1 Identifying Compliance Requirements Online Quiz Questions

True

False

Apply the rule to every entity in the industry because it is common in that sector.

Treat the rule as applicable whenever it is mentioned in a checklist.

Check whether the rule covers the entity, activity, location, or other relevant subject and whether its conditions are met.

Assume the rule applies unless the organization finds an explicit exemption.

The required action or prohibition

A general description of the organization’s industry

Any applicable threshold or required outcome

A prediction of whether regulators will investigate

The responsible party and applicable deadline or frequency

The triggering event and any required records or notifications

Applicable exceptions

Apply the clause to every customer because the supplier has one customer contract.

Record the clause and its trigger for that agreement, and check other agreements separately.

Replace the clause with the supplier’s usual practice.

Treat the clause as an industry-wide legal rule.

True

False

Enacted legal texts and official government publications

An unverified summary copied between websites

Fully executed contracts and amendments

The approved internal policy repository

An informal checklist with no cited authority

The inventory alone is a final legal determination.

Every listed item must apply to every entity in the organization.

The team should discard the inventory because it cannot support analysis.

The inventory supports analysis, while uncertain or high-impact interpretations may need appropriate escalation.

Use any version found on a shared drive because internal policies are always current.

Treat the policy as a replacement for any conflicting law or contract.

Confirm the approved current version, owner, audience, scope, and exceptions process.

Check only whether the policy title resembles the requirement being assessed.

True

False

Treat the policy as overriding the external requirement because it is the organization’s current rule.

Apply whichever requirement is easier to meet until the next scheduled review.

Escalate the conflict or gap for resolution; the policy does not replace the law or contract.

Remove the external requirement from the inventory because the policy already addresses the topic.

Limit the assessment to the legal entity’s headquarters, since other locations are separate from the main organization.

Define the entities, locations, activities, people, systems, and relationships under review, then adjust the boundary when evidence warrants it.

Include every entity and relationship that could possibly be associated with the organization, without recording exclusions or uncertainties.

Set the boundary by listing only the laws already known to apply, then search for activities that match them.

Use the summary to locate the candidate requirement, then check its status and important details against the underlying authority.

Treat any detailed industry summary as binding if it describes the requirement confidently.

Prefer a search result over an official publication because it is easier to interpret.

Rely on a summary alone whenever it cites a government source.

Apply the agreement’s notification deadline to every customer, then update the register if a customer objects.

Record only that a security incident requires customer notification, since the details can be found in the agreement later.

Record the deadline and response team, but omit the clause and trigger to keep the register concise.

Record the exact clause, incident trigger, deadline, responsible response team, and evidence of notification; do not extend the obligation to other customers without matching terms.