Compliance Programme Design and Management

Introduction

A corporate compliance programme is the organised system through which an organisation identifies legal and ethical obligations, prevents and detects misconduct, responds to failures, and improves its controls over time. It is not simply a collection of policies or a training calendar. An effective programme connects governance, risk assessment, internal controls, people, technology, reporting channels, investigations, assurance and corrective action.

Compliance has become a strategic management responsibility. Organisations operate across jurisdictions, use complex supply chains, process large volumes of personal and financial data, and rely increasingly on artificial intelligence and automated decision-making. These conditions create legal, regulatory, ethical and reputational risks that cannot be managed through informal supervision alone.

A well-designed programme should be proportionate to the organisation’s size, structure, sector, geographic reach, risk profile and regulatory environment. It should also be sufficiently independent to challenge management, sufficiently integrated to influence business decisions, and sufficiently practical to be used by employees and third parties.

This chapter explains how to design and manage a risk-based compliance programme using recognised frameworks and professional practice.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose, scope and principles of a corporate compliance programme.
2. Distinguish compliance management from legal advice, internal audit and general risk management.
3. Apply recognised frameworks, including COSO, ISO 37301 and the Three Lines Model.
4. Design a risk-based programme covering governance, policies, procedures, resources and training.
5. Establish reporting, monitoring, escalation, investigation and assurance arrangements.
6. Evaluate programme effectiveness and design a process for continuous improvement.
7. Analyse ethical, regulatory and technological challenges in programme management.

1. The Nature and Purpose of a Compliance Programme

1.1 Compliance as an organisational capability

Compliance means conforming to applicable law, regulation, contractual commitments, internal rules and relevant ethical standards. A compliance programme is the organisational capability that makes such conformity more likely and provides evidence that the organisation has taken reasonable and proportionate steps to prevent, detect and correct misconduct.

The programme normally addresses three related dimensions:

• Legal compliance: adherence to statutes, regulations, licences, court orders and regulatory requirements.
• Organisational compliance: adherence to internal policies, delegations, codes and approved procedures.
• Ethical compliance: conduct consistent with integrity, fairness, respect, transparency and responsible decision-making, even where a particular act may not be expressly prohibited by law.

A narrow programme focuses only on avoiding regulatory penalties. A mature programme also protects customers, employees, investors, business partners and the public. It supports reliable decision-making and reinforces the organisation’s social licence to operate.

1.2 Compliance, risk management and audit

These functions overlap but are not identical. Compliance identifies and advises on obligations, designs or coordinates controls, promotes ethical conduct and monitors adherence. Enterprise risk management considers a broad range of uncertainties, including strategic, financial, operational, cyber, safety and compliance risks. Internal audit provides independent and objective assurance on governance, risk management and control processes.

The compliance function should not own every operational control. Business managers remain responsible for conducting activities lawfully and ethically. If compliance assumes operational ownership, it may later be unable to provide objective challenge or monitoring. Conversely, a compliance function with no authority, resources or access to information becomes merely symbolic.

1.3 Objectives of a compliance programme

A comprehensive programme seeks to:

1. identify obligations and compliance risks;
2. assign accountability for managing those risks;
3. prevent violations through policies, controls and training;
4. detect concerns through reporting, monitoring and data analysis;
5. respond consistently through investigation and remediation;
6. protect whistleblowers and preserve evidence;
7. demonstrate reasonable oversight to regulators and stakeholders; and
8. learn from incidents and adapt to change.

The programme should be designed around risk rather than equal treatment of every obligation. A low-risk administrative requirement may need a simple checklist, whereas anti-bribery, sanctions, data protection, competition or health-and-safety risks may require specialist controls, approval workflows and continuous monitoring.

2. Recognised Frameworks and Design Principles

2.1 COSO Internal Control—Integrated Framework

The COSO framework describes internal control through five interrelated components:

1. Control environment: leadership integrity, accountability, organisational structure and competence.
2. Risk assessment: identification and analysis of risks to objectives.
3. Control activities: approvals, reconciliations, segregation of duties, access controls and other responses.
4. Information and communication: timely, reliable information reaching appropriate people.
5. Monitoring activities: ongoing and separate evaluations of whether controls operate effectively.

COSO is valuable because it treats control as an organisation-wide system rather than a collection of isolated procedures. Its limitations are that it is not a complete compliance standard and does not prescribe the exact legal obligations of a particular sector.

2.2 ISO 37301 Compliance Management Systems

ISO 37301 provides requirements and guidance for a compliance management system. Its structure reflects the management-system cycle of context, leadership, planning, support, operation, performance evaluation and improvement. Important themes include:

• understanding internal and external context;
• leadership commitment and an independent compliance function;
• identification of compliance obligations and risks;
• documented objectives and controls;
• competence, awareness and communication;
• reporting, investigation and corrective action;
• monitoring, auditing and management review; and
• continual improvement.

The standard emphasises that compliance should be integrated into organisational processes. Certification, where available and appropriate, can provide evidence of system design, but certification does not guarantee that misconduct will never occur.

2.3 The Three Lines Model

The Three Lines Model clarifies roles:

• First line: operational management owns risks and controls. It performs the work and is accountable for lawful execution.
• Second line: compliance, risk, legal, information security and similar functions provide expertise, support, monitoring and challenge.
• Third line: internal audit provides independent assurance to the governing body.

The governing body and senior management remain responsible for oversight and direction. The model is not a rigid organisational chart. In smaller organisations, one person may perform several roles, but conflicts of interest and lack of independence must be recognised and mitigated.

2.4 Core design principles

An effective programme should be:

• Risk-based: resources reflect the likelihood and impact of non-compliance.
• Proportionate: controls are appropriate to the organisation’s circumstances.
• Accountable: responsibilities are assigned to named roles, not vague departments.
• Independent: compliance can raise concerns without improper interference.
• Integrated: compliance is embedded in procurement, sales, finance, human resources, technology and strategic planning.
• Evidence-based: decisions and control operation are documented.
• Accessible: policies and reporting channels are understandable and usable.
• Responsive: concerns are assessed and escalated promptly.
• Improvement-oriented: incidents and assurance findings lead to learning.

3. Governance and Accountability

3.1 The role of the governing body

The board or equivalent governing body should approve the compliance strategy, understand significant risks, receive regular reporting and test whether management is responding adequately. Its responsibilities commonly include approving the code of conduct, overseeing conflicts of interest, reviewing serious incidents and ensuring that the compliance function has sufficient authority and resources.

Board oversight should be active rather than ceremonial. Useful questions include:

• Which compliance risks could materially affect the organisation?
• How are risk owners held accountable?
• Are incentives encouraging excessive risk-taking?
• How quickly are serious allegations reported to the board?
• What evidence shows that controls operate in practice?

3.2 Senior management

Senior management translates governance expectations into operational behaviour. It allocates resources, sets measurable objectives, integrates compliance into performance management and ensures that business leaders do not suppress inconvenient information. Tone from the top is important, but employees also observe the “tone in the middle”: the conduct of supervisors who make daily decisions.

3.3 The compliance officer

The compliance officer typically coordinates the programme, maintains the obligations register, advises management, supports risk assessments, develops policies, coordinates training, monitors controls, manages reporting channels and escalates material issues.

The compliance officer should have:

• direct or unrestricted access to senior management and the board;
• authority to obtain relevant information;
• adequate budget, staffing and technological support;
• protection from retaliation; and
• clearly documented responsibilities and limits.

The compliance officer does not replace managers, lawyers, investigators or auditors. Effective role descriptions prevent both responsibility gaps and duplicated work.

3.4 Governance documentation

Important governance instruments include a board charter, compliance committee terms of reference, compliance function charter, authority matrix, escalation protocol, reporting calendar and record-retention policy. These documents should identify who decides, who advises, who performs, who reviews and who must be informed.

4. Risk-Based Programme Design

4.1 Establishing the compliance universe

The first task is to identify the organisation’s compliance obligations. Sources may include legislation, regulations, licences, regulatory guidance, contracts, industry codes, court orders, internal policies and voluntary commitments.

An obligations register should normally record:

The register must be maintained. Laws, business models, products and regulatory expectations change, so a static legal inventory quickly becomes unreliable.

4.2 Risk identification

Compliance risks can arise from products, transactions, customers, suppliers, employees, intermediaries, jurisdictions, technologies and organisational culture. Techniques include interviews, workshops, process mapping, regulatory horizon scanning, incident analysis, complaints review, audit results, data analytics and benchmarking.

Risk identification should consider both direct violations and enabling conditions. For example, bribery risk may be influenced not only by gifts and payments but also by opaque intermediaries, unrealistic sales targets, weak due diligence and poor expense records.

4.3 Risk assessment and prioritisation

A common qualitative approach assesses likelihood and impact on scales such as low, medium and high. Impact may include legal sanctions, financial loss, customer harm, environmental damage, interruption of operations and reputational consequences.

A numerical risk score may be used as a prioritisation aid:

Here, R is the risk score, L is the likelihood rating and I is the impact rating. The formula assumes that the ratings use a consistent scale and that multiplication is an acceptable approximation for prioritisation. It does not produce an objective probability, and it should not replace professional judgment. A severe low-likelihood risk may require more attention than a frequent but minor administrative error.

Controls may reduce likelihood, impact or both. Residual risk is the risk remaining after controls operate. Organisations should document the basis for accepting residual risk and define approval thresholds for risks that exceed appetite.

4.4 Control design

Controls may be:

• Preventive: designed to stop an event, such as approval before payment.
• Detective: designed to identify an event, such as transaction review.
• Corrective: designed to remedy a failure, such as repayment and disciplinary action.
• Directive: designed to establish expected behaviour, such as a code of conduct.

A control should have a clear objective, responsible owner, frequency, evidence requirement and testing method. “Staff must comply with the law” is an aspiration, not a sufficiently specified control. “All high-risk distributors must be approved by compliance before appointment, with documented due diligence retained in the supplier system” is more testable.

5. Policies, Procedures and Standards

5.1 The policy architecture

A policy explains the organisation’s position and mandatory principles. A procedure explains how work is performed. A standard sets technical or operational requirements. Guidance provides advice where judgment is required.

A coherent policy hierarchy may include:

1. code of conduct;
2. enterprise compliance policy;
3. subject-specific policies, such as anti-bribery, conflicts, privacy, competition and sanctions;
4. operational procedures and approval workflows; and
5. forms, checklists, templates and records.

Policies should be concise, accessible and written for their audience. They should identify scope, responsibilities, prohibited conduct, required approvals, reporting routes, exceptions, consequences and review dates.

5.2 Policy lifecycle management

Policy management includes drafting, legal and operational review, approval, publication, communication, acknowledgement, version control, periodic review and withdrawal of obsolete versions. Translated policies should preserve meaning, not merely provide literal translation.

A policy is ineffective if employees cannot locate it, understand it or apply it. Excessively broad policies may also create unrealistic expectations and encourage technical non-compliance.

6. Resources, Competence and Training

6.1 Resource planning

Resource requirements depend on the organisation’s risk profile, geographic scope, regulatory intensity, number of employees, transaction volume and complexity. Resources include qualified personnel, budget, investigation capability, legal support, monitoring tools, data access and secure records management.

A useful resource assessment compares required activities with available capacity. For example, if high-risk third-party reviews are required before appointment, the organisation must have sufficient reviewers, service-level targets and systems to prevent commercial pressure from bypassing the control.

6.2 Training and communication

Training should be role-based and risk-based. All employees may need induction and code-of-conduct training, while procurement staff need supplier due diligence training and finance staff need payment-control training. Directors and senior managers require education on oversight, conflicts, escalation and personal accountability.

Effective training includes realistic scenarios, decision exercises and accessible reporting information. Completion rates are useful but insufficient. Evaluation should also consider comprehension, behaviour, quality of decisions and incident trends.

Training should be refreshed after material legal changes, serious incidents, policy revisions or changes in job responsibilities. Contractors, agents and other third parties may require proportionate communication or contractual obligations.

7. Reporting, Speak-Up and Investigations

7.1 Reporting mechanisms

A mature programme provides several reporting routes, such as line management, compliance officers, confidential hotlines, digital portals, ombuds services and external reporting where legally required. The system should allow anonymous reporting where appropriate and lawful.

Reporting channels must be accessible to people with disabilities, available in relevant languages and protected by confidentiality safeguards. Employees should know what happens after a report is made. Trust declines when reports disappear into an opaque process.

7.2 Non-retaliation

Non-retaliation is a central ethical and legal safeguard. Retaliation may include dismissal, demotion, exclusion, threats, undesirable reassignment or subtle career disadvantage. Organisations should monitor reporters for adverse treatment and investigate retaliation allegations separately where necessary.

7.3 Triage and escalation

Reports should be logged, acknowledged where possible, risk-assessed and assigned to an appropriate reviewer. Triage should consider seriousness, urgency, potential harm, conflicts of interest, evidence preservation, regulatory reporting duties and the need to protect individuals.

Immediate escalation may be required for suspected serious crime, imminent safety risks, significant data breaches, financial misstatement, senior executive involvement or conduct that could trigger mandatory notification.

7.4 Investigations

Investigations should be fair, independent, timely, confidential and properly documented. Investigators must define the allegation, preserve evidence, identify relevant witnesses, maintain a chain of custody, assess credibility and distinguish established facts from assumptions.

The organisation should determine in advance who may investigate senior executives, when external counsel or specialists are required, how legal privilege is handled, and how conflicts are managed. Confidentiality should be protected, but it should not be promised absolutely where disclosure is legally required.

Outcomes may include substantiation, partial substantiation, no finding, policy improvement, training, disciplinary action, repayment, contract termination, self-reporting or referral to authorities. Sanctions should be consistent, proportionate and documented.

8. Monitoring, Escalation and Assurance

8.1 Monitoring

Monitoring asks whether controls are operating as intended. It may include control self-assessments, sample testing, data analytics, policy attestations, site visits, transaction reviews, complaint analysis and regulatory change tracking.

Monitoring should focus on meaningful indicators. Possible indicators include:

• overdue high-risk due diligence reviews;
• unusual payment patterns;
• conflicts declarations not completed;
• training comprehension results;
• hotline reports and substantiation rates;
• repeat control failures;
• overdue remediation actions; and
• exceptions approved outside delegated authority.

A high number of reports does not automatically indicate a poor culture. It may reflect trust in reporting channels. Indicators must therefore be interpreted in context and not converted into simplistic performance targets.

8.2 Escalation

An escalation framework should specify thresholds, time limits, recipients and decision rights. Escalation may be based on severity, seniority of persons involved, likelihood of recurrence, potential regulatory reporting, financial exposure or risk to life and safety.

Managers should not be permitted to suppress or delay escalation because an issue is commercially inconvenient. At the same time, indiscriminate escalation of every minor issue can overwhelm senior governance and reduce attention to material risks.

8.3 Assurance

Assurance provides confidence that the programme is designed appropriately and operates effectively. It may include:

• first-line control checks;
• second-line compliance monitoring;
• independent internal audit;
• external assurance or certification; and
• regulatory examination.

Assurance should test both design and operating effectiveness. A policy may be well drafted but not implemented; a control may operate consistently but address the wrong risk. Findings should identify root causes, owners, due dates and verification requirements.

9. Continuous Improvement and Programme Effectiveness

A programme should operate as a cycle: understand obligations, assess risks, design controls, implement them, monitor performance, respond to incidents, review results and improve the system.

Continuous improvement depends on root-cause analysis. The question is not only “Who failed?” but also “Why did the system permit or encourage the failure?” Possible causes include unclear ownership, conflicting incentives, inadequate training, poor system design, unrealistic targets, insufficient staffing or ineffective supervision.

Management review should consider changes in law, business strategy, products, markets, technology, incidents, complaints, audit results, enforcement trends and stakeholder expectations. Improvement actions should be prioritised, resourced and tracked to closure.

Programme effectiveness should be assessed using a balanced set of evidence:

• whether major obligations are identified;
• whether high-risk controls exist and operate;
• whether employees understand expected conduct;
• whether concerns are raised and handled safely;
• whether investigations are timely and fair;
• whether corrective actions prevent recurrence; and
• whether leaders respond appropriately to adverse information.

No single metric proves effectiveness. Low incident numbers may indicate good controls, under-reporting or inadequate detection. Effective evaluation therefore combines quantitative indicators, qualitative evidence, interviews, testing and independent challenge.

10. Technology and Artificial Intelligence

Technology can improve compliance through centralised obligations registers, automated approvals, workflow tracking, continuous transaction monitoring, access controls and analytics. It can also introduce new risks, including privacy violations, biased decisions, cybersecurity failures, inaccurate outputs and unclear accountability.

Artificial intelligence may assist with regulatory horizon scanning, contract review, anomaly detection and classification of reports. However, AI outputs require human oversight, especially where decisions affect employment, customers, sanctions screening, credit, safety or investigations. Organisations should document data sources, validation methods, model limitations, access controls and review responsibilities.

Automation should not convert a weak control into a faster weak control. Before deployment, management should assess legality, explainability, data quality, security, bias, record retention and the right to challenge decisions. Human escalation must remain available for uncertain or high-impact cases.

11. Illustrative Case: Meridian Components Ltd

Background

Meridian Components Ltd, an illustrative manufacturing company, sells industrial equipment through distributors in several jurisdictions. Its rapid expansion created pressure to appoint local agents quickly. The company had an anti-bribery policy and annual online training, but distributor checks were inconsistent and sales managers controlled approval decisions.

Problem

An internal review identified unusually high commissions, incomplete distributor files and payments routed through unrelated companies. A sales manager argued that delays in compliance review threatened a major contract. The compliance officer had no formal right to attend commercial approval meetings and reported only to the finance director.

Analysis

The problem was not simply employee misconduct. The programme had structural weaknesses:

• the risk assessment had not been updated after international expansion;
• distributor ownership and beneficial ownership were not consistently verified;
• the policy did not define approval thresholds clearly;
• incentives rewarded revenue without sufficient compliance measures;
• the compliance function lacked independence and resources;
• monitoring focused on training completion rather than transaction risk; and
• escalation criteria were not documented.

The inherent risk was high because of third-party involvement, cross-border payments, commission structures and public-sector customers. The existing controls did not reduce the risk sufficiently.

Approach and solution

The board approved a remediation plan. Meridian:

1. created a third-party risk standard with risk-tiered due diligence;
2. required compliance approval before appointment or payment of high-risk distributors;
3. introduced beneficial-ownership verification and sanctions screening;
4. established a compliance committee reporting to the audit and risk committee;
5. revised sales incentives to include compliance conduct and control adherence;
6. implemented payment analytics to identify unusual commissions and bank-account changes;
7. introduced scenario-based training for sales and procurement staff;
8. created a confidential reporting channel with non-retaliation protections;
9. investigated the questionable transactions using an independent team; and
10. required management to verify remediation rather than merely mark actions complete.

Outcome

The investigation found insufficient evidence to establish bribery in some transactions but identified serious control breaches and inaccurate records. One relationship was terminated, payments were recovered where possible, and the company made regulatory disclosures after legal assessment. Subsequent monitoring showed improved completion of due diligence and earlier escalation of unusual payment activity.

Learning points

The case demonstrates that a policy and annual training do not constitute a mature programme. Effective compliance required governance independence, risk-based third-party controls, reliable information, aligned incentives, monitoring and credible escalation. It also illustrates why programme effectiveness must be judged by actual behaviour and control evidence rather than the existence of documents.

12. Challenges and Limitations

Compliance programmes face several recurring challenges. Excessive bureaucracy may slow legitimate business activity and encourage workarounds. Excessive reliance on checklists may create false assurance. Fragmented systems may prevent compliance teams from seeing connections across customers, suppliers and transactions. Global organisations must reconcile different legal requirements without lowering standards or imposing unlawful practices.

Cultural differences require sensitivity, but culture cannot be used to excuse corruption, discrimination or retaliation. Confidentiality and transparency must be balanced carefully. Investigations may also conflict with privacy, labour law, privilege and data-transfer requirements.

Independence is difficult where the compliance officer depends on the business for budget, promotion or access. The governing body should therefore monitor whether the function can challenge powerful managers. Finally, no programme eliminates risk. Its purpose is to reduce risk to an acceptable level, detect failures early, respond fairly and demonstrate responsible governance.

Best-Practice Checklist

A practical programme should be able to answer “yes” to the following questions:

• Are material compliance obligations identified and assigned to owners?
• Has the risk assessment considered current business activities and third parties?
• Are policies clear, accessible and supported by operational procedures?
• Does the compliance function have authority, expertise and independence?
• Are training and communications tailored to roles and risks?
• Can employees report concerns safely and confidentially?
• Are allegations triaged, investigated and escalated consistently?
• Are controls monitored for both design and operating effectiveness?
• Does internal audit or another independent function provide assurance?
• Are incidents used to identify and correct root causes?
• Does the board receive reliable information about material risks?
• Are technology and AI tools subject to human oversight and governance?

Chapter Summary

A corporate compliance programme is an integrated management system for identifying obligations, preventing and detecting misconduct, responding to concerns and improving organisational behaviour. Its effectiveness depends on governance, accountability, risk-based prioritisation and practical implementation.

COSO contributes a model of internal control; ISO 37301 provides a compliance management system structure; and the Three Lines Model clarifies operational ownership, specialist support and independent assurance. These frameworks are complementary rather than interchangeable.

Programme design begins with an obligations register and risk assessment. Controls should be proportionate, clearly owned, evidenced and tested. Policies must be supported by procedures, resources, role-based training and accessible reporting channels. Investigations should be fair, independent and properly documented, while escalation arrangements should protect urgent and material issues from suppression.

Monitoring, internal audit, management review and corrective action provide assurance and support continuous improvement. Technology and AI can strengthen detection and workflow, but they introduce privacy, security, bias and accountability risks that require human oversight. Ultimately, a mature programme is demonstrated not by the number of policies it contains, but by whether it influences decisions, detects problems, protects people and learns from failure.

Key Terms

Compliance programme: An organised system for managing legal, regulatory, organisational and ethical obligations.

Compliance obligation: A requirement arising from law, regulation, contract, licence, policy or ethical commitment.

Compliance risk: The possibility that failure to meet an obligation may cause harm, sanction, loss or misconduct.

Risk appetite: The level and type of risk an organisation is willing to accept in pursuit of its objectives.

Residual risk: Risk remaining after controls have been implemented.

Control: A measure designed to prevent, detect, direct or correct an unwanted event.

Control owner: The person accountable for ensuring that a control is properly designed and operates.

Control environment: The leadership, culture, structure and accountability conditions influencing control effectiveness.

Three Lines Model: A framework distinguishing operational management, specialist risk and compliance support, and independent internal audit assurance.

Obligations register: A documented inventory of applicable legal, regulatory, contractual and internal requirements.

Due diligence: Investigation and verification undertaken before or during a relationship or transaction.

Speak-up mechanism: A channel through which concerns or suspected misconduct can be reported.

Non-retaliation: Protection against adverse treatment for raising a concern or participating in an investigation.

Triage: Initial assessment used to classify, prioritise and route a report or issue.

Root-cause analysis: Examination of underlying system conditions that contributed to a failure.

Monitoring: Ongoing or periodic evaluation of whether controls operate as intended.

Assurance: Independent or objective confidence that governance, risk and control processes are effective.

Remediation: Action taken to correct a failure, address harm and prevent recurrence.

Compliance culture: Shared organisational expectations and behaviours concerning lawful and ethical conduct.

Review Questions

Short Answer Questions

1. What are the three dimensions of compliance discussed in this chapter?
2. Distinguish the compliance function from internal audit.
3. What information should an obligations register contain?
4. Why is role-based training preferable to identical training for all employees?
5. What is the purpose of non-retaliation protection?

Long Answer Questions

1. Explain how COSO, ISO 37301 and the Three Lines Model can be used together in designing a compliance programme.
2. Discuss the role of the board, senior management, operational managers and the compliance officer in programme governance.
3. Explain the stages involved in a risk-based compliance programme, from identifying obligations to continuous improvement.
4. Analyse the requirements of an effective reporting and investigation system.
5. Evaluate the benefits and limitations of using technology and artificial intelligence in compliance management.

Analytical / Application Questions

1. A company has extensive policies and 98% training completion but repeated conflicts-of-interest violations. Diagnose the likely programme weaknesses and propose an improvement plan.
2. Design a risk-based control framework for a business that appoints distributors in high-risk jurisdictions. Identify obligations, risks, controls, monitoring indicators and escalation triggers.
3. An employee anonymously reports that a senior executive approved payments to a supplier owned by a family member. Explain how the organisation should triage, investigate, escalate and remediate the matter.

Multiple Choice Questions with Answers

Question 1

Which activity is primarily associated with the first line in the Three Lines Model?

A. Providing independent internal audit assurance

B. Owning operational risks and controls

C. Setting external accounting standards

D. Certifying the compliance management system

Correct Answer: B. Owning operational risks and controls

Question 2

What is the main purpose of an obligations register?

A. To record employee performance ratings

B. To list applicable requirements and assign responsibility for addressing them

C. To replace all organisational policies

D. To calculate annual profit

Correct Answer: B. To list applicable requirements and assign responsibility for addressing them

Question 3

Which of the following is a preventive control?

A. A post-payment investigation

B. A customer complaint review

C. Approval required before a high-risk distributor is appointed

D. A disciplinary hearing after misconduct

Correct Answer: C. Approval required before a high-risk distributor is appointed

Question 4

In the illustrative Meridian case, which factor most increased third-party risk?

A. The company had an annual training course

B. The company used cross-border distributors and commission payments

C. The company maintained a code of conduct

D. The company conducted routine payroll processing

Correct Answer: B. The company used cross-border distributors and commission payments

Question 5

What does residual risk mean?

A. Risk before any controls exist

B. Risk transferred entirely to an insurer

C. Risk remaining after controls operate

D. Risk that has been legally eliminated

Correct Answer: C. Risk remaining after controls operate

Question 6

Which statement best describes internal audit’s role under the Three Lines Model?

A. It owns all operational controls

B. It provides independent and objective assurance

C. It approves every employee expense

D. It replaces the board’s oversight responsibility

Correct Answer: B. It provides independent and objective assurance

Question 7

Why should compliance training be role-based?

A. Different roles face different obligations and risk scenarios

B. It eliminates the need for policies

C. It guarantees that misconduct cannot occur

D. It prevents the use of reporting channels

Correct Answer: A. Different roles face different obligations and risk scenarios

Question 8

Which practice best supports a credible speak-up system?

A. Allowing managers to suppress inconvenient reports

B. Promising absolute secrecy in every circumstance

C. Providing accessible channels and protecting reporters from retaliation

D. Accepting reports only from senior executives

Correct Answer: C. Providing accessible channels and protecting reporters from retaliation

Question 9

If likelihood is rated 4 and impact is rated 5, what is the prioritisation score using R = L × I?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 10

What is the principal purpose of root-cause analysis after a compliance failure?

A. To identify only the individual to punish

B. To determine the underlying conditions that allowed the failure

C. To avoid documenting the incident

D. To eliminate the need for monitoring

Correct Answer: B. To determine the underlying conditions that allowed the failure