CAIIB Paper 1 Module D Quiz 2

Correct answer: It provides objective evidence about whether compliance controls work as intended. Independent testing challenges self-assessments and checks whether controls are suitably designed and operating effectively. Findings should feed into remediation, risk assessment and reporting; it complements rather than replaces daily controls.

Correct answer: Employees can explain requirements, controls operate in practice and issues are escalated and fixed. Good compliance is demonstrated by behaviour, effective controls, transparent escalation, timely remediation and reliable evidence. Absence of detected penalties is not proof of compliance because failures may remain undiscovered.

Correct answer: Governance, Risk and Compliance. GRC integrates governance, risk management and compliance activities so that responsibilities, risks, controls and reporting are aligned. Integration can reduce duplication and provide management with a consolidated view of exposure.

Correct answer: Leaders visibly follow rules, support escalation and hold people accountable fairly. Culture is shaped by leadership example, incentives, accountability, training and whether staff can raise concerns without retaliation. Commercial targets should not encourage breaches or concealment.

Correct answer: Confidential reporting channels, protection against retaliation and a fair investigation process. A well-designed policy provides accessible and confidential channels, safeguards against retaliation, impartial assessment, documentation and appropriate escalation. Allegations must be investigated fairly; reporting does not itself prove wrongdoing.

Correct answer: Conflicting incentives, unclear accountability and weak monitoring. Failures often arise from unclear accountability, poor tone at the top, inadequate training, fragmented processes, weak monitoring, unrealistic targets or ineffective escalation. Effective controls and timely remediation reduce these vulnerabilities.

Correct answer: A consolidated view of risks, controls, accountability and reporting. An integrated approach can align risk taxonomies, control libraries, reporting and ownership, improving visibility and reducing duplicated effort. It does not eliminate the need for governance, independent assurance or regulatory scrutiny.

Correct answer: Role-based training, updated for regulatory changes, with assessment and completion tracking. Training should be proportionate to roles and risks, updated when requirements change, supported by practical examples and tested for understanding. Completion records and follow-up help demonstrate coverage and identify knowledge gaps.

Correct answer: Base, Middle, Upper and Top Layers. The RBI‘s scale-based regulatory framework uses Base Layer, Middle Layer, Upper Layer and Top Layer. Regulatory intensity increases with size, activity, complexity and systemic significance; the Top Layer is intended for entities identified as warranting the highest intensity of regulation.

Correct answer: NBFCs in the specified Upper Layer and Middle Layer categories covered by RBI directions. RBI directions prescribe a compliance function and CCO framework for specified NBFC categories, notably NBFC-Upper Layer and NBFC-Middle Layer as covered by the applicable directions. Applicability should always be checked against the current RBI circular and the entity‘s classification.

Correct answer: To protect the role‘s ability to raise compliance concerns independently. Appointment, status, reporting and removal safeguards help preserve the CCO‘s independence and effectiveness. Exact eligibility, tenure and reporting provisions depend on the applicable RBI directions and should be checked in their current form.

Correct answer: Assess applicability and transition requirements under the current RBI framework and implement a documented compliance plan. A change in regulatory layer can trigger different governance, risk management and compliance requirements. The NBFC should confirm its classification, review applicable directions and transition provisions, assign owners and document timely implementation rather than assume a universal grace period.

Correct answer: Fraud involves intentional deception or concealment for an improper benefit or to cause wrongful loss. Fraud generally involves intentional deception, concealment or abuse to secure an improper benefit or cause wrongful loss. Errors can occur without intent. Classification and reporting must follow applicable legal definitions and current regulatory directions.

Correct answer: Forgery or use of a forged instrument, subject to applicable law and facts. Forgery generally concerns making a false document or electronic record with the intent required by law; using it may also attract liability. The exact offence depends on facts and the applicable statutory provisions.

Correct answer: To identify patterns, meet reporting obligations, support investigation and track corrective action. A structured system records incidents, supports classification and regulatory reporting, enables trend analysis, assigns investigation and remediation actions, and preserves an audit trail. Suspicion must be assessed fairly and reported in line with applicable requirements.

Correct answer: Promptly follow the bank‘s incident, customer-protection, dispute and reporting procedures while securing relevant evidence. The bank should act promptly under applicable RBI customer-liability directions and internal procedures, secure evidence, investigate, block or protect compromised access where appropriate, and provide complaint escalation. Liability and reimbursement depend on facts and the applicable rules.

Correct answer: Preventing, detecting and addressing misconduct and corruption risks under the applicable vigilance framework. Vigilance helps promote integrity, deter misconduct and examine potential corruption or related irregularities under the bank‘s applicable framework. Its remit and procedures differ from ordinary business management and do not replace criminal investigation or judicial processes.

Correct answer: Reviewing control weaknesses and improving procedures before another incident occurs. Preventive vigilance focuses on reducing opportunities for misconduct through sound processes, segregation of duties, training, transparent procedures and control improvements. It differs from detective or punitive action after an incident.

Correct answer: It can create authority, conflict-of-interest and override risks if limits and controls are unclear. Delegation supports operational efficiency but introduces risk if authority limits, dual controls, documentation, conflict checks and monitoring are weak. Delegated officials remain accountable for decisions and must act within approved powers.

Correct answer: Preserve logs and records with controlled access and a documented chain of custody. Evidence should be preserved in a reliable, access-controlled manner with timestamps, audit trails and chain-of-custody documentation. Altering or casually sharing evidence can compromise investigation, privacy and legal defensibility.