Compliance & Risk Management Flashcards

Under GDPR, the maximum fine for the most serious violations is:

Answer: €20 million or 4% of global annual turnover

GDPR's highest tier of fines is €20 million or 4% of global annual turnover, whichever is higher.

A Compliance Management Program (CMP) should be reviewed and updated:

Answer: On a regular schedule and when significant changes occur

An effective CMP requires periodic scheduled reviews as well as triggered reviews when regulations, business operations, or risk profiles change.

Which document formally defines an organization's acceptable level of risk exposure?

Answer: Risk appetite statement

A risk appetite statement formally articulates the amount and type of risk an organization is willing to accept in pursuit of its objectives.

An employee intentionally leaks confidential corporate data to a competitor. This is an example of:

Answer: Insider threat

An insider threat involves a current or former employee, contractor, or partner who misuses authorized access to harm the organization.

The California Consumer Privacy Act (CCPA) grants consumers the right to:

Answer: Know, delete, and opt out of sale of their personal information

CCPA grants California consumers the rights to know what personal information is collected, to delete it, and to opt out of its sale.

In the context of compliance audits, 'segregation of duties' (SoD) is a control designed to:

Answer: Prevent any single individual from controlling all steps of a critical process

Segregation of duties divides critical tasks among multiple people to reduce the risk of error or fraud by any single individual.

Which risk assessment methodology uses numeric values to calculate expected monetary loss from a risk event?

Answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical values to likelihood and impact to calculate metrics like Annual Loss Expectancy (ALE).