RCMS Regulatory Frameworks & Standards 4 — Questions and Answers
Question 1: Under the COSO Internal Control – Integrated Framework, which component addresses the processes used to identify and assess risks to achieving objectives?
- Control Environment
- Risk Assessment (Correct answer)
- Control Activities
- Monitoring Activities
Correct answer: Risk Assessment
The Risk Assessment component of COSO involves identifying and analyzing relevant risks that may prevent achievement of organizational objectives.
Question 2: Which EU regulation, effective 2023, requires large companies to conduct due diligence on human rights and environmental impacts across their supply chains?
- EU Taxonomy Regulation
- Corporate Sustainability Reporting Directive
- Corporate Sustainability Due Diligence Directive (Correct answer)
- Non-Financial Reporting Directive
Correct answer: Corporate Sustainability Due Diligence Directive
The Corporate Sustainability Due Diligence Directive (CS3D) mandates that large EU companies identify and address adverse human rights and environmental impacts in their value chains.
Question 3: In U.S. financial regulation, Regulation O governs which type of transactions?
- Options trading by insiders
- Loans to executive officers and directors of banks (Correct answer)
- Offshore banking transactions
- Over-the-counter derivatives
Correct answer: Loans to executive officers and directors of banks
Regulation O restricts credit extensions by member banks to their own executive officers, directors, principal shareholders, and their related interests.
Question 4: A compliance officer is mapping controls to regulatory requirements. Which approach ensures that each regulation has at least one control addressing it?
- Control self-assessment
- Regulatory gap analysis (Correct answer)
- Three lines of defense review
- Compliance risk scoring
Correct answer: Regulatory gap analysis
A regulatory gap analysis systematically compares existing controls against regulatory requirements to identify areas lacking adequate coverage.
Question 5: The UK Bribery Act 2010 differs from the U.S. FCPA primarily because it:
- Only applies to public officials
- Covers both public and private sector bribery (Correct answer)
- Excludes facilitation payments from its prohibitions
- Applies only to UK-incorporated companies
Correct answer: Covers both public and private sector bribery
Unlike the FCPA, the UK Bribery Act covers bribery in both the public and private sectors and includes an offense of failing to prevent bribery.
Question 6: Under the Payment Card Industry Data Security Standard (PCI DSS), what is the minimum length required for unique cryptographic keys?
- 64 bits
- 128 bits (Correct answer)
- 256 bits
- 512 bits
Correct answer: 128 bits
PCI DSS requires a minimum key length of 128 bits for symmetric encryption algorithms to protect cardholder data.
Question 7: Which provision of the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with privacy notices about information sharing practices?
- Financial Privacy Rule (Correct answer)
- Safeguards Rule
- Pretexting provisions
- Interagency Guidelines
Correct answer: Financial Privacy Rule
The GLBA Financial Privacy Rule requires financial institutions to provide clear notice to customers about their privacy practices and information-sharing policies.
RCMS Regulatory Frameworks & Standards 4
Under the COSO Internal Control – Integrated Framework, which component addresses the processes used to identify and assess risks to achieving objectives?