CAIIB Paper 1 Module D Quiz 1

Correct answer: Compliance policy is approved by the Board or an authorised Board committee. The Board has ultimate oversight of the compliance framework and normally approves the compliance policy, often through an authorised committee. Senior management implements it, while the compliance function advises, monitors and reports. Branches must not create inconsistent independent policies.

Correct answer: To identify, assess, advise on, monitor and report compliance risk. The compliance function helps the bank manage the risk of legal or regulatory sanctions, material financial loss, or reputational damage arising from failure to comply with applicable laws, rules, codes and standards. It complements rather than replaces business-line accountability and other control functions.

Correct answer: The CCO has appropriate authority, access and escalation channels to senior management and the Board. Independence requires adequate status, authority, resources, access to information and direct escalation routes. The compliance function should be able to raise concerns without commercial pressure. It does not have power to waive statutory requirements.

Correct answer: Prioritise areas using risk exposure, regulatory impact and control weakness. A risk-based plan allocates effort according to the likelihood and impact of non-compliance, considering business complexity, past findings, regulatory changes, control quality and customer impact. Uniform testing can leave high-risk areas insufficiently examined.

Correct answer: Review relevant legal and regulatory requirements early in product design. Compliance should be involved early in new products, services, processes and material changes. Early review helps identify regulatory obligations, customer-protection requirements, disclosures, outsourcing issues and control needs before launch.

Correct answer: Policies, risk assessment, advice, training, monitoring, escalation and remediation. A compliance programme is a connected set of governance, policies, risk assessment, communication, training, monitoring, reporting and corrective action. A written policy or training programme alone cannot demonstrate effective implementation.

Correct answer: Overseeing the bank-wide compliance framework and reporting material compliance concerns. The CCO leads or oversees the compliance function, advises management, monitors compliance risk and escalates significant issues. Business units remain responsible for complying with requirements in their own activities; the CCO does not replace the auditor or regulator.

Correct answer: Monitoring is ongoing oversight; an independent audit provides assurance on the adequacy and effectiveness of controls. Monitoring is typically part of day-to-day or second-line oversight and tracks compliance indicators and exceptions. Independent audit provides a more objective assessment of governance, risk management and control effectiveness. Exact organisational arrangements depend on the bank‘s framework.

Correct answer: An assessment of inherent risk, control effectiveness and residual risk. Risk-based audit directs audit resources to areas with greater residual risk. Inherent risk is assessed before considering controls; control effectiveness then informs residual risk and audit priority. Plans should be refreshed when business, technology or regulation changes.

Correct answer: Require root-cause analysis, an accountable owner, a deadline and verification of remediation. Effective follow-up requires a corrective action plan that addresses root causes, specifies responsibility and deadlines, and is independently validated for closure. Acknowledgement alone does not remedy the underlying risk.

Correct answer: To ensure disclosures are accurate, complete, timely and consistent with applicable requirements. Disclosure controls support accuracy, completeness, timeliness and consistency with applicable laws, accounting standards and listing requirements where relevant. Confidentiality and privacy obligations continue to apply.

Correct answer: Transparency, timely material information and investor protection. Listing-related disclosure requirements promote transparency and fair access to material information for investors. A listed bank may also remain subject to RBI, Companies Act, accounting and other applicable requirements; one framework does not replace the others.

Correct answer: Set tone and oversee the framework while ensuring management accountability. The Board sets the tone, approves or oversees key policies, reviews significant risks and ensures an effective control framework. Management executes the framework and the compliance function provides specialist oversight; responsibilities cannot simply be transferred away.

Correct answer: Business and operational management, supported by independent control functions. Business units and operational management are responsible for compliance in their activities and for operating first-line controls. Compliance and risk functions provide oversight and challenge, while internal audit independently assesses the framework.

Correct answer: Because local teams implement controls and must know escalation routes and accountability. A clear field-level structure translates central requirements into daily processes, identifies local accountable persons and defines reporting/escalation. It should maintain consistency with central policy and applicable law.

Correct answer: Assign an owner, map affected processes, communicate requirements and track implementation across functions. Regulatory change management needs cross-functional impact assessment, clear ownership, revised procedures and systems, staff communication, deadlines and evidence of implementation. Compliance coordinates and challenges, but affected functions must execute required changes.

Correct answer: Controls provide reasonable assurance and should be monitored for design and operating effectiveness. Internal controls reduce risk to an acceptable level but cannot guarantee elimination of all errors, fraud or non-compliance. Their design and operating effectiveness must be assessed and improved as risks evolve.

Correct answer: A confirmed or suspected instance of non-adherence to a legal, regulatory, policy or code requirement. A compliance issue is an identified concern, breach, gap or potential failure requiring assessment and, where necessary, remediation. Compliance risk is the possibility of sanctions, loss or reputational damage arising from such failures.

Correct answer: Both inherent risk and the likelihood of residual compliance risk may be high. Inherent risk arises from the activity before controls are considered. Weak controls increase the portion of that exposure that remains as residual risk. A robust assessment considers both the nature of the activity and the effectiveness of controls.

Correct answer: Identify systemic causes such as unclear ownership, data delays or inadequate systems and fix them. Recurring failures often indicate process or governance weaknesses rather than a single individual error. Root-cause analysis should examine ownership, data lineage, systems, staffing, procedures and review controls, followed by tracked remediation.