Question 1080
The bank has addressed a gap in its ability to identify the correct Australian sanctions-list authority. The implemented measure is: Use DFAT's Australian Sanctions Office and Consolidated List for sanctions designations. An auditor must now look for repeat failure. Which follow-up audit procedure most directly tests the intended control?
- test cross-border nexus fields in onboarding and payment controls
- compare vendor source feeds against the current UK source
- check authority labels in customer-screening metadata
- review authority ownership in policy and source feed governance
Explanation
Correct Answer
D:AUSTRAC supervises AML/CTF obligations, while the ASO maintains Australia's sanctions list. The selected check provides continuing verification of control results associated with the requirement to identify the correct Australian sanctions-list authority; it should be recorded with identified exceptions and remediation.
Incorrect Answers
A:EU restrictive measures can apply to nationals and EU-incorporated entities beyond EU territory; this contrast concerns the need to establish which persons and activities EU rules cover, whereas the present record requires the team to identify the correct Australian sanctions-list authority. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably identify the correct Australian sanctions-list authority.
B:This tests the capability to use the designated official UK list source, not the control gap in deciding to identify the correct Australian sanctions-list authority. A targeted assurance procedure should inspect outcomes involving DFAT Consolidated List and agency responsibility guidance.
C:Parallel national measures do not become UN sanctions without Security Council action. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably identify the correct Australian sanctions-list authority; in this assurance inquiry, the probative records are DFAT Consolidated List and agency responsibility guidance.
Question 1081
Following changes to controls intended to distinguish exemption from licensed authorization, an audit team wants evidence of sustained effectiveness. The implemented response is documented as: Review the specific program's statutory exemption and license wording. Which follow-up audit procedure most directly tests the intended control?
- sample invoices against licensed categories and reporting terms
- track license ground, conditions and decision rationale
- Accept management sign-off for distinguish exemption from licensed authorization without sampling program text and applicable humanitarian authorization
- test eligibility conditions for humanitarian transactions
Explanation
Correct Answer
D:When evaluating distinguish exemption from licensed authorization, humanitarian purpose alone does not determine whether authorization is automatic under a given regime; this should be tested against program text and applicable humanitarian authorization. The follow-up directly tests whether staff can distinguish exemption from licensed authorization when the risk returns.
Incorrect Answers
A:A license covers only its express activity and conditions, not all dealings with a target. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably distinguish exemption from licensed authorization.
B:The follow-up is targeted at the separate objective to review available statutory licensing grounds. For the remediated process, humanitarian purpose alone does not determine whether authorization is automatic under a given regime. The test should address this mechanism.
C:A management attestation can establish that a procedure was approved, but cannot show that controls for distinguish exemption from licensed authorization worked. Independent testing should inspect actual program text and applicable humanitarian authorization and outcomes, rather than treating sign-off as operating-effectiveness proof.
Question 1082
A sanctions-control issue concerning the ability to identify suspicious rerouting and authorization gaps was marked remediated. The agreed intervention is: Reconfirm ultimate destination and reassess licenses before dispatch. The assurance function will test actual cases rather than management attestations. Which follow-up audit procedure most directly tests the intended control?
- monitor deviations from licensed consignee data
- audit cargo-description discrepancies and resolution
- track late changes to destination and buyer identity
- review red flags involving mismatched customer capability
Explanation
Correct Answer
C:A change in destination can shift sanctions and export-control requirements. The proposed review of operational outcomes can reveal recurrence of the failure to identify suspicious rerouting and authorization gaps.
Incorrect Answers
A:This would be informative where audit is assessing whether staff can reassess a change in authorization scope. In the present case, a change in destination can shift sanctions and export-control requirements. The proposed sample would not directly test the intended fix.
B:The option might produce useful assurance about the ability to test document consistency before trade financing, but not the weakness requiring proof that staff can identify suspicious rerouting and authorization gaps. Records including change order, end-user confirmation and license scope matter here.
D:The follow-up is targeted at the separate objective to resolve end-use concerns before sale. For the remediated process, a change in destination can shift sanctions and export-control requirements. The test should address this mechanism.
Question 1083
An independent tester is reviewing a control designed to manage a genuine conflict of laws rather than choose one casually. The control owner describes the procedure as: Escalate to cross-border sanctions counsel and assess the specific blocking statute and exceptions. The tester must establish whether it works in live operations. Which follow-up audit procedure most directly tests the intended control?
- review approval chains for restricted US-person participation
- monitor external designation developments and material-risk decisions
- test origin and reexport classification at each handoff
- sample country attribute mappings and false-positive closures
- review and document conflicts of law and regulator-authorized exceptions
Explanation
Correct Answer
E:When evaluating manage a genuine conflict of laws rather than choose one casually, EU blocking measures may restrict compliance with certain listed extraterritorial foreign laws; this should be tested against applicable blocked US measures and EU blocking regulation annex. The selected check provides continuing verification of control results associated with the requirement to manage a genuine conflict of laws rather than choose one casually; it should be recorded with identified exceptions and remediation.
Incorrect Answers
A:A US individual can remain subject to relevant OFAC prohibitions while working abroad. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably manage a genuine conflict of laws rather than choose one casually.
B:The option might produce useful assurance about the ability to evaluate sanctionability separately from a primary-law violation, but not the weakness requiring proof that staff can manage a genuine conflict of laws rather than choose one casually. Records including applicable blocked US measures and EU blocking regulation annex matter here.
C:The proposed check measures a risk connected with the need to identify export-control nexus beyond payment currency; in this assurance inquiry, the probative records are applicable blocked US measures and EU blocking regulation annex. It does not directly retest whether the institution now can manage a genuine conflict of laws rather than choose one casually, using applicable blocked US measures and EU blocking regulation annex.
D:The option might produce useful assurance about the ability to avoid unsupported territorial assumptions, but not the weakness requiring proof that staff can manage a genuine conflict of laws rather than choose one casually. Records including applicable blocked US measures and EU blocking regulation annex matter here.
Question 1084
Following changes to controls intended to standardize geographic data mapping, an audit team wants evidence of sustained effectiveness. The implemented response is documented as: Implement controlled jurisdiction codes and validated aliases. Which follow-up audit procedure most directly tests the intended control?
- test reversible lineage for critical identity fields
- test geographic value coverage and translation rules
- run field-level integrity checks for each list revision
- review country-tag changes against applicable sanctions law
Explanation
Correct Answer
B:Unmapped geographic values can bypass geography-dependent controls. The selected test checks recurring activity relevant to the need to standardize geographic data mapping.
Incorrect Answers
A:The proposed check measures a risk connected with the need to retain raw source identities alongside normalized values; in this assurance inquiry, the probative records are country-code dictionary and raw source values. It does not directly retest whether the institution now can standardize geographic data mapping, using country-code dictionary and raw source values.
C:The follow-up is targeted at the separate objective to validate content rather than counts alone. For the remediated process, unmapped geographic values can bypass geography-dependent controls. The test should address this mechanism.
D:The option might produce useful assurance about the ability to separate external scoring from legal controls, but not the weakness requiring proof that staff can standardize geographic data mapping. Records including country-code dictionary and raw source values matter here.
Question 1085
Compliance has already implemented an operational remedy to reassess newly introduced payment participants. The documented process change is: Screen new intermediaries and record the amended routing decision. Independent testing is now required. Which follow-up audit procedure most directly tests the intended control?
- review exclusions whenever new bank designations appear
- simulate high-speed settlement with seeded designated-party alerts
- test amended messages for mandatory rescreen triggers
- test field coverage with known-party examples
Explanation
Correct Answer
C:To determine whether the institution consistently can reassess newly introduced payment participants, audit should inspect actual case outcomes. Material routing changes can add a sanctioned institution or jurisdiction after initial review; the assurance aspect of this decision should be evaluated against payment amendment and final routing chain in response to a USD wire clears initial sanctions checks but is rerouted through a different intermediary before settlement. That is what this follow-up is designed to evidence.
Incorrect Answers
A:The option might produce useful assurance about the ability to avoid screening blind spots from trust-based exclusions, but not the weakness requiring proof that staff can reassess newly introduced payment participants. Records including payment amendment and final routing chain matter here.
B:This tests the capability to control screening before irrevocable value transfer, not the control gap in deciding to reassess newly introduced payment participants. A targeted assurance procedure should inspect outcomes involving payment amendment and final routing chain.
D:The follow-up is targeted at the separate objective to screen relevant parties throughout the payment chain. For the remediated process, material routing changes can add a sanctioned institution or jurisdiction after initial review. The test should address this mechanism.
Question 1086
An audit finding concerns the process used to resolve end-use concerns before sale. The closure file requires an actual remedy and a targeted control-effectiveness test. An earlier decision relied on the unsupported shortcut to consider a clean party screen a complete end-use check. Which TWO choices jointly provide these elements? Choose TWO.
- Screen parties and investigate applicable catch-all restrictions
- review red flags involving mismatched customer capability
- Determine US export-control jurisdiction and applicable reexport rules
- review high-value first-time orders for customer-purpose mismatch
- Seek an end-use statement and independently verify the customer and intended facility
Explanation
Correct Answers
B:Some items may be restricted based on end use even when not obviously military hardware. The selected test checks recurring activity relevant to the need to resolve end-use concerns before sale.
E:Some items may be restricted based on end use even when not obviously military hardware. To meet the objective to resolve end-use concerns before sale, obtain and preserve end-user undertaking and facility verification.
Incorrect Answers
A:Operationally, the alternative is meant to consider end-user and end-use controls even for non-CCL items; it does not prove the present assessment. Some items may be restricted based on end use even when not obviously military hardware. The first relevant corroboration is end-user undertaking and facility verification.
C:Although the measure can help when the task is to evaluate reexport and foreign-direct-product implications where relevant, it is not the most direct intervention to resolve end-use concerns before sale. Some items may be restricted based on end use even when not obviously military hardware. Confirm the case using end-user undertaking and facility verification.
D:The follow-up is targeted at the separate objective to investigate customer capability and diversion risk; in this assurance inquiry, the probative records are end-user undertaking and facility verification. For the remediated process, some items may be restricted based on end use even when not obviously military hardware. The test should address this mechanism.
Question 1087
A sanctions-control issue concerning the ability to determine whether the financing itself is prohibited was marked remediated. The agreed intervention is: Check tenor, issuer, issuance date and relevant sectoral directive before booking. The assurance function will test actual cases rather than management attestations. Which follow-up audit procedure most directly tests the intended control?
- test product controls alongside party screening
- reconcile frozen positions and prohibited debits
- compare vessel identification against movement and ownership history
- sample tenors and issuance dates against directive conditions
Explanation
Correct Answer
D:Sectoral restrictions often turn on the type and terms of financial instrument rather than full ownership blocking; the assurance aspect of this decision should be evaluated against debt contract terms and governing directive in response to a broker proposes a new loan to an entity subject only to an applicable sectoral new-debt restriction. The selected test checks recurring activity relevant to the need to determine whether the financing itself is prohibited.
Incorrect Answers
A:The proposed check measures a risk connected with the need to identify non-name-based goods restrictions. It does not directly retest whether the institution now can determine whether the financing itself is prohibited, using debt contract terms and governing directive.
B:That procedure would help test control performance when the goal is to determine the effect of an asset freeze on property interests. The remediation under review is meant to determine whether the financing itself is prohibited; the specific proof to examine is debt contract terms and governing directive.
C:A sanctions list may identify vessels separately from the counterparties who operate them. That observation does not measure the control outcome that matters here: whether staff can determine whether the financing itself is prohibited. A closer test would inspect debt contract terms and governing directive.
Question 1088
A quarterly review concerns control effectiveness when the institution must assess changes in the goods' status and final use over time. The remediation plan specifies: Reassess destination, reexport requirements and current control rules before onward shipment. The auditor needs a relevant retrospective test. Which follow-up audit procedure most directly tests the intended control?
- sample foreign-branch deals for EU-entity nexus
- review deviations and conflicts across countries
- review downstream destination changes and license conditions
- compare customer representations with destination evidence
Explanation
Correct Answer
C:Compliance at the initial export does not prove a subsequent transfer is permissible. The selected test checks recurring activity relevant to the need to assess changes in the goods' status and final use over time.
Incorrect Answers
A:EU legal persons incorporated under Member State law can be covered even outside EU territory. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably assess changes in the goods' status and final use over time.
B:The follow-up is targeted at the separate objective to distinguish policy risk appetite from mandatory local law. For the remediated process, compliance at the initial export does not prove a subsequent transfer is permissible. The test should address this mechanism.
D:The follow-up is targeted at the separate objective to look beyond the immediate consignee. For the remediated process, compliance at the initial export does not prove a subsequent transfer is permissible; in this assurance inquiry, the probative records are onward-sale documents and prevailing classification restrictions. The test should address this mechanism.
Question 1089
A sanctions-control issue concerning the ability to test whether address churn masks entity continuity was marked remediated. The agreed intervention is: Use persistent company identifiers, officers and operating records. The assurance function will test actual cases rather than management attestations. Which follow-up audit procedure most directly tests the intended control?
- monitor successor entities and continuing license agreements
- review agent-submitted applications for identity conflicts
- review related-party divestments for beneficial interest retention
- compare registry history and management continuity
Explanation
Correct Answer
D:To determine whether the institution consistently can test whether address churn masks entity continuity, audit should inspect actual case outcomes. Address changes may be cosmetic when business operations and beneficial control remain unchanged; the assurance aspect of this decision should be evaluated against corporate filings and fixed operational identifiers in response to a company moves its registered office repeatedly after sanctions publications while operations stay at the same site. That is what this follow-up is designed to evidence.
Incorrect Answers
A:That procedure would help test control performance when the goal is to investigate corporate successor identity and control; in this assurance inquiry, the probative records are corporate filings and fixed operational identifiers. The remediation under review is meant to test whether address churn masks entity continuity; the specific proof to examine is corporate filings and fixed operational identifiers.
B:For the distinct task to detect fabricated ownership disclosure, repeated boilerplate declarations can conceal shared designated owners behind fictitious businesses; this question instead requires a decision to test whether address churn masks entity continuity. That observation does not measure the control outcome that matters here: whether staff can test whether address churn masks entity continuity. A closer test would inspect corporate filings and fixed operational identifiers.
C:That procedure would help test control performance when the goal is to investigate value transfer and divestment substance. The remediation under review is meant to test whether address churn masks entity continuity; the specific proof to examine is corporate filings and fixed operational identifiers; in this assurance inquiry, the probative records are corporate filings and fixed operational identifiers.
Question 1090
Following changes to controls intended to assess property interests outside share ownership, an audit team wants evidence of sustained effectiveness. The implemented response is documented as: Review contractual economic rights and applicable property-blocking provisions separately from the 50 percent entity rule. Which follow-up audit procedure most directly tests the intended control?
- test beneficial economic arrangements and side letters
- review distributions and beneficial interests periodically
- review control concerns without changing the statutory threshold
- reconcile nominee positions and underlying owner identities
Explanation
Correct Answer
A:A person may hold an interest in particular assets even if the entity is not automatically blocked by ownership; the assurance aspect of this decision should be evaluated against side letter and economic entitlement clauses in response to a designated person appears to have no equity but is entitled to assets under a side agreement. The selected check provides continuing verification of control results associated with the requirement to assess property interests outside share ownership; it should be recorded with identified exceptions and remediation.
Incorrect Answers
B:Sanctions analysis must consider substantive interests in property, not only account titles. That observation does not measure the control outcome that matters here: whether staff can assess property interests outside share ownership. A closer test would inspect side letter and economic entitlement clauses.
C:The proposed check measures a risk connected with the need to distinguish OFAC automatic ownership blocking from control risk; in this assurance inquiry, the probative records are side letter and economic entitlement clauses. It does not directly retest whether the institution now can assess property interests outside share ownership, using side letter and economic entitlement clauses.
D:Nominee fragmentation cannot erase a designated person's actual equity interest. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably assess property interests outside share ownership.