RCMS Investigation & Remediation Procedures 2 — Questions and Answers
Question 1: When conducting a compliance investigation, which action best preserves the integrity of electronic evidence?
- Copying files to a shared network drive
- Creating a forensic image of the original storage media (Correct answer)
- Deleting duplicate files to simplify review
- Forwarding emails to personal accounts for safekeeping
Correct answer: Creating a forensic image of the original storage media
A forensic image creates a bit-for-bit copy that preserves metadata and chain of custody without altering the original evidence.
Question 2: A compliance officer discovers a potential violation during a routine audit. What is the FIRST step in the investigation process?
- Immediately terminate the suspected employee
- Issue a public disclosure to regulators
- Conduct a preliminary assessment to determine if a formal investigation is warranted (Correct answer)
- Close the finding and monitor for recurrence
Correct answer: Conduct a preliminary assessment to determine if a formal investigation is warranted
A preliminary assessment determines the credibility and scope of the potential violation before committing resources to a full investigation.
Question 3: Which privilege most commonly protects communications between legal counsel and employees during an internal compliance investigation?
- Work product doctrine
- Attorney-client privilege (Correct answer)
- Fifth Amendment privilege
- Common interest privilege
Correct answer: Attorney-client privilege
Attorney-client privilege protects confidential communications between an attorney and the client when legal advice is sought.
Question 4: During a remediation plan, a company identifies a systemic process failure. Which remediation approach addresses root causes most effectively?
- Disciplining the individual employee involved
- Issuing a memo reminding staff of existing policies
- Redesigning the flawed process and implementing new controls (Correct answer)
- Waiting for the next audit cycle to reassess
Correct answer: Redesigning the flawed process and implementing new controls
Addressing root causes through process redesign and new controls prevents recurrence rather than addressing only symptoms.
Question 5: What does the term 'chain of custody' refer to in a compliance investigation?
- The hierarchy of managers who approved the investigation
- The documented chronological record of evidence collection, handling, and storage (Correct answer)
- The list of witnesses interviewed in order of interview date
- The regulatory reporting chain from company to agency
Correct answer: The documented chronological record of evidence collection, handling, and storage
Chain of custody documents who collected, handled, and stored evidence to ensure its authenticity and admissibility.
Question 6: An employee reports a potential FCPA violation involving a foreign subsidiary. Which body typically has jurisdiction over this matter?
- State attorney general
- Securities and Exchange Commission (SEC) and Department of Justice (DOJ) (Correct answer)
- Federal Trade Commission (FTC)
- Department of Labor (DOL)
Correct answer: Securities and Exchange Commission (SEC) and Department of Justice (DOJ)
The SEC and DOJ share enforcement authority over FCPA violations involving bribery of foreign officials.
Question 7: Which factor is LEAST important when prioritizing remediation actions after a compliance investigation?
- Severity of the violation
- Likelihood of recurrence
- The seniority of the employee who caused the violation (Correct answer)
- Regulatory reporting deadlines
Correct answer: The seniority of the employee who caused the violation
Employee seniority should not determine remediation priority; severity, recurrence risk, and deadlines are the substantive drivers.
RCMS Investigation & Remediation Procedures 2
When conducting a compliance investigation, which action best preserves the integrity of electronic evidence?