Question 960
A designated person's US sanctions ownership calculation relied only on nominal voting percentages, although other share classes and economic entitlements may affect the conclusion. After remediation under the OFAC 50 Percent Rule, which focused audit test would detect the original weakness?
- test beneficial economic arrangements and side letters
- check corporate agreements for non-equity control powers
- test ownership dates against settlement timestamps
- review all share classes and economic interests
Explanation
Correct Answer
D:When evaluating apply the US property ownership test, nonvoting equity can still represent ownership even when voting power is allocated differently; this should be tested against capitalization table and share-class rights. The selected check provides continuing verification of control results associated with the requirement to apply the US property ownership test; it should be recorded with identified exceptions and remediation.
Incorrect Answers
A:A person may hold an interest in particular assets even if the entity is not automatically blocked by ownership; this contrast concerns the need to assess property interests outside share ownership, whereas the present record requires the team to apply the US property ownership test. The suggested test therefore concerns a different weakness, whereas the question asks if controls can reliably apply the US property ownership test.
B:UK criteria can capture board appointment powers even below majority share ownership. That observation does not measure the control outcome that matters here: whether staff can apply the US property ownership test. A closer test would inspect capitalization table and share-class rights.
C:This tests the capability to assess effective ownership rather than announcement, not the control gap in deciding to apply the US property ownership test. A targeted assurance procedure should inspect outcomes involving capitalization table and share-class rights.
Question 961
A quarterly review concerns control effectiveness when the institution must use stable identifiers to adjudicate apparent name mismatches. The remediation plan specifies: Investigate account ownership, bank details and sanctioned entity identifiers. The auditor needs a relevant retrospective test. Which follow-up audit procedure most directly tests the intended control?
- review exclusions whenever new bank designations appear
- test cover-message reconciliation and missing-party escalation
- test amended messages for mandatory rescreen triggers
- test match outcomes against identifier evidence
Explanation
Correct Answer
D:A name variation should not override strong evidence linking the account to a restricted owner, which is directly relevant when deciding how to use stable identifiers to adjudicate apparent name mismatches using account ownership record and source-list identifiers. Ongoing testing must detect whether the same failure mode has reappeared.
Incorrect Answers
A:The follow-up is targeted at the separate objective to avoid screening blind spots from trust-based exclusions. For the remediated process, a name variation should not override strong evidence linking the account to a restricted owner. The test should address this mechanism.
B:This would be informative where audit is assessing whether staff can resolve transparency limitations in correspondent payments. In the present case, a name variation should not override strong evidence linking the account to a restricted owner. The proposed sample would not directly test the intended fix.
C:This would be informative where audit is assessing whether staff can reassess newly introduced payment participants; in this assurance inquiry, the probative records are account ownership record and source-list identifiers. In the present case, a name variation should not override strong evidence linking the account to a restricted owner; in this assurance inquiry, the probative records are account ownership record and source-list identifiers. The proposed sample would not directly test the intended fix.
Question 962
The bank has addressed a gap in its ability to evaluate nominee ownership and sanctions entitlement. The implemented measure is: Obtain beneficial interest and control records behind the custody arrangement. An auditor must now look for repeat failure. Which follow-up audit procedure most directly tests the intended control?
- review corporate actions against sanctioned beneficial interests
- test velocity scenarios and cross-customer beneficiary links
- validate renewal workflows against vessel designations
- stress-test list updates in real-time payment flows
Explanation
Correct Answer
A:Nominee titles can obscure the property interests of a blocked person. The follow-up directly tests whether staff can evaluate nominee ownership and sanctions entitlement when the risk returns.
Incorrect Answers
B:That procedure would help test control performance when the goal is to allocate controls based on speed, volume and destination risk. The remediation under review is meant to evaluate nominee ownership and sanctions entitlement; the specific proof to examine is beneficial owner register and custody allocation records.
C:This would be informative where audit is assessing whether staff can determine whether insurance support is restricted. In the present case, nominee titles can obscure the property interests of a blocked person. The proposed sample would not directly test the intended fix.
D:Post-settlement alerts may arrive too late to prevent prohibited dealings. That observation does not measure the control outcome that matters here: whether staff can evaluate nominee ownership and sanctions entitlement. A closer test would inspect beneficial owner register and custody allocation records.
Question 963
A quarterly review concerns control effectiveness when the institution must identify retained beneficial control after nominal transfer. The remediation plan specifies: Examine voting proxies, economic rights and legal transfer substance. The auditor needs a relevant retrospective test. Which follow-up audit procedure most directly tests the intended control?
- monitor successor entities and continuing license agreements
- review distribution decisions and changes in protectors
- compare registry history and management continuity
- reassess economic and voting control following restructurings
Explanation
Correct Answer
D:A paper ownership change may leave the designated person with relevant interests or control. Ongoing testing must detect whether the same failure mode has reappeared.
Incorrect Answers
A:That procedure would help test control performance when the goal is to investigate corporate successor identity and control. The remediation under review is meant to identify retained beneficial control after nominal transfer; the specific proof to examine is share-transfer documents and side agreements.
B:This would be informative where audit is assessing whether staff can investigate influence and entitlement in the trust structure. In the present case, a paper ownership change may leave the designated person with relevant interests or control. The proposed sample would not directly test the intended fix.
C:For the distinct task to test whether address churn masks entity continuity, address changes may be cosmetic when business operations and beneficial control remain unchanged; this question instead requires a decision to identify retained beneficial control after nominal transfer. That observation does not measure the control outcome that matters here: whether staff can identify retained beneficial control after nominal transfer. A closer test would inspect share-transfer documents and side agreements.
Question 964
An independent tester is reviewing a control designed to investigate customer capability and diversion risk. The control owner describes the procedure as: Verify business function, installation site and credible need for the machines. The tester must establish whether it works in live operations. Which follow-up audit procedure most directly tests the intended control?
- trend origin-document mismatches and supplier remediation
- review high-value first-time orders for customer-purpose mismatch
- sample commodity descriptions against technical data
- compare end-user statements with routing events
- test whether combined red flags trigger escalation
Explanation
Correct Answer
B:An inexperienced intermediary purchasing advanced technology can signal hidden end use. The selected test checks recurring activity relevant to the need to investigate customer capability and diversion risk.
Incorrect Answers
A:False origin declarations may disguise restricted-country sourcing or import prohibitions. That observation does not measure the control outcome that matters here: whether staff can investigate customer capability and diversion risk. A closer test would inspect site information and customer business records.
C:A generic invoice description is not a reliable export-control classification. That observation does not measure the control outcome that matters here: whether staff can investigate customer capability and diversion risk; in this assurance inquiry, the probative records are site information and customer business records. A closer test would inspect site information and customer business records.
D:This tests the capability to identify the actual ultimate end user, not the control gap in deciding to investigate customer capability and diversion risk. A targeted assurance procedure should inspect outcomes involving site information and customer business records.
E:The follow-up is targeted at the separate objective to treat unusual trade behavior as a diversion red flag. For the remediated process, an inexperienced intermediary purchasing advanced technology can signal hidden end use. The test should address this mechanism.
Question 965
An independent tester is reviewing a control designed to verify recipients without assuming all aid is prohibited. The control owner describes the procedure as: Conduct partner due diligence and determine available humanitarian authorizations. The tester must establish whether it works in live operations. Which follow-up audit procedure most directly tests the intended control?
- review grant spending evidence and partner changes
- compare current and former vessel identities during charter review
- re-screen claims payees near disbursement
- audit high-value third-party purchases for hidden beneficiaries
- test provenance documents for consistency with physical logistics
Explanation
Correct Answer
A:To determine whether the institution consistently can verify recipients without assuming all aid is prohibited, audit should inspect actual case outcomes. Relief activities require both sanctions-law analysis and controls over downstream benefit. That is what this follow-up is designed to evidence.
Incorrect Answers
B:The proposed check measures a risk connected with the need to apply diligence to maritime identifiers and controllers. It does not directly retest whether the institution now can verify recipients without assuming all aid is prohibited, using partner due diligence and program license terms.
C:The proposed check measures a risk connected with the need to check the actual property interest in a payment. It does not directly retest whether the institution now can verify recipients without assuming all aid is prohibited, using partner due diligence and program license terms; in this assurance inquiry, the probative records are partner due diligence and program license terms.
D:This tests the capability to identify the ultimate purchaser and source of payment, not the control gap in deciding to verify recipients without assuming all aid is prohibited. A targeted assurance procedure should inspect outcomes involving partner due diligence and program license terms.
E:The option might produce useful assurance about the ability to identify sanctioned supply origins, but not the weakness requiring proof that staff can verify recipients without assuming all aid is prohibited. Records including partner due diligence and program license terms matter here.
Question 966
An independent tester is reviewing a control designed to evaluate sanctionability separately from a primary-law violation. The control owner describes the procedure as: Analyze the specific statutory secondary-sanctions triggers and potential consequences. The tester must establish whether it works in live operations. Which follow-up audit procedure most directly tests the intended control?
- review and document conflicts of law and regulator-authorized exceptions
- review deviations and conflicts across countries
- monitor external designation developments and material-risk decisions
- sample country attribute mappings and false-positive closures
- test nexus assessments against transaction evidence
Explanation
Correct Answer
C:Secondary measures may expose non-US actors to designation or restrictions without making every transaction a direct primary breach; the assurance aspect of this decision should be evaluated against transaction activity and relevant secondary criteria in response to a non-US lender is warned that an overseas deal may trigger secondary sanctions but no US-person nexus exists. The selected test checks recurring activity relevant to the need to evaluate sanctionability separately from a primary-law violation.
Incorrect Answers
A:The proposed check measures a risk connected with the need to manage a genuine conflict of laws rather than choose one casually. It does not directly retest whether the institution now can evaluate sanctionability separately from a primary-law violation, using transaction activity and relevant secondary criteria.
B:The proposed check measures a risk connected with the need to distinguish policy risk appetite from mandatory local law. It does not directly retest whether the institution now can evaluate sanctionability separately from a primary-law violation, using transaction activity and relevant secondary criteria; in this assurance inquiry, the probative records are transaction activity and relevant secondary criteria.
D:The option might produce useful assurance about the ability to avoid unsupported territorial assumptions, but not the weakness requiring proof that staff can evaluate sanctionability separately from a primary-law violation. Records including transaction activity and relevant secondary criteria matter here.
E:Testing that area does not confirm whether this remediation works in the circumstances requiring evaluate sanctionability separately from a primary-law violation. Secondary measures may expose non-US actors to designation or restrictions without making every transaction a direct primary breach; this alternative supports a different inquiry to identify actual sanctions nexus before legal characterization, whereas the current task is to evaluate sanctionability separately from a primary-law violation using transaction activity and relevant secondary criteria. The suggested assurance is insufficiently specific.
Question 967
After a control gap relating to the ability to perform transaction-level due diligence, compliance must provide both a corrective response and proof that remediation works in live activity. The former review memo contained the flawed assumption: approve all future transfers automatically after low-risk onboarding. Which TWO choices jointly provide these elements? Choose TWO.
- Review the actual transaction's destination, participants, asset and purpose
- Resolve location context and supporting business records before final disposition
- Investigate the payment purpose and downstream party receiving the benefit
- reassess transactions when counterparties or destinations change
- review owners against current sanctions sources and controls
Explanation
Correct Answers
A:The requested decision is whether and how to perform transaction-level due diligence. Customer risk ratings do not replace event-specific checks for prohibited activity. Acting on this exposure requires a targeted operational response supported by payment details, shipment documents and transaction rationale.
D:Customer risk ratings do not replace event-specific checks for prohibited activity. A control test should measure what the remediation actually prevented; sample-based verification is more persuasive than an assertion that the issue was closed; in this assurance inquiry, the probative records are payment details, shipment documents and transaction rationale.
Incorrect Answers
B:For the distinct task to avoid treating a keyword as conclusive evidence, textual mentions may refer to a historic event, person or destination rather than restricted activity; this question instead requires a decision to perform transaction-level due diligence. Its focus is on how to avoid treating a keyword as conclusive evidence, not the present need to perform transaction-level due diligence. The decisive facts here are found in payment details, shipment documents and transaction rationale.
C:Sanctions exposure can arise through indirect provision of funds to a restricted target. Its focus is on how to resolve the economic beneficiary before clearance, not the present need to perform transaction-level due diligence. The decisive facts here are found in payment details, shipment documents and transaction rationale; in this assurance inquiry, the probative records are payment details, shipment documents and transaction rationale.
E:The follow-up is targeted at the separate objective to separate designation findings from broader exposure. For the remediated process, customer risk ratings do not replace event-specific checks for prohibited activity. The test should address this mechanism.
Question 968
A quarterly review concerns control effectiveness when the institution must determine whether a restrictive measure is legally operative. The remediation plan specifies: Verify the adopted Council legal act and its entry-into-force provisions. The auditor needs a relevant retrospective test. Which follow-up audit procedure most directly tests the intended control?
- retest relevant transactions against revised activity prohibitions
- test list-update latency and retroactive exposure review
- compare pending proposals with published final legal texts
- compare sanctions obligations for each branch after regulatory changes
Explanation
Correct Answer
C:When evaluating determine whether a restrictive measure is legally operative, political statements signal potential change but do not replace binding EU regulations or decisions; this should be tested against Official Journal publication and applicable commencement clause. Repeating the selected check against actual activity will show whether decisions to determine whether a restrictive measure is legally operative now follow the intended control.
Incorrect Answers
A:This tests the capability to identify what changed before altering controls, not the control gap in deciding to determine whether a restrictive measure is legally operative. A targeted assurance procedure should inspect outcomes involving Official Journal publication and applicable commencement clause.
B:This tests the capability to establish the time at which the new restriction became applicable, not the control gap in deciding to determine whether a restrictive measure is legally operative. A targeted assurance procedure should inspect outcomes involving Official Journal publication and applicable commencement clause; in this assurance inquiry, the probative records are Official Journal publication and applicable commencement clause.
D:Lists and legal prohibitions vary by jurisdiction even when targets overlap. That observation does not measure the control outcome that matters here: whether staff can determine whether a restrictive measure is legally operative. A closer test would inspect Official Journal publication and applicable commencement clause.
Question 969
The bank has addressed a gap in its ability to provide accurate but appropriately limited notice. The implemented measure is: Explain the status and lawful contact route without disclosing protected reporting material. An auditor must now look for repeat failure. Which follow-up audit procedure most directly tests the intended control?
- test template messages for inadvertent investigation disclosure
- review outbound messages for protected investigation information
- check communications against reporting secrecy and sanctions requirements
- review unusual pre-effective-date transfers and communications
Explanation
Correct Answer
C:When evaluating provide accurate but appropriately limited notice, notification of a legal restriction can be distinct from revealing confidential suspicious activity reports; this should be tested against validated blocking status and approved notice guidance. The proposed review of operational outcomes can reveal recurrence of the failure to provide accurate but appropriately limited notice.
Incorrect Answers
A:For the distinct task to separate customer-facing explanations from privileged case analysis, a customer can receive appropriate operational information without sensitive internal investigative reasoning; this question instead requires a decision to provide accurate but appropriately limited notice. That observation does not measure the control outcome that matters here: whether staff can provide accurate but appropriately limited notice. A closer test would inspect validated blocking status and approved notice guidance.
B:The option might produce useful assurance about the ability to distinguish necessary service notice from revealing investigative details, but not the weakness requiring proof that staff can provide accurate but appropriately limited notice. Records including validated blocking status and approved notice guidance matter here.
D:Testing that area does not confirm whether this remediation works in the circumstances requiring provide accurate but appropriately limited notice. Notification of a legal restriction can be distinct from revealing confidential suspicious activity reports; this alternative supports a different inquiry to prevent assistance that could frustrate sanctions implementation, whereas the current task is to provide accurate but appropriately limited notice using validated blocking status and approved notice guidance. The suggested assurance is insufficiently specific.
Question 970
An independent tester is reviewing a control designed to assess sanctions exposure without equating political status with designation. The control owner describes the procedure as: Map controlled entities and relevant restrictive measures through enhanced due diligence. The tester must establish whether it works in live operations. Which follow-up audit procedure most directly tests the intended control?
- review PEP-related sanctions exposure separately from AML findings
- monitor service changes against authorization scope
- sample beneficial owner records and subaccount movements
- monitor changes in ownership and routing
- test acquired customer and payment files after migration
Explanation
Correct Answer
A:Political prominence may increase scrutiny but does not itself prove a sanctions prohibition. The selected check provides continuing verification of control results associated with the requirement to assess sanctions exposure without equating political status with designation; it should be recorded with identified exceptions and remediation.
Incorrect Answers
B:Some travel-related activity may be exempt while related commercial services remain restricted; this contrast concerns the need to evaluate the actual travel activity and financial restrictions, whereas the present record requires the team to assess sanctions exposure without equating political status with designation. That observation does not measure the control outcome that matters here: whether staff can assess sanctions exposure without equating political status with designation. A closer test would inspect verified ownership chart and designation identifiers.
C:That procedure would help test control performance when the goal is to assess underlying investor and control exposure. The remediation under review is meant to assess sanctions exposure without equating political status with designation; the specific proof to examine is verified ownership chart and designation identifiers.
D:Testing that area does not confirm whether this remediation works in the circumstances requiring assess sanctions exposure without equating political status with designation. Political prominence may increase scrutiny but does not itself prove a sanctions prohibition. The suggested assurance is insufficiently specific.
E:This would be informative where audit is assessing whether staff can identify inherited business and integration risk. In the present case, political prominence may increase scrutiny but does not itself prove a sanctions prohibition. The proposed sample would not directly test the intended fix.