3 Assessing Compliance Online Quiz Questions

True or false: If an obligation’s applicability is uncertain, an assessor should treat the interpretation as settled so testing can proceed.

An assessor wants to determine whether a system block prevents vendor approval until screening is complete. The assessor runs a controlled approval scenario to see whether the block works. Which assessment method is being used?

What term describes assessing whether a control could address a risk if it were performed as intended?

When evaluating records as evidence, which qualities should an assessor consider? Select all that apply.

An assessor selects high-risk vendor files and exception cases rather than using a statistical sampling design. If the assessor finds a problem, what is the most supportable approach to reporting the result?

True or false: A missing record necessarily proves that the underlying control activity never occurred.

What is the assessment practice called when an assessor compares a system report with underlying records or observations to strengthen support for a significant finding?

A vendor approval control was assessed as appropriately designed and capable of blocking approval before screening. During the assessment period, records showed that the control was inconsistently performed or bypassed, and some approvals occurred before screening. Which aspect of the control does this evidence primarily call into question?

True or false: If some elements of a requirement were met but a material gap remains, the result may be classified as partially compliant.

You are assessing whether a high-risk vendor screening control operated during a period with many onboardings. Describe a defensible procedure for selecting and testing vendor files, evaluating discrepancies, and limiting your conclusion to what the evidence supports.

A significant finding reveals that vendor screening is often completed after approval because responsibilities are unclear. Which recommendation best supports effective remediation?

A control owner describes how vendor screening should work, but the assessment must determine whether screening actually occurred consistently. What is the best next step?

Which assessment method involves exercising a control or comparing actual results with expected results? Enter the method as one word.

An assessor is evaluating a control intended to prevent vendor onboarding before screening. Which approach correctly distinguishes assessing the control’s design from assessing its operation?

While establishing assessment criteria, the team finds a regulatory requirement whose applicability to one business unit is uncertain. What should the team do?

Evidence and access are insufficient to determine whether a control met its criteria. What conclusion category should the assessor use? Enter the category exactly as stated in the material.

A system report used as evidence for a significant finding does not match the underlying records. What is the most appropriate assessment response?

An organization is deciding which obligations and controls deserve more extensive testing. Select all factors that should inform its risk-based priorities.