Act (FCPA), HR professionals must ensure that which employee behavior is explicitly prohibited in company policy?
- Offering paid time off to government officials visiting the facility
- Paying bribes or anything of value to foreign government officials to obtain or retain business (Correct answer)
- Hiring relatives of government officials as interns
- Providing branded merchandise at trade shows
Correct answer: Paying bribes or anything of value to foreign government officials to obtain or retain business
The FCPA prohibits offering, paying, or promising anything of value to foreign government officials to gain a business advantage.
Question 6: An MNC is rolling out a global minimum wage floor that exceeds some host-country statutory minimums. What is the PRIMARY compliance consideration?
- Ensuring the floor does not exceed what local law requires
- Verifying that the global floor does not inadvertently violate local collective bargaining agreements or benefit entitlement triggers (Correct answer)
- Applying the global floor only to expatriate employees
- Publishing the floor only internally to avoid competitive disclosure
Correct answer: Verifying that the global floor does not inadvertently violate local collective bargaining agreements or benefit entitlement triggers
A global wage floor that surpasses local statutory minimums may trigger additional entitlements under local CBAs or statutory benefit formulas tied to base pay.
Question 7: What is the key HR compliance responsibility when deploying an expatriate on a long-term assignment to a country with a bilateral social security totalization agreement with the home country?
- Enrolling the expatriate in both the home and host country social security systems simultaneously
- Obtaining a certificate of coverage to prevent dual social security contributions (Correct answer)
- Exempting the expatriate from all social security obligations
- Calculating social security contributions based solely on host-country salary
Correct answer: Obtaining a certificate of coverage to prevent dual social security contributions
A certificate of coverage issued under a totalization agreement confirms the expatriate remains covered by the home-country system, eliminating the obligation to contribute in the host country.
GPHR (GPHR) Global Risk and Compliance 5
A global company is assessing third-party vendor risk for HR data processing.
Which contractual mechanism is REQUIRED under GDPR when sharing EU employee data with a vendor?