RCMS Regulatory Frameworks & Standards 3 — Questions and Answers
Question 1: Which U.S. law requires publicly traded companies to establish internal controls over financial reporting and have management assess their effectiveness annually?
- Dodd-Frank Act
- Sarbanes-Oxley Act Section 404 (Correct answer)
- Gramm-Leach-Bliley Act
- Bank Secrecy Act
Correct answer: Sarbanes-Oxley Act Section 404
SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting each year.
Question 2: In the context of AML compliance, what does the term 'layering' refer to?
- Placing illicit funds into the financial system
- Disguising the trail of illicit funds through complex transactions (Correct answer)
- Integrating laundered funds back into the legitimate economy
- Structuring deposits to avoid reporting thresholds
Correct answer: Disguising the trail of illicit funds through complex transactions
Layering is the second stage of money laundering, involving complex transactions designed to obscure the audit trail of illicit funds.
Question 3: Which federal regulation requires financial institutions to verify the identity of beneficial owners of legal entity customers?
- FinCEN Customer Due Diligence Rule (Correct answer)
- Bank Secrecy Act Section 312
- USA PATRIOT Act Section 326
- OFAC Compliance Program Guidance
Correct answer: FinCEN Customer Due Diligence Rule
FinCEN's CDD Rule, effective 2018, requires covered financial institutions to identify and verify beneficial owners owning 25% or more of legal entity customers.
Question 4: The NIST Cybersecurity Framework (CSF) organizes its core functions in which order?
- Identify, Protect, Detect, Respond, Recover (Correct answer)
- Assess, Plan, Implement, Monitor, Review
- Prevent, Detect, Contain, Eradicate, Recover
- Govern, Identify, Protect, Detect, Respond, Recover
Correct answer: Identify, Protect, Detect, Respond, Recover
The original NIST CSF core consists of five functions: Identify, Protect, Detect, Respond, and Recover (CSF 2.0 added Govern).
Question 5: Under the Health Insurance Portability and Accountability Act (HIPAA), which rule specifically governs the security of electronic protected health information (ePHI)?
- Privacy Rule
- Security Rule (Correct answer)
- Breach Notification Rule
- Enforcement Rule
Correct answer: Security Rule
The HIPAA Security Rule establishes national standards to protect ePHI through administrative, physical, and technical safeguards.
Question 6: Which organization publishes the Principles for Responsible Investment (PRI) framework that guides ESG compliance for institutional investors?
- International Finance Corporation
- United Nations-supported initiative (Correct answer)
- World Economic Forum
- Basel Committee on Banking Supervision
Correct answer: United Nations-supported initiative
The PRI is a UN-supported network of investors that develops principles promoting the incorporation of ESG factors into investment decisions.
Question 7: A regulated entity receives conflicting guidance from two different federal regulators claiming jurisdiction. This situation is best characterized as:
- Regulatory arbitrage
- Jurisdictional overlap (Correct answer)
- Preemption conflict
- Regulatory capture
Correct answer: Jurisdictional overlap
Jurisdictional overlap occurs when multiple regulators claim authority over the same entity or conduct, creating compliance ambiguity.
RCMS Regulatory Frameworks & Standards 3
Which U.S. law requires publicly traded companies to establish internal controls over financial reporting and have management assess their effectiveness annually?