Compliance Management Systems and Regulatory Risk

Introduction and Context

Information-technology organisations operate within overlapping legal, regulatory, contractual, professional and ethical obligations. These obligations may concern privacy, cybersecurity, intellectual property, financial reporting, employment, accessibility, records management, artificial intelligence, consumer protection, outsourcing and sector-specific regulation. Compliance is therefore not a narrow legal exercise. It is an organisational capability that translates external requirements into accountable decisions, operational controls, evidence and continuous improvement.

A compliance management system (CMS) is the structured set of governance arrangements, processes, people, information and technologies through which an organisation identifies obligations, evaluates compliance risk, implements controls, detects failures, responds to incidents and improves performance. A mature CMS does not promise that breaches will never occur. Instead, it provides reasonable assurance that the organisation understands its duties, manages foreseeable risks, detects deviations and responds consistently.

This chapter develops a risk-based approach to compliance management. It connects obligation registers, risk assessment, policies, controls, training, third-party due diligence, monitoring, reporting and escalation with ISO 37301 and the Three Lines Model. The emphasis is strategic: compliance should support trustworthy innovation, resilience and informed risk-taking rather than merely create documentation.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the purpose, scope and principles of a compliance management system.
2. Construct and maintain an obligation register for an IT organisation.
3. Assess regulatory risk using likelihood, impact and control effectiveness.
4. Map obligations to policies, controls, owners, evidence and assurance activities.
5. Design proportionate arrangements for training, third-party due diligence, reporting and escalation.
6. Interpret the relevance of ISO 37301 and the Three Lines Model.
7. Evaluate practical and ethical limitations of compliance programmes, including those involving automation and artificial intelligence.

1. Compliance as an Organisational Capability

1.1 Compliance, conformity and ethics

Compliance means fulfilling applicable requirements. These requirements may be:

• Legal: statutes, regulations, judicial decisions and regulatory directions.
• Contractual: customer security clauses, service-level commitments and processor obligations.
• Organisational: internal policies, standards and delegated authority rules.
• Professional: codes of conduct and sector expectations.
• Voluntary but strategically important: standards, certifications and public commitments.

Conformity is evidence that a specified requirement has been met. Ethics is broader: it concerns whether conduct is responsible, fair and defensible, including situations where the law is silent or permits more than stakeholders reasonably expect. A lawful use of personal data may nevertheless be unfair; a contract may permit extensive monitoring while such monitoring remains ethically questionable.

1.2 Compliance risk

Compliance risk is the possibility that an organisation will fail to meet an obligation and consequently suffer legal, financial, operational, technological, reputational or stakeholder harm. It has two dimensions:

• Inherent risk: exposure before considering controls.
• Residual risk: exposure remaining after controls operate.

A risk-based CMS allocates effort according to significance. It does not treat every requirement as equally urgent, nor does it assume that a long policy library demonstrates effective compliance.

1.3 Objectives of a CMS

A CMS should enable an organisation to:

1. identify applicable obligations;
2. assign ownership and accountability;
3. understand compliance risks and priorities;
4. implement preventive and detective controls;
5. provide accessible advice and training;
6. collect reliable evidence;
7. report meaningful information to management and governing bodies;
8. investigate and remediate non-compliance; and
9. learn from incidents, changes and assurance results.

The CMS should be integrated with enterprise risk management, information-security management, internal audit, procurement, human resources, product governance and business continuity. A separate compliance department cannot compensate for weak operational ownership.

2. ISO 37301 and the Three Lines Model

2.1 ISO 37301 as a management-system standard

ISO 37301 specifies requirements and guidance for establishing, developing, implementing, evaluating, maintaining and improving a compliance management system. It adopts a management-system logic: leadership establishes direction; the organisation understands its context and obligations; risks are assessed; controls and processes are implemented; performance is evaluated; and the system is improved.

Important themes include:

• leadership commitment and a compliance culture;
• independence, authority and adequate resources for the compliance function;
• identification of compliance obligations;
• compliance-risk assessment;
• competence, awareness and communication;
• operational planning and control;
• reporting, investigation and corrective action;
• monitoring, measurement, audit and management review; and
• continual improvement.

ISO 37301 is not a catalogue of every law an organisation must obey. Certification, where pursued, is not proof that every legal obligation has been fulfilled. It provides a structured system for managing compliance and demonstrating that the organisation has designed and operated relevant processes.

2.2 The Three Lines Model

The Three Lines Model, associated with the Institute of Internal Auditors, clarifies roles rather than creating three rigid departments.

The first line cannot transfer ownership to compliance. The second line should advise and challenge without taking over operational decisions. The third line should remain sufficiently independent to evaluate both first- and second-line performance. The governing body must receive information that is sufficiently accurate, timely and candid to support oversight.

Figure: Roles and relationships in the Three Lines Model.

3. Building the Compliance Architecture

3.1 Governance and accountability

A CMS begins with a mandate. The governing body should approve the compliance policy, understand the organisation's principal compliance risks and receive reports on significant failures. Senior management should provide resources, establish priorities and model expected conduct. A chief compliance officer or equivalent should have access to senior management and, where appropriate, the governing body without management filtering material concerns.

A responsibility assignment matrix can clarify who is accountable, responsible, consulted and informed. Accountability should be assigned to a role rather than an individual name alone, because responsibilities must survive staff turnover.

3.2 The obligation register

An obligation register is the authoritative inventory of requirements relevant to the organisation. It should be a controlled record, not an unowned spreadsheet. Typical fields include:

The register should distinguish obligations from controls. “Encrypt sensitive data in transit” may be a control objective or requirement, whereas a legal provision requiring appropriate security is an external obligation. The mapping between them is essential because one obligation may require several controls, and one control may support several obligations.

Sources include legislation, regulatory guidance, enforcement decisions, contracts, licences, standards adopted by policy, customer requirements and internal commitments. Legal counsel or qualified specialists should validate interpretation in material or ambiguous cases. A register that copies legal text without translating it into business responsibilities is difficult to operate.

3.3 Change management

The compliance environment changes when a law is amended, a regulator issues guidance, the organisation enters a new market, a product changes its data use, or a supplier introduces a new service. The CMS should therefore connect horizon scanning with change management. Each material change should be assessed for affected processes, controls, documentation, training, contracts, systems and residual risk.

4. Regulatory-Risk Assessment

4.1 A structured assessment method

A defensible risk assessment normally follows these steps:

1. define scope, assumptions and assessment criteria;
2. identify obligations and compliance failure scenarios;
3. estimate inherent likelihood and impact;
4. assess control design and operating effectiveness;
5. determine residual risk;
6. compare residual risk with approved appetite or tolerance;
7. select treatment, owner, deadline and evidence; and
8. monitor changes and reassess after events.

Impact should be multidimensional. It may include regulatory sanctions, financial loss, interruption of critical services, harm to individuals, loss of confidentiality or integrity, litigation, reputational damage and strategic consequences. A privacy breach affecting a vulnerable population may have high human impact even if the immediate financial loss is modest.

A simple qualitative matrix may classify likelihood and impact as low, medium or high. Quantitative scoring can support prioritisation but should not create false precision. If a numerical model is used, the organisation must document scales, assumptions and decision thresholds. Scores are decision aids, not objective measurements of risk.

4.2 Control effectiveness

Controls can be:

• Preventive: access approval, segregation of duties, secure design review.
• Detective: logging, alerts, reconciliations, compliance monitoring.
• Corrective: incident response, deletion, remediation and disciplinary action.
• Directive: policies, training and management instructions.
• Compensating: alternative safeguards used when the preferred control is unavailable.

Design effectiveness asks whether a control, if performed as specified, would address the risk. Operating effectiveness asks whether it actually operated consistently during the relevant period and produced reliable evidence. A beautifully written policy with no implementation has weak operating effectiveness.

A practical residual-risk judgement considers the significance of the obligation, control design, control performance, evidence quality, exposure duration and uncertainty. Organisations should define escalation criteria in advance, such as mandatory reporting for suspected criminal conduct, material regulatory breaches, serious harm to individuals or failure of a critical control.

4.3 Treatment options

Treatment may involve reducing risk through controls, avoiding an activity, transferring limited consequences through contracts or insurance, accepting risk within delegated authority, or sharing risk through carefully governed arrangements. Transfer does not remove legal responsibility. For example, outsourcing processing does not necessarily eliminate the customer's duties concerning personal data.

5. From Obligations to Controls and Evidence

5.1 Control mapping

A control library should state the control objective, activity, owner, frequency, population or scope, evidence, exceptions and testing method. Consider the following mapping:

Controls should be proportionate and integrated into normal work. A security control embedded in deployment tooling may be more reliable than a manual reminder. Automation is valuable, but automated results require ownership, exception handling and periodic validation.

5.2 Policies and procedures

A policy expresses organisational intent and mandatory principles. A standard specifies measurable requirements. A procedure explains how work is performed. Guidance helps users apply judgement. Confusing these layers produces either vague documents or excessive bureaucracy.

Policies should identify scope, roles, prohibited conduct, exceptions, enforcement, review cycle and related documents. They should be accessible, understandable and translated into processes. Approval alone is not evidence of effectiveness; the organisation should test whether relevant personnel understand and follow the requirements.

5.3 Training and competence

Training should be role-based. Developers may need secure coding and privacy-by-design skills; procurement staff need supplier due diligence; executives need escalation and oversight responsibilities; all personnel need reporting channels and conduct expectations. Completion rates are useful but insufficient. Better indicators include assessment performance, observed behaviour, quality of reports and recurrence of failures.

Training should be supplemented by communication, coaching, simulations and just-in-time prompts. A punitive culture may suppress reporting; a healthy culture encourages good-faith concerns while distinguishing honest mistakes from reckless or intentional conduct.

6. Third-Party and Supply-Chain Compliance

IT services depend on cloud providers, software vendors, consultants, data processors, distributors and subcontractors. Third-party risk management should be risk-based and lifecycle-oriented:

1. classify the relationship by data, access, criticality, geography and concentration;
2. perform proportionate due diligence before onboarding;
3. negotiate appropriate contractual rights and responsibilities;
4. approve residual risk and any exceptions;
5. monitor performance, incidents, assurance reports and changes;
6. reassess after material events; and
7. terminate or transition safely when required.

Due diligence may examine ownership, sanctions exposure, regulatory history, financial resilience, security practices, privacy arrangements, business continuity, subcontracting, labour practices and conflicts of interest. Certifications and questionnaires are evidence, not substitutes for judgement. A supplier may hold a certification whose scope excludes the service being purchased.

Contracts should address permitted use of data, security controls, incident notification, audit or assurance rights, subcontractors, data location where relevant, retention and deletion, assistance with individual or regulatory requests, business continuity and exit. Monitoring should reflect criticality; a provider supporting a critical service merits more intensive oversight than a low-risk office supplier.

7. Reporting, Investigation and Escalation

7.1 Reporting architecture

Compliance reporting should answer management questions: What changed? Which obligations are most exposed? Are critical controls working? Where are exceptions accumulating? What decisions are required? Useful reports combine leading indicators, such as overdue assessments and training gaps, with lagging indicators, such as incidents, enforcement actions and repeat findings.

A report should state scope, data quality, methodology, significant assumptions, trends, exceptions and management actions. A green status without explanation can conceal uncertainty. Dashboards should support decisions rather than reward superficial completion.

7.2 Speak-up and investigation

Reporting channels may include managers, compliance officers, hotlines, confidential portals and specialist contacts. They should be accessible, protected against retaliation and capable of handling anonymous reports where lawful and appropriate. Investigations should preserve evidence, define scope, protect confidentiality, manage conflicts of interest and apply consistent procedures.

Investigators should distinguish allegations, facts, inferences and unresolved questions. Digital evidence may be volatile and privacy-sensitive; collection should be lawful, proportionate and documented. Findings should lead to corrective action, disciplinary decisions where justified, control improvement and, where required, external notification.

7.3 Escalation

Escalation criteria should be predetermined. Factors include severity of potential harm, involvement of senior personnel, criminal suspicion, systemic control failure, likely media or regulatory interest, cross-border implications, uncertainty about reporting deadlines and risk of evidence destruction. Escalation is not the same as assuming guilt. It is a governance response to uncertainty and potential significance.

8. Monitoring, Assurance and Continual Improvement

Monitoring is management's ongoing observation of compliance performance. Testing examines whether controls are designed and operating effectively. Internal audit provides independent assurance. These activities should be coordinated to reduce duplication while preserving independence.

A mature programme maintains a compliance calendar covering obligation reviews, control tests, policy reviews, training, supplier reassessments, regulatory returns, management reviews and audit follow-up. Findings should be assigned owners and due dates. Closure should require evidence that the issue was remediated, not merely that an action was stated as complete.

Root-cause analysis is important. A failure may arise from unclear ownership, unrealistic process design, inadequate technology, incentives, insufficient staffing, poor supplier governance or cultural pressure. Treating only the immediate symptom leads to recurrence.

Useful performance measures include:

• proportion of high-risk obligations with named owners;
• overdue high-risk control tests;
• repeat findings and average remediation age;
• quality and timeliness of incident escalation;
• completion and effectiveness of role-based training;
• supplier assessment coverage weighted by criticality; and
• management actions arising from compliance reports.

Metrics require interpretation. A fall in reported incidents may indicate improvement—or fear of reporting. A rise may indicate deterioration—or a healthier speak-up culture.

9. Technology, Data and Artificial Intelligence

Technology can improve obligation tracking, control monitoring, workflow, evidence collection and regulatory change detection. Governance platforms can link obligations to risks, controls, owners and evidence. Security information and event management tools can identify suspicious activity, while data-loss prevention and identity systems can support preventive and detective controls.

Artificial intelligence may assist with classifying regulatory text, identifying changes, summarising evidence or prioritising reviews. However, AI outputs can be incomplete, outdated, biased or confidently incorrect. Human review is required for legal interpretation, high-impact decisions and material escalations. Organisations should record the model's purpose, data sources, limitations, validation, decision authority and escalation path.

AI used within compliance creates additional issues: privacy, confidentiality, intellectual property, explainability, data provenance, bias, security and accountability. Automated compliance scoring should not be treated as a legal conclusion. A model may prioritise a review; it should not silently determine that an obligation is irrelevant.

10. Illustrative Case: Cloud Migration in a Health-Technology Company

Background

MedData Analytics, a fictional medium-sized company, provides clinical reporting software to hospitals in three jurisdictions. It plans to migrate its platform to a public cloud provider and introduce an AI-assisted feature that identifies anomalies in clinical data. The company has a privacy policy and an information-security certification, but its obligation register is incomplete and supplier reviews are inconsistent.

Problem

The migration creates uncertainty about data processing roles, international transfers, retention, subcontractors, incident notification, model training data and access by support personnel. Engineering views the cloud move as urgent. Procurement wants to use a standard supplier contract. The board asks whether the project is compliant.

Analysis

The compliance team first defines the scope: patient data, production systems, development environments, cloud provider, AI service and support subcontractors. It updates the obligation register using applicable privacy requirements, customer contracts, security commitments and sector expectations. The team then identifies scenarios:

• unauthorised support access to patient records;
• use of clinical data to train the AI feature without a valid basis or customer permission;
• delayed notification after a security incident;
• retention of data after contract termination; and
• inability to demonstrate where subcontractors process data.

The risk assessment rates the first four scenarios as high because potential harm and regulatory consequences are significant. Existing controls are judged partially effective: access management exists, but privileged access reviews are irregular; contracts contain security terms, but deletion and audit rights are unclear; incident response exists, but notification responsibility is not assigned.

Approach and solution

The company establishes a project compliance workstream governed by the first line, with privacy and compliance specialists providing second-line challenge. Internal audit schedules an independent review after implementation. Actions include:

1. creating a system and data inventory linked to the obligation register;
2. defining controller, processor or equivalent roles for each processing activity;
3. conducting a privacy and security impact assessment;
4. prohibiting use of customer data for model training until approval is documented;
5. implementing least privilege, privileged-access monitoring and quarterly reviews;
6. adding incident, deletion, subcontractor and audit clauses to the contract;
7. requiring supplier evidence and a list of relevant subprocessors;
8. testing backup restoration and exit procedures;
9. training engineering, support and procurement personnel; and
10. establishing a severity matrix with named escalation and notification owners.

The AI feature is initially deployed using synthetic and de-identified data. A governance committee reviews any later proposal to use production data, including purpose, necessity, fairness, security, retention and customer transparency.

Outcome

The migration is delayed by six weeks but proceeds with documented residual-risk acceptance for a low-risk reporting function. The high-risk AI training proposal is deferred pending further assessment. A post-implementation test finds one access-review exception, which is corrected. The board receives a report showing obligations, controls, open issues, owners and deadlines rather than a simple certification claim.

Learning points

The case demonstrates that compliance is most effective when introduced during design rather than after deployment. A certification or supplier questionnaire cannot replace obligation-specific analysis. The first line retains ownership, second-line specialists provide challenge, and third-line assurance evaluates the system independently. The case also shows that responsible delay may be a strategic enabler: it prevents uncontrolled exposure while preserving the business objective.

11. Challenges and Critical Limitations

11.1 Fragmented and changing requirements

Multinational IT organisations face differing definitions, deadlines, supervisory expectations and transfer rules. Harmonisation can reduce complexity, but a single global control may fail to satisfy a local requirement. The register should record jurisdictional variation and local owners.

11.2 Compliance theatre

Compliance theatre occurs when visible activity—policies, badges, training completion or certifications—is mistaken for effective compliance. The remedy is evidence of operation, independent challenge, meaningful metrics and attention to outcomes.

11.3 Excessive bureaucracy

Controls can impede innovation when they are duplicative, poorly designed or applied without regard to risk. Risk-based design, reusable evidence, automated workflow and clear exception procedures can preserve speed without abandoning accountability.

11.4 Conflicts and independence

Compliance personnel may face pressure from revenue-generating teams. Reporting lines, access to the governing body and documented escalation rights help protect independence. Independence should be balanced with operational engagement; a compliance function isolated from product and engineering decisions will intervene too late.

11.5 Data quality and false precision

Incomplete inventories, inconsistent classifications and unreliable evidence undermine assessments. Numerical risk scores can conceal disagreement and uncertainty. Organisations should record confidence, assumptions and qualitative reasoning alongside scores.

11.6 Ethical limits of control

A control can be legally valid yet harmful if it disproportionately surveils workers, excludes vulnerable users or shifts risk to people with little bargaining power. Compliance governance should therefore consider fairness, human dignity, accessibility, sustainability and affected-stakeholder voice.

12. Best-Practice Design Principles

A strategically effective CMS generally follows these principles:

1. Leadership ownership: governing bodies and executives treat compliance as a business responsibility.
2. Clear accountability: every material obligation and control has an owner.
3. Risk proportionality: effort reflects potential harm, uncertainty and criticality.
4. Traceability: requirements connect to risks, controls, evidence, findings and decisions.
5. Operational integration: compliance is embedded in product, procurement, engineering and service processes.
6. Independence and challenge: second- and third-line roles can raise uncomfortable issues.
7. Evidence over assertion: effectiveness is demonstrated through reliable records and testing.
8. Speak-up protection: concerns can be raised without retaliation.
9. Continuous improvement: incidents, audits, regulatory change and experience alter the system.
10. Human-centred governance: legality is supplemented by fairness, responsibility and stakeholder impact.

Chapter Summary

A compliance management system is an organisational capability for identifying obligations, assessing regulatory risk, implementing controls, developing competence, managing suppliers, reporting concerns and improving performance. ISO 37301 provides a management-system structure, while the Three Lines Model clarifies the relationship between operational ownership, specialist oversight and independent assurance. The obligation register is the foundation for traceability, but it must be connected to risk scenarios, policies, controls, evidence and accountable owners. Risk assessment should distinguish inherent from residual risk and should use qualitative or quantitative methods cautiously. Effective compliance depends on role-based training, proportionate third-party due diligence, protected reporting channels, predetermined escalation and evidence-based monitoring. Technology and AI can strengthen compliance, but they require human judgement, validation and accountability. Ultimately, mature compliance supports trustworthy innovation by making risk visible and decisions defensible.

Key Terms

Compliance management system: A structured system for managing obligations, risks, controls, evidence and improvement.

Compliance obligation: A legal, contractual, organisational, professional or adopted requirement applicable to an organisation.

Obligation register: A controlled inventory of applicable requirements and their owners, controls, evidence and review information.

Compliance risk: The possibility of failure to meet an obligation and resulting harm.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls are considered.

Control: A measure designed to prevent, detect, direct or correct undesired events.

Control objective: The outcome a control is intended to achieve.

Design effectiveness: The extent to which a control is suitably designed to address a risk.

Operating effectiveness: The extent to which a control operates consistently and produces reliable evidence.

Three Lines Model: A model distinguishing operational ownership, specialist oversight and independent assurance.

Second line: Functions providing compliance expertise, monitoring and challenge.

Third line: An independent assurance function, commonly internal audit.

Due diligence: Investigation and evaluation performed before or during a relationship to understand risk.

Residual-risk acceptance: A formally authorised decision to tolerate remaining exposure.

Speak-up: Raising concerns about suspected misconduct, non-compliance or control failure.

Root-cause analysis: Examination of underlying conditions that produced a failure.

Management review: Senior evaluation of CMS performance, suitability and improvement needs.

Compliance culture: Shared values and behaviours that influence how obligations are understood and followed.

Compliance theatre: Visible compliance activity that creates an appearance of control without reliable effectiveness.

Review Questions

5 Short Answer Questions

1. What is the purpose of an obligation register?
2. Distinguish inherent risk from residual risk.
3. What is the principal role of the second line in the Three Lines Model?
4. Why are certifications insufficient evidence of complete compliance?
5. State two characteristics of effective compliance training.

5 Long Answer Questions

1. Explain how ISO 37301 can guide the design and continual improvement of a compliance management system.
2. Describe a complete process for translating a legal obligation into operational controls and evidence.
3. Discuss the respective responsibilities of the first, second and third lines in an IT organisation.
4. Explain how third-party due diligence should be adapted to supplier criticality and data access.
5. Evaluate the benefits and limitations of using technology and artificial intelligence in compliance management.

3 Analytical / Application Questions

1. An organisation has high training completion, few reported incidents and many overdue control tests. Analyse what this information may—and may not—demonstrate about its compliance culture and effectiveness.
2. Design an obligation-register and risk-assessment approach for a cloud service processing sensitive personal data across two jurisdictions. Identify at least five fields, four risk scenarios and suitable escalation triggers.
3. A business unit wants to deploy an AI tool using customer data, but the contract is silent on model training. Apply the principles in this chapter to recommend a governance and decision process.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of a compliance management system?

A. To guarantee that no legal breach can ever occur

B. To identify obligations, manage risks, implement controls and improve compliance performance

C. To transfer all compliance responsibility to the legal department

D. To replace internal audit with automated reporting

Correct Answer: B. To identify obligations, manage risks, implement controls and improve compliance performance

Question 2

What is the principal distinction between inherent risk and residual risk?

A. Inherent risk is financial, whereas residual risk is operational

B. Inherent risk is external, whereas residual risk is internal

C. Inherent risk is assessed before controls, whereas residual risk remains after controls

D. Inherent risk is measured annually, whereas residual risk is measured daily

Correct Answer: C. Inherent risk is assessed before controls, whereas residual risk remains after controls

Question 3

Which activity belongs primarily to the first line of the Three Lines Model?

A. Operating business controls and owning operational risks

B. Providing independent assurance to the governing body

C. Issuing external regulatory judgments

D. Approving all internal-audit findings

Correct Answer: A. Operating business controls and owning operational risks

Question 4

Which field is most important for connecting an obligation to operational accountability?

A. Document font

B. Named role owner

C. Office location only

D. Marketing category

Correct Answer: B. Named role owner

Question 5

Which statement about a compliance certification is most accurate?

A. It proves every applicable law has been satisfied

B. It eliminates the need for supplier monitoring

C. It provides evidence about the assessed scope and system, but is not proof of universal compliance

D. It transfers legal responsibility to the certification body

Correct Answer: C. It provides evidence about the assessed scope and system, but is not proof of universal compliance

Question 6

Which is an example of a detective control?

A. Pre-approval of privileged access

B. A policy stating that passwords must be protected

C. A security alert identifying unusual access activity

D. A contract prohibition on subcontracting

Correct Answer: C. A security alert identifying unusual access activity

Question 7

What should a risk-based third-party programme do first?

A. Apply the same questionnaire to every supplier regardless of service

B. Classify the relationship according to factors such as criticality, data and access

C. Assume that a supplier certification removes all risk

D. Wait for an incident before assessing the supplier

Correct Answer: B. Classify the relationship according to factors such as criticality, data and access

Question 8

Which measure most directly evaluates operating effectiveness?

A. Whether a policy has a professional design

B. Whether a control operated consistently and has reliable evidence

C. Whether the organisation has a compliance logo

D. Whether a risk has a high numerical score without testing

Correct Answer: B. Whether a control operated consistently and has reliable evidence

Question 9

Why should AI-assisted compliance analysis remain subject to human review?

A. AI systems are always slower than manual processes

B. AI outputs may be incomplete, biased, outdated or incorrect

C. Human review is required only for low-risk decisions

D. AI cannot process any regulatory text

Correct Answer: B. AI outputs may be incomplete, biased, outdated or incorrect

Question 10

Which response best reflects a mature approach to a suspected material compliance breach?

A. Suppress the matter until facts are completely certain

B. Delete potentially damaging records

C. Apply predetermined escalation, preserve evidence, investigate and assess reporting duties

D. Transfer the matter automatically to the supplier

Correct Answer: C. Apply predetermined escalation, preserve evidence, investigate and assess reporting duties