RCMS Compliance Monitoring & Testing 4 — Questions and Answers
Question 1: When a compliance test reveals a gap between policy requirements and actual employee behavior, the root cause analysis should FIRST examine:
- Whether the policy was communicated and understood by employees (Correct answer)
- How long the policy has been in existence
- Whether a competitor organization has a similar policy
- The total number of employees affected by the policy
Correct answer: Whether the policy was communicated and understood by employees
Gaps between policy and behavior often stem from inadequate communication or training, making that the logical first root cause to investigate.
Question 2: A compliance officer is tasked with validating a third-party vendor's compliance controls. Which approach is MOST appropriate?
- Rely solely on the vendor's self-certification questionnaire
- Conduct an on-site review or request detailed evidence of control operation (Correct answer)
- Assume controls are adequate if the vendor has a written compliance policy
- Delegate vendor oversight entirely to the procurement department
Correct answer: Conduct an on-site review or request detailed evidence of control operation
Effective third-party oversight requires obtaining and reviewing evidence of control operation, not just relying on self-reported information.
Question 3: Which of the following is a PRIMARY output of a compliance monitoring cycle?
- A revised regulatory examination schedule
- A monitoring report summarizing findings, risk ratings, and remediation recommendations (Correct answer)
- An updated list of applicable regulations
- A revised annual compliance budget
Correct answer: A monitoring report summarizing findings, risk ratings, and remediation recommendations
The primary deliverable of a monitoring cycle is the monitoring report, which communicates findings and drives corrective action.
Question 4: A compliance test finds that 100% of sampled transactions complied with policy requirements. The tester should:
- Conclude there are no compliance risks in this area and remove it from future monitoring
- Document the satisfactory result but maintain the area in the monitoring universe for future cycles (Correct answer)
- Immediately expand the sample to the full population to confirm the result
- Report the satisfactory result only if management requests it
Correct answer: Document the satisfactory result but maintain the area in the monitoring universe for future cycles
A clean result should be documented and the area retained in the monitoring universe, as risk conditions can change over time.
Question 5: Which regulation MOST directly governs requirements for compliance monitoring programs at US bank holding companies?
- Regulation E (Electronic Fund Transfers)
- Regulation Z (Truth in Lending)
- 12 CFR Part 30 / OCC Heightened Standards and Federal Reserve SR 08-8 (Correct answer)
- Regulation DD (Truth in Savings)
Correct answer: 12 CFR Part 30 / OCC Heightened Standards and Federal Reserve SR 08-8
OCC Heightened Standards (12 CFR Part 30) and Federal Reserve SR 08-8 set supervisory expectations for compliance risk management programs at large banking organizations.
Question 6: In compliance monitoring, a 'hot spot' refers to:
- A geographic region with elevated regulatory activity
- A business area, process, or product line identified as having elevated compliance risk requiring focused attention (Correct answer)
- A time period during which compliance testing is suspended
- A type of regulatory examination that occurs without advance notice
Correct answer: A business area, process, or product line identified as having elevated compliance risk requiring focused attention
Hot spots are areas of concentrated compliance risk that warrant additional monitoring resources and attention.
Question 7: Which of the following BEST describes 'issue aging' in a compliance management system?
- Tracking how long it takes regulators to close examination findings
- Monitoring how long corrective action items remain open past their target remediation dates (Correct answer)
- Measuring the number of years a compliance officer has been in their role
- Calculating when a policy was last updated relative to a regulatory change
Correct answer: Monitoring how long corrective action items remain open past their target remediation dates
Issue aging tracks overdue remediation items, helping management identify unresolved compliance risks that need escalation.
RCMS Compliance Monitoring & Testing 4
When a compliance test reveals a gap between policy requirements and actual employee behavior, the root cause analysis should FIRST examine: