Question 70
Independent testing has confirmed compromised third-line independence. Management agrees that restating the existing policy will not resolve the process breakdown. Which corrective measure most directly closes this gap?
- Separate control design ownership from independent assurance testing
- Require business staff to report concerns through protected AFC channels
- Express measurable exposure limits and prohibited activities for specific products
- Return routine process execution to operations while retaining independent second-line challenge
- Give the designated officer clear escalation authority and access to oversight
Explanation
Correct Answer
A:This responds to the identified weakness, compromised third-line independence, at the point where the process breaks down. Assigning the change to chief audit executive or audit committee and testing audit independence declarations and approved audit plan makes remediation verifiable rather than aspirational.
Incorrect Answers
B:The proposed step is appropriate when first-line ownership failure in identifying and escalating risk is observed. The case instead concerns compromised third-line independence; the alternative would not repair the particular failing in time or at the correct control point.
C:With the contrast between non-operational risk appetite language and compromised third-line independence in view, this approach is usually evidenced by product limits, breach triggers, and board-approved risk appetite, addressing non-operational risk appetite language. It is not a substitute for the targeted corrective action needed to resolve compromised third-line independence in this workflow.
D:The alternative may improve a different part of AFC governance, but it primarily tackles blurred first- and second-line responsibility. The actual defect, compromised third-line independence, requires a different control intervention.
E:This intervention solves a different weakness, namely inadequate authority of the MLRO or BSA officer. It leaves the current compromised third-line independence substantially unresolved because the broken process here requires separate control design ownership from independent assurance testing.
Question 71
An analyst challenges a working hypothesis of reputational damage with banking-service disruption because the file lacks verification of whether partner exits were linked to unresolved AFC deficiencies. Independent source material is needed before disposition. Which source should the analyst check to settle the disputed fact?
- Alert backlog segmented by customer and corridor risk
- Correspondent termination notices and remediation history
- Shared-device and common-beneficiary analysis
- Case logs matched to training and supervisory records
Explanation
Correct Answer
B:This material provides a practical way to establish whether partner exits were linked to unresolved AFC deficiencies. When examining the need to establish whether partner exits were linked to unresolved AFC deficiencies, its value is in linking the customer's asserted purpose to observed facts, so investigators can articulate a reasoned conclusion.
Incorrect Answers
A:The proposed source is most informative for a question about whether monitoring resources match actual exposure. The current case calls for establishing whether partner exits were linked to unresolved AFC deficiencies; using this instead could leave the customer explanation largely untested.
C:When examining the distinction between establishing whether the senders are connected to a single controller and establishing whether partner exits were linked to unresolved AFC deficiencies, the document helps with investigations focused on whether the senders are connected to a single controller. In this case the evidential gap lies with whether partner exits were linked to unresolved AFC deficiencies, so the reviewer needs a more targeted source before reaching a conclusion.
D:Such records could help establish whether staff acted on written escalation duties in a different investigation. Here the precise evidential question involves establishing whether partner exits were linked to unresolved AFC deficiencies, so the suggested material would be indirect and may not resolve the decisive uncertainty.
Question 72
Accountability for work to separate control design ownership from independent assurance testing is disputed following a finding of compromised third-line independence. The owner must have control over execution. Where should primary ownership for resolving the weakness sit?
- First-line relationship management supervisor
- Second-line head of AFC compliance
- Chief audit executive or audit committee
- Board AFC management information owner
Explanation
Correct Answer
C:Primary ownership needs to sit with the function able to ensure that the organization can separate control design ownership from independent assurance testing. The problem identified as compromised third-line independence requires accountability for actual process change; advice and independent testing are supporting, separate duties.
Incorrect Answers
A:That group is suited to producing escalation samples reconciled to customer service records for another control issue. In the present case ownership must support measures to separate control design ownership from independent assurance testing and closure of compromised third-line independence, not an unrelated assurance task.
B:When examining the contrast between blurred first- and second-line responsibility and compromised third-line independence, the alternative's control domain is blurred first- and second-line responsibility, generally corrected through steps to return routine process execution to operations while retaining independent second-line challenge. Here the relevant weakness is compromised third-line independence, requiring a different remediation ownership and workplan.
D:In assessing the contrast between KPI selection missing risk and control quality indicators and compromised third-line independence, its normal responsibility would be addressing KPI selection missing risk and control quality indicators. It may advise or review here, but the accountable execution of measures to separate control design ownership from independent assurance testing belongs in the process identified by this case.
Question 73
A compliance task requires an organization to participate in peer review and address prioritized recommendations. The steering committee has not identified the function with the relevant authority or responsibility. Which body or function has the specifically described lead responsibility?
- Financial-sector AML supervisor enforcing domestic CDD rules
- FATF or relevant FATF-style regional body
- Sector supervisor or designated national assessment body
- National competent authority governing company transparency
- Domestic AML supervisor setting proportional requirements
Explanation
Correct Answer
B:This body or team has the relevant authority or duty for the action in this case: participate in peer review and address prioritized recommendations. The distinction matters because mutual evaluation report with action plan and follow-up must be accountable to the proper decision maker.
Incorrect Answers
A:This function normally leads work such as require identification and reasonable verification of beneficial owners, which is distinct from the issue at hand. Given the separate duty to require identification and reasonable verification of beneficial owners as opposed to the current duty to participate in peer review and address prioritized recommendations as the distinguishing point, the current responsibility relates to participate in peer review and address prioritized recommendations, so routing it here would misassign accountability.
C:The alternative is associated with sectoral risk assessment with evidence-based drivers for another kind of obligation. It is not the authority chiefly accountable for participate in peer review and address prioritized recommendations in the circumstances described.
D:That organization may contribute relevant information but primarily handles improve access to adequate, accurate, up-to-date ownership evidence. It cannot replace the proper lead for participate in peer review and address prioritized recommendations and its associated review record.
E:When examining the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to participate in peer review and address prioritized recommendations, this function normally leads work such as retain essential identification and apply relief only where permitted, which is distinct from the issue at hand. Given the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to participate in peer review and address prioritized recommendations as the distinguishing point, the current responsibility relates to participate in peer review and address prioritized recommendations, so routing it here would misassign accountability.
Question 74
Data engineering has been asked to support work to reconcile source population to monitoring population with exception alerts so that incomplete transaction data ingestion no longer affects outputs. The necessary inputs must be controlled before release. Which dataset or lineage feature must be controlled to resolve the failure?
- Source-to-target field mappings and branch-level counts
- Document feature evidence and issuer reference data
- Canonical date format with provenance and validation rules
- Unique cross-system identity keys and entity merge decisions
Explanation
Correct Answer
A:Given the technical failure of incomplete transaction data ingestion as the distinguishing point, the data dependency must be traceable to the source and the corrected processing step. Control owners need to test its accuracy and availability before judging reconcile source population to monitoring population with exception alerts effective.
Incorrect Answers
B:In assessing the difference between OCR extraction mistaken for document authentication and incomplete transaction data ingestion, that information underpins use document authenticity checks and trusted issuer verification where available when the problem is OCR extraction mistaken for document authentication. The case instead depends on source-to-target field mappings and branch-level counts, which is necessary to correct the stated failure and make the output auditable.
C:The alternative dataset is relevant to inconsistent identity attribute normalization. It would not provide the key input required for reconcile source population to monitoring population with exception alerts in this case, so apparent model performance could still be misleading.
D:When examining the difference between identifier collisions and entity resolution failure and incomplete transaction data ingestion, these attributes help evaluate challenge merged profiles against known distinct-person samples in another workflow. The present failure involves incomplete transaction data ingestion, making source-to-target field mappings and branch-level counts the more direct dependency to verify.
Question 75
A product team asks how to mitigate unaddressed confidence concerns among funding partners without assuming that all activity linked to reputational damage with banking-service disruption is unlawful. A targeted check is preferred. Which control should the team implement at this risk point?
- Risk-weighted capacity allocation and monitoring tuning
- Control-effectiveness testing and remediation ownership
- Board oversight of material AFC remediation commitments
- Environmental-crime indicators in sectoral risk controls
- Corruption-sensitive customer and contract due diligence
Explanation
Correct Answer
C:This measure addresses unaddressed confidence concerns among funding partners, rather than a different typology. Given the exposure to unaddressed confidence concerns among funding partners as the distinguishing point, staff should apply it to the relevant customer, product, or transaction stage and preserve evidence of challenge and follow-up.
Incorrect Answers
A:In assessing the distinction between exposure to high-risk activity concealed by inefficient alert volumes and exposure to unaddressed confidence concerns among funding partners, the measure is more suited to limiting high-risk activity concealed by inefficient alert volumes. With the distinction between exposure to high-risk activity concealed by inefficient alert volumes and exposure to unaddressed confidence concerns among funding partners in view, it does not directly test or prevent unaddressed confidence concerns among funding partners in the described customer or transaction process, even if it might help elsewhere in the AFC program.
B:The alternative would mitigate risks involving policies that exist on paper but are not followed, not the principal failure here. The relevant control design must be built around unaddressed confidence concerns among funding partners, with appropriate evidence and exceptions.
D:This control addresses facilitation of illicit natural-resource proceeds, a different vulnerability. The current exposure is unaddressed confidence concerns among funding partners; installing the alternative without a tailored check would leave the key failure path substantially open.
E:In assessing the distinction between exposure to placement of corruption proceeds in commercial accounts and exposure to unaddressed confidence concerns among funding partners, the measure is more suited to limiting placement of corruption proceeds in commercial accounts. With the distinction between exposure to placement of corruption proceeds in commercial accounts and exposure to unaddressed confidence concerns among funding partners in view, it does not directly test or prevent unaddressed confidence concerns among funding partners in the described customer or transaction process, even if it might help elsewhere in the AFC program.
Question 76
Before closing an audit finding of compromised third-line independence, the assurance team needs evidence that measures to separate control design ownership from independent assurance testing were actually executed. Which record best demonstrates execution rather than merely policy intent?
- Escalation samples reconciled to customer service records
- Reporting charter and recorded board escalations
- Audit independence declarations and approved audit plan
- Responsibility matrix and sampled independent challenge
Explanation
Correct Answer
C:This artifact would show whether separate control design ownership from independent assurance testing was executed and whether compromised third-line independence was reduced in practice. In assessing the deficiency of compromised third-line independence, A signed policy without operating evidence would be an insufficient effectiveness test.
Incorrect Answers
A:That documentation is meaningful where measures to require business staff to report concerns through protected AFC channels are the expected control. The present issue is compromised third-line independence, and the reviewer needs records specifically tracing the chosen remedy.
B:The artifact tests a different process led by board-approved MLRO or BSA officer function. It does not adequately demonstrate that compromised third-line independence is now controlled, even if it could support wider AFC assurance.
D:The proposed evidence corresponds to oversight of blurred first- and second-line responsibility. It would leave the actual remediation, separate control design ownership from independent assurance testing, without a clear operational test in this case.
Question 77
An independent review is verifying FATF mutual evaluation and follow-up process. The expected action is to participate in peer review and address prioritized recommendations, and the reviewer needs a record of performance rather than a statement of policy. Which documentation best shows that the relevant requirement was implemented?
- Sectoral risk assessment with evidence-based drivers
- Risk justification and approved simplified CDD procedure
- Mutual evaluation report with action plan and follow-up
- Risk model change record tied to official national findings
Explanation
Correct Answer
C:In assessing the compliance duty to participate in peer review and address prioritized recommendations, an audit trail has to tie the recorded outcome to the relevant legal or governance requirement. It allows supervisors or auditors to assess whether the required team acted to participate in peer review and address prioritized recommendations under FATF or relevant FATF-style regional body.
Incorrect Answers
A:When examining the separate duty to combine sector data, known typologies, and mitigation capacity as opposed to the current duty to participate in peer review and address prioritized recommendations, such evidence is useful when checking whether combine sector data, known typologies, and mitigation capacity occurred. The scenario instead requires proof that the responsible team acted to participate in peer review and address prioritized recommendations, so the proposed artifact would not show the relevant control or decision.
B:Given the separate duty to retain essential identification and apply relief only where permitted as opposed to the current duty to participate in peer review and address prioritized recommendations as the distinguishing point, this documentation is linked to proportionate simplified due diligence under FATF standards and work performed by domestic AML supervisor setting proportional requirements. It does not directly demonstrate the implementation of the obligation to participate in peer review and address prioritized recommendations in this case.
D:That artifact shows activity in the remit of bank enterprise risk assessment owner, not the performance of the required step. It would be an indirect reference rather than defensible proof that the necessary work to participate in peer review and address prioritized recommendations happened.
Question 78
A team has introduced a solution to reconcile source population to monitoring population with exception alerts in response to incomplete transaction data ingestion. Independent assurance requests a repeatable test using dependable source-to-target field mappings and branch-level counts. What acceptance test best demonstrates control effectiveness?
- Reconstruct past alert decisions from retained system events
- Challenge merged profiles against known distinct-person samples
- Measure mismatches before and after identity normalization
- Compare transaction totals and missing-field rates each cycle
Explanation
Correct Answer
D:When examining the technical failure of incomplete transaction data ingestion, the proposed validation directly challenges the weakness, not an unrelated performance statistic. It can reveal whether reconcile source population to monitoring population with exception alerts works on the relevant data and exceptions before broader deployment.
Incorrect Answers
A:This would be useful when implementing implement decision logs with evidence, reviewer, and timestamp retention, but the key failure here is incomplete transaction data ingestion. In assessing the difference between missing case auditability in lifecycle tooling and incomplete transaction data ingestion, it may pass even if the present defect persists, so it is not the most probative test.
B:This check would reveal failures like identifier collisions and entity resolution failure, not whether reconcile source population to monitoring population with exception alerts corrects the problem in this case. The relevant validation must challenge incomplete transaction data ingestion using source-to-target field mappings and branch-level counts.
C:With the difference between inconsistent identity attribute normalization and incomplete transaction data ingestion in view, the alternative is tailored to standardize data types and apply tested transformation rules and its separate data requirement. It would not provide decisive evidence that the remedy in this scenario eliminates incomplete transaction data ingestion.
Question 79
A payment institution spends heavily investigating low-risk alerts while persistent high-risk corridors are not examined. Which interpretation most directly explains the concern in this case?
- Reputational damage with banking-service disruption
- Operational costs from misallocated compliance resources
- Regulatory enforcement exposure from ineffective implementation
- Overlooking legitimate-source terrorist financing
Explanation
Correct Answer
B:This characterization follows from the particular flow and relationships described, especially the need to establish whether monitoring resources match actual exposure. If substantiated, the resulting vulnerability is high-risk activity concealed by inefficient alert volumes; investigators should separate the alert from proof of the underlying offense.
Incorrect Answers
A:That interpretation is associated with a different situation where investigators must establish whether partner exits were linked to unresolved AFC deficiencies. It would direct attention toward unaddressed confidence concerns among funding partners, whereas this case principally calls for establishing whether monitoring resources match actual exposure; the signals should not be treated as interchangeable.
C:The relevant clue for this alternative would be the need to establish whether staff acted on written escalation duties. No comparable fact is central to this case; the key unresolved link is establishing whether monitoring resources match actual exposure, making the proposed characterization weaker.
D:Given the distinction between exposure to misclassification of terrorist financing because funds are lawful and exposure to high-risk activity concealed by inefficient alert volumes as the distinguishing point, the alternative addresses activity that might produce misclassification of terrorist financing because funds are lawful and would require evidence about whether apparently lawful donations reached a prohibited recipient. Those are not the facts that drive this scenario, whose defining task is to establish whether monitoring resources match actual exposure.
Question 80
A bank appoints a reporting officer but grants no direct route to senior governance for material suspicious-activity issues. What is the principal control-design or governance failure?
- Customer risk assessment that ignores material exposure drivers
- First-line ownership failure in identifying and escalating risk
- Inadequate authority of the MLRO or BSA officer
- Blurred first- and second-line responsibility
Explanation
Correct Answer
C:Given the need to give the designated officer clear escalation authority and access to oversight as the distinguishing point, the decisive control failure lies in the handling of the scenario's specific risk or obligation. The appropriate repair is to give the designated officer clear escalation authority and access to oversight, under the accountability of board-approved MLRO or BSA officer function, and then test its operation.
Incorrect Answers
A:With the contrast between customer risk assessment that ignores material exposure drivers and inadequate authority of the MLRO or BSA officer in view, the alternative diagnosis describes an issue corrected through steps to use transparent ownership, geography, delivery channel, and activity inputs. The scenario instead points to a failure requiring the team to give the designated officer clear escalation authority and access to oversight; confusing the two would send corrective effort to the wrong workflow.
B:When examining the contrast between first-line ownership failure in identifying and escalating risk and inadequate authority of the MLRO or BSA officer, the corresponding consequence of this alternative would be evidenced through escalation samples reconciled to customer service records. The stated control problem has a different operating symptom, addressed by measures to give the designated officer clear escalation authority and access to oversight.
D:In assessing the contrast between blurred first- and second-line responsibility and inadequate authority of the MLRO or BSA officer, this weakness would appear in a process requiring staff to return routine process execution to operations while retaining independent second-line challenge. It is not the defining break in the present case, where the remediation must be designed to give the designated officer clear escalation authority and access to oversight to address the observed behavior.