CAIIB Paper 4 Module A Quiz 3

A structured process identifies changes, determines applicability, maps impacted products and controls, assigns accountability, implements updates and tests whether changes are effective.

A reliable audit trail supports accountability, supervisory review, incident investigation and consistent implementation. Documentation evidences the process but does not make an unlawful decision valid.

RBI has a statutory regulatory framework for NBFCs, with requirements depending on the entity‘s category and activities. NBFCs are not automatically banks and generally cannot accept demand deposits.

Banks and NBFCs have different legal status and permissions. Their permitted activities, deposit-taking capacity and payment-system access depend on their respective laws and regulatory authorisations.

Registration and permission to accept deposits are not interchangeable. The entity‘s exact regulatory status, activity and applicable statutory restrictions must be checked.

Co-operative banks can be subject to a framework involving RBI‘s banking powers and other authorities for co-operative matters, depending on the institution and applicable law.

Products may engage multiple legal regimes. Correctly identifying jurisdiction helps the bank meet the relevant authorisation, conduct, prudential, disclosure and reporting requirements.

Least-privilege access, individual credentials, monitoring, training and escalation reduce misuse risk and help establish accountability. Shared logins undermine traceability.

A major outage requires incident management, continuity arrangements, root-cause investigation, customer communication and regulatory reporting where applicable. Logs and evidence should be preserved.

Clear and timely disclosures help customers understand rates, charges, conditions and risks. Banks should use prescribed formats and channels and retain evidence of disclosure where required.

Vendor selection should include due diligence, risk assessment, contractual safeguards, data handling terms, incident duties, audit rights and continuity planning.

Compliance helps manage adherence to obligations, while internal audit independently evaluates controls and governance under its mandate. Their coordination should preserve appropriate independence.

Sustainable remediation addresses why the failure occurred, not just the individual event. Controls should be implemented, tested and monitored to verify that recurrence risk has fallen.

Risk appetite connects strategy with risk-taking boundaries. It informs limits, monitoring and escalation; it does not replace prudential requirements or sound controls.

Repeated limit breaches may indicate poor controls, unrealistic limits or excessive risk-taking. They require transparent escalation, investigation and remediation rather than concealment.

Preventive controls aim to stop an error or breach before it occurs. System validation can block incomplete transactions, while reviews and reports are generally detective or corrective.

Detective controls identify events that have already occurred or are in progress. Exception reports help identify unusual or non-compliant transactions for investigation.

Separating initiation, authorisation, custody and reconciliation creates checks and reduces opportunities for error or fraud to pass undetected.

A delegation matrix establishes approval powers and thresholds, supports segregation of duties and helps ensure decisions are made by authorised personnel.

Misleading communications can create conduct and legal risk. The bank should stop or correct the statement, assess harm, provide appropriate remediation and strengthen review controls.