CAIIB Paper 1 Module D Quiz 3

Correct answer: Unusual transaction patterns, repeated control overrides and unexplained reconciliation differences. Anomalies such as unusual patterns, overrides, unexplained differences, duplicate payments or inconsistent documents may indicate elevated fraud risk. They are indicators requiring examination, not conclusive proof of fraud.

Correct answer: Introduce independent verification by separating initiation and authorisation. Maker-checker separates transaction initiation from review or authorisation, reducing the chance that one person can commit and conceal an unauthorised transaction. It is most effective when combined with role-based access and monitoring.

Correct answer: Ensure appropriate confidential escalation and an impartial, evidence-based assessment. The report should be handled through authorised confidential channels, assessed impartially and investigated proportionately. Relevant records should be preserved, retaliation prevented and findings documented. An allegation is not proof, and denial alone is not dispositive.

Correct answer: Escalate promptly through defined channels, contain the issue and document remediation. Material breaches require timely escalation under internal policy and any applicable regulatory reporting obligation. The response should contain harm, preserve records, identify root cause, assign remediation and track closure.

Correct answer: To record applicable changes, impact assessment, accountable owners, deadlines and implementation status. A change register creates traceability from a new or amended requirement to impact assessment, assigned actions, implementation evidence and closure. It helps prevent changes from being missed across affected functions.

Correct answer: Timeliness of remediation, repeat findings, overdue actions and control effectiveness. Outcome-oriented indicators reveal whether controls are working and whether issues are being resolved. Policy counts or communication volumes are activity measures and do not by themselves demonstrate compliance effectiveness.

Correct answer: Reflect it as a mandatory obligation; risk appetite cannot authorise a breach of law. Risk appetite is not permission to disregard statutory or regulatory obligations. Management can decide how to manage lawful business risks within approved limits, but it cannot authorise non-compliance with mandatory requirements.

Correct answer: Material breaches, emerging risks, significant regulatory changes, repeat issues and remediation status. Board-level reporting should be concise but sufficient to support oversight, including material incidents, trends, emerging risks, significant regulatory changes, overdue remediation and systemic control weaknesses.

Correct answer: Self-review threat that may impair objectivity. Designing a control and then independently auditing it creates a self-review threat. Appropriate safeguards or alternative arrangements are needed so assurance remains objective and does not become an assessment of one‘s own work.

Correct answer: Build regulatory obligations and controls into the process from the planning and design stage. Compliance by design incorporates legal requirements, disclosures, consent, recordkeeping, access controls and monitoring into the product or process from the outset. Retrofitting controls after launch can be more costly and leave exposures unaddressed.

Correct answer: Dated transaction samples, system logs, approvals and documented test results appropriate to the control. Operating effectiveness needs evidence that the control actually operated during the period, such as samples, logs, approvals and exception handling. A policy shows intended design, not necessarily execution.

Correct answer: Rationale, approver, scope, duration, compensating controls and review or expiry date, where legally permissible. Exception governance requires transparency, authorised approval, clear scope and duration, rationale, compensating controls and periodic review. No internal exception can waive a mandatory legal requirement.

Correct answer: Assess lawful basis, purpose limitation, security, contractual safeguards and applicable outsourcing/privacy rules. Outsourcing does not remove the bank‘s obligations concerning confidentiality, security and applicable data-protection or regulatory requirements. The bank should assess purpose, permitted sharing, minimisation, safeguards, access, contracts and monitoring.

Correct answer: When material changes occur in products, law, technology, business model or control performance, and at planned intervals. Compliance risk is dynamic. Assessments should be updated periodically and when significant triggers arise, including new regulation, products, incidents, acquisitions, technology changes, control failures or changes in customer and transaction patterns.

Correct answer: Relevant business lines, products, support functions, locations, systems and material third parties based on risk. The audit universe should cover activities that can create material compliance exposure, including products, channels, support functions, locations, systems and relevant outsourced activities. Risk assessment determines priority and frequency.

Correct answer: It encourages early reporting of concerns that might otherwise remain hidden. Fear of retaliation suppresses reporting and allows issues to persist. Protection supports early detection, but reports still require impartial assessment and appropriate evidence; protection is not a presumption that allegations are proven.

Correct answer: Fraud classification requires assessment of facts and intent under applicable definitions; errors and system failures may have different causes. An operational loss may result from error, process failure, external events or intentional misconduct. Correct classification supports appropriate reporting, investigation, accountability and prevention. Applicable RBI directions and legal definitions must be followed.

Correct answer: Segregate duties, enforce access controls, reconcile independently and monitor exceptions. Segregation of duties, individual user IDs, access reviews, independent reconciliation and exception monitoring reduce opportunities to commit and conceal fraud. No single measure is sufficient on its own.

Correct answer: Source data is reconciled, definitions are applied consistently, review is documented and submission deadlines are met. Reliable regulatory reporting depends on controlled data sources, consistent definitions, reconciliations, validation, documented review, accountability and timely submission. Unsupported estimates or copy-forward errors can create regulatory and reputational risk.

Correct answer: Assess capacity and skills, prioritise risk, escalate resource constraints and agree a documented remediation plan. The function needs sufficient resources, skills, access and authority proportionate to the bank‘s size, complexity and risk profile. Material capacity constraints should be transparently escalated and managed, not silently accepted.