Business Law, Intellectual Property, and Ethical Regulation

Introduction

Business ethics is not separate from law. Law establishes minimum standards of conduct, while ethics asks whether conduct is fair, responsible, transparent, and respectful of stakeholders even when a legal rule is incomplete or enforcement is unlikely. For managers, the central challenge is therefore not simply to avoid prosecution. It is to design decisions, controls, incentives, and relationships that satisfy legal duties and withstand ethical scrutiny.

This chapter examines the legal and regulatory dimensions of business ethics through four connected areas: business laws concerning corruption, money laundering, and consumer protection; intellectual property rights and their ethical use; compliance-program design and implementation; and national and international regulatory frameworks. Because legal rules differ across jurisdictions, the chapter presents general principles rather than jurisdiction-specific legal advice. Managers must consult applicable statutes, regulators, courts, professional advisers, and internal legal counsel before acting.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain how law and ethics interact in managerial decision-making.
2. Interpret the ethical significance of anti-corruption, anti-money-laundering, and consumer-protection requirements.
3. Evaluate intellectual property rights and distinguish lawful ownership from ethically responsible use.
4. Design the principal elements of a risk-based ethical compliance programme.
5. Compare national and international standards and apply them to cross-border business conduct.
6. Critically assess corporate accountability and responsible market conduct in practical situations.

1. Law, Ethics, and Corporate Accountability

1.1 Law as a minimum standard and governance mechanism

Business law consists of enforceable rules governing relationships among firms, governments, investors, employees, consumers, and other parties. Ethical regulation includes statutes, regulations, licensing conditions, administrative guidance, judicial decisions, professional codes, and widely accepted standards of responsible conduct.

Legal compliance generally answers the question: “What conduct is permitted or prohibited?” Ethical analysis asks broader questions:

• Who may be harmed or benefited?
• Is the conduct honest and non-deceptive?
• Is power being used fairly?
• Would the decision remain defensible if publicly disclosed?
• Does the conduct respect the purpose, rather than merely the wording, of the rule?

A legally permissible practice may nevertheless be unethical. For example, a company may disclose a material fee in extremely small print and technically satisfy a disclosure rule while deliberately exploiting consumer inattention. Conversely, an ethical objective cannot normally justify violating a valid law. Responsible managers seek alignment among legal compliance, stakeholder protection, and organisational values.

1.2 Corporate accountability

Corporate accountability is the obligation of an organisation and its decision-makers to explain, justify, and accept consequences for corporate conduct. It includes accountability to regulators, owners, employees, customers, suppliers, communities, and affected third parties. Accountability is strengthened by:

• clearly allocated responsibilities;
• accurate records and auditable decisions;
• board oversight of significant legal and ethical risks;
• independent investigation of allegations;
• proportionate discipline and remediation; and
• transparent communication about material failures.

A corporation acts through people and systems. The fact that an unlawful or unethical act was committed by an employee does not automatically eliminate organisational responsibility. Boards and senior managers may be accountable where they authorised misconduct, ignored warning signs, created unreasonable incentives, or failed to establish appropriate controls.

2. Anti-Corruption and Responsible Market Conduct

2.1 Meaning and forms of corruption

Corruption is the misuse of entrusted power for private or improper advantage. Bribery is a central form of corruption and involves offering, promising, giving, requesting, or accepting something of value to influence a decision improperly. The benefit may be money, gifts, travel, employment, a charitable donation, a political contribution, preferential treatment, or a benefit to a relative or associate.

Corruption can be active or passive. Active bribery involves offering or giving an improper advantage; passive bribery involves requesting or receiving one. It can also be direct or indirect. A company may be exposed when an agent, consultant, distributor, or joint-venture partner makes an improper payment on its behalf.

Not every payment to a public official is automatically unlawful in every jurisdiction. However, so-called facilitation payments, excessive hospitality, political contributions, charitable donations, and recruitment of connected persons present serious risks. The relevant questions include the recipient’s role, the purpose and timing of the benefit, its value, transparency, business justification, and whether it is intended to influence a decision.

2.2 Ethical risks in anti-corruption compliance

Anti-corruption law reflects principles of fairness, impartiality, and public trust. Corruption distorts competition, increases transaction costs, diverts public resources, and can produce unsafe or inferior goods and services. It also creates a culture in which employees believe that results matter more than integrity.

A robust policy should address:

• gifts, hospitality, travel, and entertainment;
• dealings with public officials and state-owned enterprises;
• political and charitable contributions;
• conflicts of interest and nepotism;
• third-party due diligence;
• accurate books and records; and
• reporting, investigation, and non-retaliation.

A common managerial failure is to treat anti-corruption compliance as a limit on sales rather than as a condition of sustainable competition. Commercial targets should never reward employees for achieving revenue through concealed payments or misleading representations.

2.3 Books, records, and internal controls

Anti-corruption regimes commonly require accurate accounting records and adequate internal controls. A bribe disguised as “consulting fees,” “marketing expenses,” or “commissions” is both a corruption problem and a financial-reporting problem. Controls should ensure that payments have a legitimate purpose, an identifiable recipient, appropriate approval, and supporting documentation.

Red flags include unusually high commissions, vague services, requests for cash, offshore accounts without commercial justification, refusal to disclose ownership, and insistence on using a particular intermediary. A red flag is not proof of misconduct, but it requires documented assessment and, where appropriate, enhanced investigation.

3. Anti-Money Laundering and Countering Illicit Finance

3.1 Concept and stages

Money laundering is the process of disguising the criminal origin of proceeds so that they appear legitimate. It is often described through three overlapping stages:

1. Placement: introducing illicit proceeds into the financial or commercial system.
2. Layering: conducting transactions designed to obscure the origin, ownership, or movement of the funds.
3. Integration: reintroducing the funds into the economy as apparently legitimate wealth.

The stages are analytical rather than mandatory. A transaction may involve only some of them, and digital assets, trade-based schemes, shell companies, real estate, luxury goods, and complex corporate structures can be used in different combinations.

3.2 Core AML controls

Anti-money-laundering programmes generally require a risk-based approach. This means allocating stronger controls to relationships and transactions presenting greater risk rather than applying identical procedures to every customer.

Important controls include:

• customer identification and verification;
• understanding the customer’s business and expected activity;
• identifying beneficial owners, meaning the natural persons who ultimately own or control an entity;
• screening against relevant sanctions and politically exposed-person databases, as legally required;
• transaction monitoring;
• escalation and reporting of suspicious activity to the competent authority;
• employee training; and
• retention of records for the legally prescribed period.

Customer due diligence is not a one-time formality. A customer’s ownership, geography, products, transaction patterns, and risk profile can change. Ongoing monitoring should identify activity inconsistent with the stated purpose of the relationship.

3.3 Ethical tensions in AML

AML controls can conflict with customer convenience, privacy, financial inclusion, and commercial speed. A bank or platform that rejects customers solely because they come from a high-risk region may commit unfair discrimination or exclude legitimate businesses. On the other hand, ignoring risk indicators may facilitate serious crime. Ethical implementation requires proportionality, documented reasoning, secure handling of personal data, human review of automated alerts, and accessible procedures for correcting errors.

Managers should distinguish confidentiality from secrecy. Confidentiality protects sensitive information and lawful reporting processes; secrecy intended to conceal wrongdoing undermines both law and ethics. Staff must also understand that filing a suspicious-activity report, where legally required, must be handled according to applicable confidentiality rules and must not become a tool for retaliation or commercial sabotage.

4. Consumer Protection and Responsible Market Conduct

4.1 Purpose and scope

Consumer-protection law seeks to correct information and power asymmetries between businesses and consumers. It commonly addresses product safety, unfair contract terms, misleading advertising, defective goods, privacy, distance selling, digital commerce, refunds, warranties, and complaint handling.

Consumer protection is ethically significant because consumers may lack the expertise, bargaining power, time, or information needed to evaluate an offer. Ethical market conduct therefore requires more than formal disclosure. Information should be accurate, material, understandable, timely, and presented in a way that does not manipulate reasonable consumers.

4.2 Deception, omission, and dark patterns

Misleading conduct may arise from a false statement, an exaggerated claim, selective disclosure, or omission of a material fact. A technically true statement can still mislead if its overall presentation creates a false impression. Claims about health, environmental performance, performance outcomes, scarcity, rankings, and endorsements require especially careful substantiation.

Digital interfaces can create “dark patterns”: design choices that steer users toward decisions they would not otherwise make, such as preselected add-ons, difficult cancellation, confusing consent screens, or countdown timers that reset repeatedly. These practices may raise legal concerns and are ethically problematic because they exploit cognitive biases rather than support informed choice.

4.3 Product safety, privacy, and vulnerable consumers

Businesses have responsibilities to design, test, label, monitor, and recall products where safety risks arise. They should investigate complaints and near misses rather than waiting for regulatory enforcement. Vulnerable consumers—including children, elderly persons, financially distressed customers, and persons with disabilities—may require enhanced safeguards.

Consumer data should be collected for legitimate, communicated purposes and protected against unauthorised access. Consent should not be treated as ethically sufficient where it is coerced, bundled, incomprehensible, or obtained through deceptive design. Managers must reconcile consumer-protection requirements with privacy, cybersecurity, and sector-specific obligations.

5. Intellectual Property Rights and Ethical Use

5.1 Principal forms of intellectual property

Intellectual property (IP) law protects certain creations, identifiers, and commercially valuable information. The main categories are:

The precise requirements, duration, exceptions, registration systems, and enforcement remedies vary by jurisdiction. Ownership may also be affected by employment contracts, commissioned work, assignment clauses, licenses, and joint development agreements.

5.2 Ethical use of IP

Legal ownership does not exhaust ethical analysis. A firm may hold a valid patent yet use it in a way that creates unjustified barriers to essential goods. A copyright owner may lawfully restrict copying but should consider accessibility, education, preservation, and fair remuneration. Ethical IP management considers innovation incentives, creator recognition, public benefit, competition, and access.

Key ethical duties include:

• obtaining permission before using protected material;
• respecting license conditions and attribution requirements;
• avoiding plagiarism and false claims of authorship;
• conducting clearance searches before adopting brands or designs;
• protecting confidential information received from partners or employees;
• avoiding misappropriation of competitors’ trade secrets; and
• maintaining accurate ownership records.

Open-source software illustrates the distinction between free access and unrestricted use. A permissive license may allow modification and commercial distribution subject to conditions such as attribution. A reciprocal or copyleft license may require distribution of derivative work under specified terms. Copying code without understanding its license can create legal exposure and violate the ethical principle of respecting contributors’ conditions.

5.3 IP, competition, and access

IP rights are intended to encourage creativity and investment, not to provide unlimited power to suppress competition. Licensing decisions should be assessed for exclusivity, territorial restrictions, tying, discriminatory terms, and effects on innovation. In sectors such as pharmaceuticals, information technology, and media, managers must weigh legitimate returns against access, interoperability, public health, and the risk of abusive market conduct.

Artificial intelligence creates additional challenges. Training data, generated outputs, model weights, confidential prompts, and proprietary datasets may involve copyright, trade-secret, privacy, or contractual rights. Organisations should document data provenance, assess licenses, prohibit uploading confidential third-party material into uncontrolled systems, and establish human review for high-impact outputs. The existence of an AI-generated result does not by itself answer who owns it or whether source materials were lawfully used.

6. Ethical Compliance Programmes

6.1 Purpose and design principles

An ethical compliance programme is an integrated system of policies, governance arrangements, controls, training, monitoring, reporting, investigation, and remediation designed to prevent, detect, and respond to misconduct. An effective programme is not a collection of documents. It is an organisational capability supported by leadership, resources, reliable information, and credible consequences.

The programme should be:

• risk-based: proportionate to the organisation’s sectors, jurisdictions, products, partners, and history;
• leadership-led: visibly supported by the board and senior executives;
• integrated: connected to strategy, incentives, procurement, finance, HR, information security, and operations;
• accessible: understandable to employees and relevant third parties; and
• continuously improved: adjusted in response to incidents, regulatory change, audits, and new technology.

6.2 Development cycle

A practical development cycle contains six linked stages.

Stage 1: Risk assessment. Identify legal and ethical risks, affected stakeholders, inherent risk, existing controls, residual risk, and risk owners. Methods may include interviews, transaction analysis, regulatory mapping, audits, scenario workshops, and review of past incidents.

Stage 2: Governance and policy. Allocate responsibility among the board, audit or risk committee, compliance function, legal department, business units, internal audit, and employees. Policies should explain prohibited conduct, approval requirements, escalation channels, and consequences.

Stage 3: Preventive controls. Use segregation of duties, approval thresholds, vendor screening, contract clauses, access controls, product review, advertising substantiation, IP registers, and training. Controls should be embedded in workflows rather than relying only on annual declarations.

Stage 4: Detection. Provide confidential reporting channels, data analytics, quality testing, transaction monitoring, audits, customer complaints, and management information. Whistleblowers need protection against retaliation and a reasonable expectation that reports will be handled fairly.

Stage 5: Response and remediation. Triage allegations, preserve evidence, investigate independently, protect due process, report where required, discipline consistently, compensate or remediate harm, and address root causes. A weak response can undermine an otherwise strong prevention system.

Stage 6: Evaluation and improvement. Test whether controls operate in practice, measure trends, review near misses, update risk assessments, and report material issues to governing bodies.

6.3 Measuring effectiveness

Counting policies issued or employees trained is insufficient. More meaningful indicators include completion and comprehension rates, time taken to resolve alerts, substantiated incidents by root cause, repeat findings, third-party review coverage, speak-up activity, retaliation allegations, customer complaints, and control-testing results. A rise in reports may indicate deterioration, but it may also show greater trust in reporting channels. Metrics require contextual interpretation rather than simplistic targets.

7. National and International Regulatory Frameworks

7.1 National frameworks

At national level, ethical regulation may be distributed across company law, criminal law, consumer law, competition law, securities regulation, tax law, data-protection law, IP statutes, financial-services rules, procurement requirements, and sector-specific licensing. Regulators may possess powers to investigate, inspect, compel information, impose administrative penalties, revoke licenses, refer cases for prosecution, or require remediation.

Managers should create a legal obligations register identifying the applicable rule, responsible owner, evidence of compliance, reporting deadline, and consequence of failure. This is especially important for multinational firms because a transaction may be subject to the law of the place of conduct, the place of incorporation, the location of affected consumers, or another jurisdiction with extraterritorial reach.

7.2 International standards and guidelines

International instruments promote consistency but do not automatically replace domestic law. Relevant examples include:

• the United Nations Convention against Corruption;
• the OECD Anti-Bribery Convention;
• the Financial Action Task Force recommendations on money laundering and terrorist financing;
• the World Trade Organization’s TRIPS Agreement on intellectual property standards; and
• the United Nations Guiding Principles on Business and Human Rights.

Management systems and voluntary guidance, including anti-bribery, compliance, risk-management, and social-responsibility standards, can help organisations structure controls. Certification may provide evidence of a management process, but it is not a guarantee that misconduct cannot occur and does not transfer accountability away from leadership.

7.3 Managing conflicts across borders

Cross-border operations create conflicts concerning data transfers, disclosure to investigators, sanctions, confidentiality, discovery, employment rights, and differing definitions of corruption or consumer rights. A sound approach is to identify the strictest applicable requirement where lawful, document the reasoning, obtain local advice, and avoid assuming that a practice accepted in one country is acceptable elsewhere.

International compliance must also avoid cultural stereotyping. Local customs may explain why a practice occurs, but they do not automatically justify bribery, discrimination, deception, or exploitation. Cultural intelligence should improve communication and control design, not weaken core ethical commitments.

8. Applied Case: The Meridian Smart-Device Launch

The following is an illustrative fictional case.

Background

Meridian Devices, a multinational technology company, plans to launch a connected home-security product through distributors in three countries. The product collects household usage data, uses third-party software, and requires installation by local contractors. A distributor proposes paying a “relationship consultant” a 12 percent commission to accelerate regulatory approval. Marketing wants to advertise the product as “fully private” and “AI-certified,” although data are shared with a cloud provider and no independent AI certification exists. Engineers also copied a small software component from an online repository without checking its license.

Problem

The company faces potential corruption, consumer deception, privacy and data-governance concerns, IP infringement, third-party risk, and inadequate product-safety assurance. Senior management argues that delay will cause lost market share.

Analysis

The consultant’s vague role and unusually high commission are corruption red flags. Meridian should suspend payment, identify the beneficial owners and services of the consultant, conduct enhanced due diligence, verify compensation against legitimate work, and determine whether any official decision is being influenced.

The privacy advertisement is misleading because “fully private” contradicts known data sharing. The claim should be replaced by a precise explanation of collection, use, retention, sharing, security, and consumer controls. “AI-certified” must not be used unless a genuine, relevant certification exists and its scope supports the claim.

The software component requires license review. If its license requires attribution or disclosure of derivative source, Meridian must comply, replace the component, or obtain a suitable commercial license. The firm should maintain a software bill of materials and an approval process for third-party code.

Finally, the product should undergo safety, cybersecurity, accessibility, and consumer-impact testing. Installation contractors should be screened, contractually bound to compliance, trained, and monitored.

Approach and outcome

The board risk committee authorises a temporary launch hold. Compliance and legal teams conduct third-party due diligence, engineering replaces or properly licenses the software, marketing withdraws unsupported claims, and product teams revise consent and privacy controls. An independent review tests the product before launch. The revised launch occurs later but with clearer consumer information, documented approvals, and distributor controls.

Learning points

The case demonstrates that compliance is interconnected. A sales decision can create corruption risk; a marketing claim can create consumer and privacy exposure; and a software shortcut can become an IP and cybersecurity problem. A risk-based programme protects not only against penalties but also against reputational damage, customer harm, and strategic fragility.

9. Challenges and Limitations

First, legal rules may be ambiguous, fragmented, or changing rapidly. Compliance teams must exercise judgment and document interpretations rather than pretend that every issue has a simple answer. Second, excessive bureaucracy can encourage employees to bypass controls. Controls should be proportionate and designed with operational users. Third, automated monitoring can produce false positives, unfair profiling, or privacy risks. Human review, explainability, data governance, and appeal mechanisms are necessary. Fourth, global supply chains make visibility difficult. Contractual promises are not substitutes for verification and credible remedy. Finally, ethical culture cannot be manufactured by slogans. Incentives, promotion decisions, leadership behaviour, and responses to bad news communicate the organisation’s real standards.

Best-Practice Checklist for Managers

• Map legal obligations and ethical risks before entering a market.
• Obtain board-level ownership of major compliance risks.
• Perform risk-based due diligence on intermediaries, suppliers, licensees, and acquisition targets.
• Keep complete and accurate books and records.
• Make consumer claims evidence-based and understandable.
• Maintain IP ownership, license, attribution, and confidentiality registers.
• Integrate compliance controls into procurement, finance, sales, product, and technology workflows.
• Offer trusted reporting channels and prohibit retaliation.
• Investigate allegations independently and remediate affected stakeholders.
• Test controls and update them when law, technology, or business models change.

Chapter Summary

Business ethics and business law are related but distinct. Law establishes enforceable minimum standards, while ethics evaluates fairness, honesty, stakeholder impact, and responsible use of power. Anti-corruption systems must address bribery, intermediaries, gifts, conflicts, political and charitable contributions, accurate records, and internal controls. Anti-money-laundering programmes use customer identification, beneficial-ownership analysis, monitoring, reporting, training, and risk-based controls, while balancing security with privacy and financial inclusion.

Consumer-protection law and ethical market conduct require accurate claims, fair contracts, safe products, responsible data practices, accessible remedies, and avoidance of manipulative digital design. Intellectual property rights protect inventions, expression, brands, confidential information, and designs, but ethical use also considers attribution, licensing, access, competition, public benefit, and emerging AI-related risks.

An effective compliance programme is leadership-led, risk-based, integrated, accessible, and continuously improved. It includes assessment, governance, prevention, detection, response, remediation, and evaluation. National laws must be interpreted alongside international instruments and standards, especially in cross-border operations. Ultimately, corporate accountability depends on governance, reliable records, incentives, transparency, and credible consequences.

Key Terms

Anti-money laundering: Measures used to prevent, detect, and report the concealment of criminal proceeds.

Beneficial owner: The natural person who ultimately owns or controls an entity or arrangement.

Bribery: Offering, giving, requesting, or receiving something of value to influence conduct improperly.

Compliance programme: An organised system for preventing, detecting, investigating, and correcting misconduct.

Consumer protection: Legal and ethical measures safeguarding consumers against unsafe, deceptive, unfair, or exploitative practices.

Corporate accountability: The obligation to explain, justify, and accept consequences for organisational conduct.

Dark pattern: A digital-interface design that manipulates users into decisions they might not otherwise make.

Due diligence: Investigation and verification undertaken before or during a relationship or transaction.

Facilitation payment: A payment intended to expedite a routine official action; its legality varies and it presents significant ethical risk.

Intellectual property: Legally protected creations, identifiers, designs, and confidential commercial information.

Layering: Transactions intended to obscure the origin or ownership of illicit funds.

Money laundering: Disguising criminal proceeds as legitimate assets or transactions.

Patent: An exclusive, time-limited right relating to a qualifying invention.

Placement: Introducing illicit proceeds into the financial or commercial system.

Responsible market conduct: Honest, fair, safe, and non-manipulative conduct toward customers and competitors.

Trade secret: Confidential commercially valuable information protected through reasonable secrecy measures.

Trademark: A sign that distinguishes the goods or services of one undertaking from those of others.

Whistleblower: A person who reports suspected wrongdoing through an internal or external channel.

Review Questions

Short Answer Questions

1. Why is legal compliance considered a minimum rather than a complete ethical standard?
2. Distinguish active bribery from passive bribery.
3. What is a beneficial owner, and why is beneficial-ownership information important in AML controls?
4. Explain why a technically true advertisement may still mislead consumers.
5. Identify three elements of an effective ethical compliance programme.

Long Answer Questions

1. Explain the relationship among anti-corruption controls, accurate books and records, and corporate accountability.
2. Compare the legal and ethical dimensions of intellectual property ownership and use.
3. Describe the six-stage development cycle for a risk-based compliance programme.
4. Analyse the principal consumer-protection risks created by digital platforms and dark patterns.
5. Discuss the difficulties multinational firms face when national laws and international standards overlap.

Analytical / Application Questions

1. A distributor asks a company to pay a large commission to an undisclosed consultant who claims to have government contacts. Identify the red flags, immediate actions, and longer-term controls required.
2. A retailer uses a preselected subscription box, hides the cancellation link, and advertises a product as “carbon neutral” without evidence. Evaluate the conduct from legal, ethical, and compliance perspectives.
3. A firm discovers that its AI tool was trained on confidential supplier data and produces marketing claims unsupported by evidence. Design a response covering IP, confidentiality, consumer protection, governance, and remediation.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the relationship between law and business ethics?

A. Ethics is irrelevant when conduct is legally permitted.

B. Law establishes enforceable standards, while ethics also evaluates fairness and stakeholder impact.

C. Ethics always overrides valid legal requirements.

D. Law and ethics are identical systems with identical consequences.

Correct Answer: B. Law establishes enforceable standards, while ethics also evaluates fairness and stakeholder impact.

Question 2

Which activity is most clearly an example of layering in money laundering?

A. Depositing illicit cash into a business account

B. Using multiple complex transfers to obscure the origin of funds

C. Purchasing a legitimate asset with documented salary income

D. Reporting a suspicious transaction to a regulator

Correct Answer: B. Using multiple complex transfers to obscure the origin of funds

Question 3

What is a beneficial owner?

A. The employee who processes a customer application

B. The regulator supervising a company

C. The natural person who ultimately owns or controls an entity

D. Any supplier with a written contract

Correct Answer: C. The natural person who ultimately owns or controls an entity

Question 4

Which is an anti-corruption red flag?

A. A documented payment for a verified service at market rates

B. A vague consultancy agreement with an unusually high commission

C. An independently reviewed annual report

D. A publicly available product price list

Correct Answer: B. A vague consultancy agreement with an unusually high commission

Question 5

Why can a technically true advertisement still violate responsible market conduct principles?

A. All advertising is prohibited without government approval.

B. Truthful statements can never be misleading.

C. Its overall presentation may create a false impression through omission or context.

D. Consumers are legally required to purchase the product.

Correct Answer: C. Its overall presentation may create a false impression through omission or context.

Question 6

Which intellectual property category primarily protects confidential commercially valuable information?

A. Trademark

B. Patent

C. Copyright

D. Trade secret

Correct Answer: D. Trade secret

Question 7

Which compliance-program activity is primarily a detection control?

A. Publishing a code of conduct

B. Providing confidential reporting channels and transaction monitoring

C. Defining corporate values

D. Approving the annual strategy

Correct Answer: B. Providing confidential reporting channels and transaction monitoring

Question 8

What is the most appropriate response to a suspiciously high payment requested by an intermediary?

A. Pay immediately because the intermediary accepts responsibility.

B. Record it as miscellaneous expense and continue the transaction.

C. Suspend or escalate the payment and conduct documented due diligence.

D. Delete the payment records after completion.

Correct Answer: C. Suspend or escalate the payment and conduct documented due diligence.

Question 9

Which statement about international standards is most accurate?

A. They always automatically replace domestic law.

B. They can provide common principles and guidance but must be applied with applicable national law.

C. They apply only to non-profit organisations.

D. They eliminate the need for internal controls.

Correct Answer: B. They can provide common principles and guidance but must be applied with applicable national law.

Question 10

Why should compliance metrics not rely only on the number of employees trained?

A. Training is never useful.

B. Training completion alone does not show whether controls operate effectively or misconduct is detected.

C. Training records are always illegal to retain.

D. Only financial results measure compliance.

Correct Answer: B. Training completion alone does not show whether controls operate effectively or misconduct is detected.