CAIIB Paper 4 Module A Quiz 10

Time limit: 0

0 of 20 questions completed

Questions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Information

Questions: 20

You have already completed the Test before. Hence you can not start it again.

Test is loading...

You must sign in or sign up to start the Test.

You have to finish following quiz, to start this Test:

Your results are here!! for" CAIIB Paper 4 Module A Quiz 10 "

0 of 20 questions answered correctly

Your time:

Time has elapsed

Your Final Score is : 0
You have attempted : 0
Number of Correct Questions : 0 and scored 0
Number of Incorrect Questions : 0 and Negative marks 0

Not categorized
You have attempted: 0
Number of Correct Questions: 0 and scored 0
Number of Incorrect Questions: 0 and Negative marks 0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Answered
Review

Question 1 of 20

1. Question
Which statement about compliance with laws governing a bank‘s board composition is correct?
- Board composition is entirely a matter of informal preference
- The bank must comply with applicable statutory and regulatory requirements for composition, qualifications and appointments
- A shareholder vote can waive every statutory condition
- Board requirements apply only to public-sector banks
Correct

Board composition and appointments may be subject to legal and regulatory criteria. The bank must assess the provisions applicable to its category and current circumstances.

Incorrect

Board composition and appointments may be subject to legal and regulatory criteria. The bank must assess the provisions applicable to its category and current circumstances.

Unattempted

Board composition and appointments may be subject to legal and regulatory criteria. The bank must assess the provisions applicable to its category and current circumstances.
Question 2 of 20

2. Question
What is the best response if a regulatory obligation has no clear owner after a reorganisation?
- Leave it unassigned until an inspection
- Assign accountable ownership promptly, clarify supporting roles and review impacted controls
- Assume the former owner remains responsible forever
- Delete it from the register
Correct

Organisational changes can create ownership gaps. Assigning a clear owner and reviewing the associated process prevents obligations from being missed during transition.

Incorrect

Organisational changes can create ownership gaps. Assigning a clear owner and reviewing the associated process prevents obligations from being missed during transition.

Unattempted

Organisational changes can create ownership gaps. Assigning a clear owner and reviewing the associated process prevents obligations from being missed during transition.
Question 3 of 20

3. Question
Why is it important to distinguish a confirmed breach from a potential breach in reporting?
- Potential breaches should never be recorded
- Clear status labels support proportionate escalation while preserving the need to investigate and update conclusions
- Every suspicion must be reported as a proven violation
- Status can be changed without evidence
Correct

Accurate classification avoids overstating or understating incidents. Potential breaches should be investigated and updated as evidence develops, with urgent escalation when risk warrants it.

Incorrect

Accurate classification avoids overstating or understating incidents. Potential breaches should be investigated and updated as evidence develops, with urgent escalation when risk warrants it.

Unattempted

Accurate classification avoids overstating or understating incidents. Potential breaches should be investigated and updated as evidence develops, with urgent escalation when risk warrants it.
Question 4 of 20

4. Question
Which statement about the regulator‘s supervisory role is correct?
- Supervision guarantees every institution‘s survival
- Supervision seeks to assess and influence safe, sound and compliant operation but cannot eliminate all risk
- Supervision replaces all board duties
- Supervision applies only after a bank fails
Correct

Supervision is an important safeguard, but it does not guarantee that a bank will never fail or remove the responsibility of directors and management to manage the institution.

Incorrect

Supervision is an important safeguard, but it does not guarantee that a bank will never fail or remove the responsibility of directors and management to manage the institution.

Unattempted

Supervision is an important safeguard, but it does not guarantee that a bank will never fail or remove the responsibility of directors and management to manage the institution.
Question 5 of 20

5. Question
Which action is most appropriate when a bank‘s internal compliance policy is stricter than the minimum legal requirement?
- Automatically weaken it to the legal minimum
- Follow the approved stricter policy unless law or authorised governance requires a change, while ensuring it remains practical and lawful
- Ignore it because it is not law
- Let customers opt out of it informally
Correct

Banks may adopt stricter internal controls than the legal minimum. Staff should follow approved policy unless it is lawfully changed through governance; stricter policy cannot itself authorise unlawful conduct.

Incorrect

Banks may adopt stricter internal controls than the legal minimum. Staff should follow approved policy unless it is lawfully changed through governance; stricter policy cannot itself authorise unlawful conduct.

Unattempted

Banks may adopt stricter internal controls than the legal minimum. Staff should follow approved policy unless it is lawfully changed through governance; stricter policy cannot itself authorise unlawful conduct.
Question 6 of 20

6. Question
Which of the following best describes the goal of regulatory compliance in banking?
- To maximise sales regardless of conduct
- To ensure the bank‘s activities adhere to applicable laws and directions while protecting customers and supporting sound operations
- To eliminate all business judgement
- To guarantee zero operational risk
Correct

Compliance seeks adherence to applicable obligations and supports customer protection, sound governance and trust. It cannot guarantee zero risk, but it helps prevent and manage regulatory failures.

Incorrect

Compliance seeks adherence to applicable obligations and supports customer protection, sound governance and trust. It cannot guarantee zero risk, but it helps prevent and manage regulatory failures.

Unattempted

Compliance seeks adherence to applicable obligations and supports customer protection, sound governance and trust. It cannot guarantee zero risk, but it helps prevent and manage regulatory failures.
Question 7 of 20

7. Question
A bank is reviewing RBI licensing policy for universal banks. What should the bank do first?
- Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 8 of 20

8. Question
A bank is reviewing RBI licensing policy for universal banks. Which approach is compliant?
- Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 9 of 20

9. Question
A bank is reviewing RBI licensing policy for universal banks. What is the main risk of ignoring this requirement?
- The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 10 of 20

10. Question
A bank is reviewing RBI licensing policy for universal banks. What is the best governance response?
- Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 11 of 20

11. Question
A bank is reviewing RBI licensing policy for universal banks. Which evidence would best support compliance?
- Current authoritative requirements, documented applicability analysis, approvals, implementation evidence and periodic review records.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Current authoritative requirements, documented applicability analysis, approvals, implementation evidence and periodic review records. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Current authoritative requirements, documented applicability analysis, approvals, implementation evidence and periodic review records. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Current authoritative requirements, documented applicability analysis, approvals, implementation evidence and periodic review records. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 12 of 20

12. Question
A bank is reviewing RBI licensing policy for universal banks. How should uncertainty be handled?
- Escalate to the bank‘s compliance/legal function and seek authoritative clarification where appropriate rather than assume an exemption.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Escalate to the bank‘s compliance/legal function and seek authoritative clarification where appropriate rather than assume an exemption. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Escalate to the bank‘s compliance/legal function and seek authoritative clarification where appropriate rather than assume an exemption. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Escalate to the bank‘s compliance/legal function and seek authoritative clarification where appropriate rather than assume an exemption. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 13 of 20

13. Question
A bank is reviewing RBI licensing policy for universal banks. What should happen after a rule changes?
- Assess the amendment and effective date, update policies and systems, communicate changes and test implementation.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assess the amendment and effective date, update policies and systems, communicate changes and test implementation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assess the amendment and effective date, update policies and systems, communicate changes and test implementation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Assess the amendment and effective date, update policies and systems, communicate changes and test implementation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 14 of 20

14. Question
A bank is reviewing RBI licensing policy for universal banks. What should the board or senior management receive?
- Material impact, risks, accountable owners, required decisions, deadlines and evidence of remediation.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Material impact, risks, accountable owners, required decisions, deadlines and evidence of remediation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Material impact, risks, accountable owners, required decisions, deadlines and evidence of remediation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Material impact, risks, accountable owners, required decisions, deadlines and evidence of remediation. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 15 of 20

15. Question
A bank is reviewing RBI licensing policy for universal banks. What should be avoided?
- Commencing activity before required permission, relying on informal assurances or treating internal policy as overriding law.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Commencing activity before required permission, relying on informal assurances or treating internal policy as overriding law. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Commencing activity before required permission, relying on informal assurances or treating internal policy as overriding law. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Commencing activity before required permission, relying on informal assurances or treating internal policy as overriding law. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 16 of 20

16. Question
A bank is reviewing RBI licensing policy for universal banks. How should the control be sustained?
- Use documented procedures, staff training, monitoring, exception escalation and evidence-based testing.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Use documented procedures, staff training, monitoring, exception escalation and evidence-based testing. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Use documented procedures, staff training, monitoring, exception escalation and evidence-based testing. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

An applicant seeking to establish a universal bank should first demonstrate compliance with the applicable RBI licensing framework, including eligibility and fit-and-proper conditions. Use documented procedures, staff training, monitoring, exception escalation and evidence-based testing. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 17 of 20

17. Question
A bank is reviewing small finance bank licensing. What should the bank do first?
- Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Identify the exact legal provision and current RBI direction, assess applicability and document the required approvals or controls. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 18 of 20

18. Question
A bank is reviewing small finance bank licensing. Which approach is compliant?
- Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Follow the applicable statutory and regulatory framework, obtain required approval before acting and retain evidence. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 19 of 20

19. Question
A bank is reviewing small finance bank licensing. What is the main risk of ignoring this requirement?
- The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. The bank may breach a binding obligation and face supervisory action, remediation duties, customer impact or reputational harm. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.
Question 20 of 20

20. Question
A bank is reviewing small finance bank licensing. What is the best governance response?
- Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance.
- Proceed based only on the business unit‘s preference and document the decision later.
- Assume the requirement does not apply unless a penalty has previously been imposed.
- Allow each branch to use a different interpretation without central review.
Correct

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Incorrect

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.

Unattempted

A small finance bank applicant must satisfy the applicable RBI licensing conditions and operate within the permissions and restrictions attached to that licence. Assign an accountable owner, obtain legal/compliance input where needed, document the decision and monitor ongoing compliance. Internal preferences or past enforcement history do not displace applicable law. A documented, risk-based approach supports consistent implementation and auditability.