Compliance Monitoring & Auditing Flashcards

A compliance auditor discovers that a business unit has been self-certifying controls using a checklist that was last updated 18 months ago, predating two material regulatory amendments. The unit's controls technically pass the outdated checklist. What is the auditor's MOST appropriate immediate action?

Answer: Issue a finding classifying the gap as a control design deficiency and suspend the self-certification program pending a framework refresh

The outdated checklist represents a control design deficiency — the monitoring framework failed to keep pace with regulatory change, rendering the self-certifications unreliable as assurance. Issuing a finding and suspending the program until the checklist is updated is the correct response: it stops continued reliance on flawed attestations, creates a documented record, and triggers remediation through proper channels. Accepting the attestations ignores the current compliance gap. Board escalation without first engaging line management violates the standard escalation protocol and is disproportionate at this stage. Retroactively replacing attestations would misrepresent the historical assurance record and could create legal exposure.

During a continuous monitoring review, a compliance team identifies a statistically significant anomaly: a single approver authorized 94% of exceptions to the vendor payment policy over a 90-day period, yet all exceptions fell within delegated authority limits. Which risk concept does this pattern MOST directly implicate?

Answer: Concentration risk within the control environment, potentially masking a tone-at-the-top breakdown

Even when individual exceptions are within delegated limits, funneling nearly all exceptions through a single approver signals concentration risk — a structural vulnerability where one person's judgment, bias, or potential misconduct is the sole safeguard. This pattern can indicate a culture where subordinates route exceptions to a permissive approver, which is a tone-at-the-top concern. Inherent risk is a property of the activity, not the approver pattern. Residual risk and threshold-setting are separate issues not directly evidenced by approver concentration alone. Detection risk relates to auditor methodology; the monitoring system did flag the anomaly, albeit with a lag.

A CCM is designing a risk-based audit plan and must allocate limited audit resources across 40 business processes. Two processes have identical inherent risk scores but Process A has a mature, tested control environment while Process B relies on manual controls that have never been independently validated. Under a risk-based audit methodology, how should audit frequency be differentiated?

Answer: Process B should receive higher audit frequency because unvalidated manual controls produce greater residual risk despite equal inherent risk

Risk-based auditing prioritizes residual risk — what remains after controls are applied — not inherent risk alone. Process B's never-validated manual controls mean there is no evidence of operating effectiveness, so its residual risk is materially higher than Process A's, even though both start with the same inherent risk. Audit resources should shift toward B to establish a baseline of control effectiveness. Using inherent risk as the sole driver ignores the control dimension entirely, which is a fundamental methodological error. Process A's mature, tested controls reduce residual risk and actually justify less frequent audit, not more.

A compliance monitoring program uses a Key Risk Indicator (KRI) dashboard with amber/red thresholds. For six consecutive months, three KRIs have sat just below the amber threshold. Senior management interprets the sustained sub-threshold readings as evidence that the program is well-controlled. A compliance manager disagrees. What phenomenon BEST explains the manager's concern?

Answer: Threshold gaming, where business units manage activity to avoid triggering escalation rather than addressing underlying risk

When multiple KRIs persistently cluster just below escalation thresholds over an extended period, the most operationally significant explanation is threshold gaming — the business is actively managing to the metric rather than to the underlying risk. This is a well-documented compliance culture failure where the measurement itself becomes the target. A Type II error describes a statistical false negative in a test, which is a model design issue, not a behavioral pattern. Autocorrelation is a statistical property of time-series data and does not explain the suspicious clustering. Survivorship bias would apply if poor-performing KRIs had been removed from the dashboard, which is not described here.

An internal compliance audit finds that a subsidiary operating in a high-risk jurisdiction has fully documented policies, completed annual staff training, and passed prior audits. However, transaction testing reveals that 23% of sampled customer due diligence (CDD) files are missing required beneficial ownership documentation. Which audit conclusion framework concept does this situation BEST illustrate?

Answer: The distinction between design effectiveness and operating effectiveness — controls were well-designed but not functioning in practice

This scenario is a textbook example of the design-versus-operating-effectiveness distinction. The subsidiary has all the hallmarks of a well-designed compliance program: documented policies, trained staff, and clean audit history. Yet transaction testing — which tests whether controls actually work — reveals a significant failure rate in practice. This is an operating effectiveness failure. The jurisdiction's inherent risk level informs scoping and materiality thresholds but does not automatically override the need for evidence-based conclusions. Confirmation bias may have contributed to prior misses but is not the primary framework concept illustrated. A 23% exception rate in audit samples is generally sufficient to support a population-level conclusion under standard sampling methodology.

A compliance manager is evaluating two proposed remediation plans for the same audit finding — a systemic failure in trade surveillance alert dispositions. Plan A implements an automated escalation rule that routes all unresolved alerts past 72 hours to a second-line reviewer. Plan B requires first-line supervisors to certify monthly that no alerts have exceeded 72 hours without resolution. From a control theory perspective, which plan offers superior assurance and why?

Answer: Plan A, because it is a preventive-detective automated control that eliminates reliance on human attestation and acts at the point of failure

Plan A is superior because it is an automated control that acts directly on the condition being managed — an alert exceeding 72 hours — at the moment the condition occurs. This eliminates the human judgment and memory dependencies that make attestation-based controls weak. Monthly certifications (Plan B) are detective controls with a significant lag: by the time the supervisor attests, failures may have persisted for up to 30 days, and the attestation itself is only as reliable as the supervisor's diligence and record-keeping. Plan A is also self-evidencing — system logs prove escalations occurred. However, it is important to note that 'always preferable' (option D) is incorrect as a general rule — automated controls can have their own failure modes and may not suit every objective. The correct answer is A because the reasoning is specific and accurate, not because automation is categorically superior.