RCC Regulatory Change Management and Regulator Engagement — Questions and Answers
Question 1: What is the primary purpose of 'horizon scanning' in a regulatory change management program?
- To audit completed controls for effectiveness
- To identify upcoming laws, rules and regulatory expectations before they take effect (Correct answer)
- To train employees on existing policies
- To investigate reported misconduct
Correct answer: To identify upcoming laws, rules and regulatory expectations before they take effect
Horizon scanning proactively monitors proposed and emerging regulations, guidance and enforcement trends so the organization can assess impact and prepare before compliance deadlines arrive.
Question 2: After a new regulation is identified as applicable, which step should come next in a typical regulatory change management lifecycle?
- Retire all related policies
- Perform an impact assessment to determine affected processes, policies, systems and owners (Correct answer)
- Wait for the first regulatory examination
- Report the change to the board as a violation
Correct answer: Perform an impact assessment to determine affected processes, policies, systems and owners
Once a change is identified and deemed applicable, the organization assesses its impact on business processes, policies, controls, systems and people. It then assigns owners, implements changes and tracks completion.
Question 3: What is the main benefit of maintaining a regulatory obligations register (or inventory)?
- It replaces the need for a compliance risk assessment
- It maps legal and regulatory requirements to the policies, controls and owners responsible for meeting them (Correct answer)
- It guarantees regulators will not conduct exams
- It lists employees who have violated policy
Correct answer: It maps legal and regulatory requirements to the policies, controls and owners responsible for meeting them
An obligations register links each requirement to the controls and accountable owners that satisfy it. This makes gaps visible, supports change management, and provides evidence of compliance during examinations.
Question 4: During a regulatory examination, which practice is generally considered best for managing the organization's interaction with examiners?
- Allow any employee to answer examiner questions informally
- Designate a coordinator to manage requests, track responses and ensure accurate, consistent and timely production of documents (Correct answer)
- Delay all document requests until the exam ends
- Provide only verbal answers to avoid creating records
Correct answer: Designate a coordinator to manage requests, track responses and ensure accurate, consistent and timely production of documents
A central point of contact or exam coordinator ensures requests are logged, responses are accurate and consistent, deadlines are met, and legal counsel is involved when needed. This supports a cooperative and credible relationship with the regulator.
Question 5: A compliance officer discovers a significant, previously unreported violation. Which consideration most strongly supports voluntary self-disclosure to the regulator?
- Regulators never consider disclosure in enforcement decisions
- Timely self-reporting combined with cooperation and remediation can result in reduced penalties or more lenient treatment (Correct answer)
- Self-disclosure eliminates the need for any corrective action
- Disclosure is only permitted after a whistleblower complaint
Correct answer: Timely self-reporting combined with cooperation and remediation can result in reduced penalties or more lenient treatment
Many enforcement frameworks, such as the DOJ Corporate Enforcement Policy and OFAC's Enforcement Guidelines, treat voluntary self-disclosure, cooperation and remediation as mitigating factors. Disclosure does not remove the obligation to fix the underlying problem.
Question 6: Which sequence best represents a sound remediation process after a compliance finding?
- Fix the symptom, close the issue, and move on
- Root cause analysis, corrective action plan with owners and deadlines, implementation, and validation that the fix is effective (Correct answer)
- Discipline employees, then end the review
- Document the finding and wait for the next audit cycle
Correct answer: Root cause analysis, corrective action plan with owners and deadlines, implementation, and validation that the fix is effective
Effective remediation identifies the root cause, assigns corrective actions with accountable owners and due dates, implements them, and independently validates that the issue is resolved and will not recur.
