Question 780
The AFC team needs to demonstrate sustained remediation for the following weakness: A bank screens PEPs only during initial account opening. Which validation is appropriate?
- Sample mule referrals for consistent risk reassessment and action
- Seed new-PEP events and inspect alerts plus escalation records
- Sample PEP accounts for ownership verification and approval evidence
- Test entity inventories for inclusion across applicable AFC assessments
Explanation
Correct Answer
B:The test verifies continuing coverage rather than one-time clearance. The assessment probes the affected transactions and decisions, not just an adjacent risk such as a fraud team sees mule-account patterns that the AML team never incorporates into customer….
Incorrect Answers
A:The relevant alternative mechanism is different from a bank screens PEPs only during initial account opening: Testing checks whether relevant fraud intelligence drives AFC review. This assurance method targets a fraud team sees mule-account patterns that the AML team never incorporates into customer risk… rather than the reported process: a bank screens PEPs only during initial account opening.
C:This is not the central mechanism when a bank screens PEPs only during initial account opening; the review tests whether heightened scrutiny is substantive. The sample would be probative if a new customer is a PEP whose funds arrive from a closely held firm with undisclosed controllers; a different population and test are needed for a bank screens PEPs only during initial account opening.
D:When testing the contrasting pattern of a bank screens PEPs only during initial account opening, remember that assurance checks that material subsidiaries are not invisible in specialist reporting. The test exercises an adjacent pathway, a high-risk subsidiary is included in the enterprise risk assessment but not in the…, without directly challenging a bank screens PEPs only during initial account opening.
Question 781
The compliance team introduces remediation for this weakness: An MSB withdraws from an entire remittance corridor after isolated suspicious cases without analyzing the wider portfolio. Which evidence best shows it is functioning?
- Compare segment outcomes before and after risk-based changes
- Audit high-risk exits for committee approval and documented rationale
- Sample recorded customer contacts for report-specific disclosures
- Audit productions against the request and approval inventory
- Sample exchanges for channel classification and retention evidence
Explanation
Correct Answer
A:Testing evaluates whether targeted safeguards preserve control effectiveness and access. The proposed sample exercises the failure seen in an MSB withdraws from an entire remittance corridor after isolated suspicious cases without analyzing…, rather than the separate pathway represented by a bank decides to exit a high-risk customer while two divisions disagree about who has….
Incorrect Answers
B:Compared with the stated facts about an MSB withdraws from an entire remittance corridor after isolated suspicious cases…, assurance can reveal inconsistent or unauthorized account closures. This assurance method targets a bank decides to exit a high-risk customer while two divisions disagree about who has approval… rather than the reported process: an MSB withdraws from an entire remittance corridor after isolated suspicious cases without….
C:This is not the central mechanism when an MSB withdraws from an entire remittance corridor after isolated suspicious cases…; assurance tests whether confidentiality rules are followed in practice. Testing this would validate controls for a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…, not the effectiveness of remediation for an MSB withdraws from an entire remittance corridor after isolated suspicious cases without….
D:When testing the contrasting pattern of an MSB withdraws from an entire remittance corridor after isolated suspicious cases…, remember that assurance detects overproduction, omissions, and unexplained transfers. The sample would be probative if a bank responds to a law-enforcement subpoena by providing unrelated records outside the requested…; a different population and test are needed for an MSB withdraws from an entire remittance corridor after isolated suspicious cases without….
E:Testing ensures searches and disclosures follow the proper framework; the observed record here instead involves an MSB withdraws from an entire remittance corridor after isolated suspicious cases…. The test exercises an adjacent pathway, a bank treats a voluntary interbank information request as an automatic section 314(a) government…, without directly challenging an MSB withdraws from an entire remittance corridor after isolated suspicious cases without….
Question 782
A firm wants measurable assurance for this identified exposure: A graph model flags every customer sharing a common public IP address as a criminal network. Which evaluation should be conducted?
- Test benign shared-IP clusters for false positive network formation
- Back-test model versions and check drift plus approval evidence
- Inject unsupported relationships and verify they are rejected in review
- Sample OSINT assertions for verifiable sources and dated captures
- Seed ambiguous high-risk matches and examine reviewer escalation
Explanation
Correct Answer
A:Assurance checks that weak links do not dominate suspicious-group classification. For the supported action of test benign shared-ip clusters for false positive network formation in this effectiveness test review involving a graph model flags every customer sharing a common public IP address as a criminal network, success on this scenario would be relevant to the original failure, whereas a data scientist deploys a revised monitoring model without documenting validation or… tests a different exposure.
Incorrect Answers
B:When testing the contrasting pattern of a graph model flags every customer sharing a common public IP address as a criminal…, remember that assurance determines whether changes preserved detection effectiveness. The sample would be probative if a data scientist deploys a revised monitoring model without documenting validation or independent…; a different population and test are needed for a graph model flags every customer sharing a common public IP address as a criminal network.
C:Testing measures whether errors are caught before escalation and reporting; the observed record here instead involves a graph model flags every customer sharing a common public IP address as a criminal…. The test exercises an adjacent pathway, a case system auto-generates suspicious-activity narratives using AI that sometimes invents account…, without directly challenging a graph model flags every customer sharing a common public IP address as a criminal network.
D:Against the reported situation in which a graph model flags every customer sharing a common public IP address as a criminal…, the test distinguishes investigative evidence from unsupported summaries. Even a favorable result for investigators copy public social-media information into cases without recording where or when they… would not demonstrate the control works when a graph model flags every customer sharing a common public IP address as a criminal network.
E:The relevant alternative mechanism is different from a graph model flags every customer sharing a common public IP address as a criminal…: Assurance checks that automation does not bypass critical adjudication. This assurance method targets an institution uses AI to prioritize sanctions cases but lets the system permanently clear… rather than the reported process: a graph model flags every customer sharing a common public IP address as a criminal network.
Question 783
A remediation is marked complete for this case: Internal audit designs the transaction monitoring rules it must later assess. Which operational test would best challenge that claim?
- Verify auditors did not approve the controls they later audited
- Test whether serious findings reached the board and caused remediation
- Recalculate sample scores to verify controls affect only residual risk
- Challenge high-effectiveness ratings against unresolved audit findings
Explanation
Correct Answer
A:Workpaper review and role histories expose impaired independence. The proposed sample exercises the failure seen in internal audit designs the transaction monitoring rules it must later assess, rather than the separate pathway represented by an AML department has written procedures but no authority to challenge a revenue-generating….
Incorrect Answers
B:Assurance should check implemented decisions rather than the existence of policy documents; the observed record here instead involves internal audit designs the transaction monitoring rules it must later assess. This assurance method targets an AML department has written procedures but no authority to challenge a revenue-generating… rather than the reported process: internal audit designs the transaction monitoring rules it must later assess.
C:Against the reported situation in which internal audit designs the transaction monitoring rules it must later assess, testing detects models that double-count or hide mitigation. Testing this would validate controls for a bank calculates inherent country risk after deducting the effectiveness of its screening controls, not the effectiveness of remediation for internal audit designs the transaction monitoring rules it must later assess.
D:The relevant alternative mechanism is different from internal audit designs the transaction monitoring rules it must later assess: The review checks for credible evidence supporting risk reductions. The sample would be probative if a bank uses the number of written AML policies as proof that residual risk is low; a different population and test are needed for internal audit designs the transaction monitoring rules it must later assess.
Question 784
An institution has corrected a process after discovering this case: A bank treats a voluntary interbank information request as an automatic section 314(a) government search. Which test best proves the relevant safeguard operates?
- Review rejection reasons and verified alternative-onboarding outcomes
- Trace case-to-filing dates against documented legal triggers
- Sample exchanges for channel classification and retention evidence
- Sample filed reports for coherent subject, flow, and suspicion descriptions
Explanation
Correct Answer
C:Testing ensures searches and disclosures follow the proper framework. The proposed sample exercises the failure seen in a bank treats a voluntary interbank information request as an automatic section 314(a) government search, rather than the separate pathway represented by a bank terminates all accounts belonging to refugees because identity documents differ from….
Incorrect Answers
A:Assurance checks fairness and control performance, not only onboarding speed; the observed record here instead involves a bank treats a voluntary interbank information request as an automatic section…. The test exercises an adjacent pathway, a bank terminates all accounts belonging to refugees because identity documents differ from its…, without directly challenging a bank treats a voluntary interbank information request as an automatic section 314(a) government….
B:Against the reported situation in which a bank treats a voluntary interbank information request as an automatic section…, testing identifies delayed reports and weak deadline governance. Even a favorable result for a transaction monitoring alert is escalated after the legal deadline because investigators dispute… would not demonstrate the control works when a bank treats a voluntary interbank information request as an automatic section 314(a) government….
D:Compared with the stated facts about a bank treats a voluntary interbank information request as an automatic section…, the test assesses actionable content, not only whether a form was submitted. Testing this would validate controls for an AML team files a report that lists transaction values but fails to explain the suspected pattern…, not the effectiveness of remediation for a bank treats a voluntary interbank information request as an automatic section 314(a) government….
Question 785
For this identified exposure, a relationship manager promises a high-risk client instant onboarding despite missing beneficial ownership evidence. Choose TWO complementary steps: one targeted safeguard and one test of its operation.
- Require complete CDD and AFC approval before risk-sensitive onboarding
- Evaluate available identity methods and actual customer risk factors
- Sample recorded customer contacts for report-specific disclosures
- Compare segment outcomes before and after risk-based changes
- Sample accelerated onboarding for documentary and authorization completeness
- Create controlled RFI templates and investigator-review procedures
Explanation
Correct Answers
A:For the supported action of require complete cdd and afc approval before risk-sensitive onboarding in this effectiveness test review involving a relationship manager promises a high-risk client instant onboarding despite missing…, the front office should gather information while compliance independently challenges unresolved risk. It addresses the live exposure in a relationship manager promises a high-risk client instant onboarding despite missing beneficial ownership…; corrective action is not a substitute for verifying its operation.
E:Assurance checks that speed targets do not override risk controls. It produces control-performance evidence about a relationship manager promises a high-risk client instant onboarding despite missing beneficial ownership…; a documented plan alone would not prove operation.
Incorrect Answers
B:This is not the central mechanism when a relationship manager promises a high-risk client instant onboarding despite missing…; a nuanced assessment distinguishes documentation barriers from suspicious conduct. That review would be useful if a bank terminates all accounts belonging to refugees because identity documents differ from its…, but it would not resolve the central uncertainty in a relationship manager promises a high-risk client instant onboarding despite missing beneficial…. For the alternative option of evaluate available identity methods and actual customer risk factors in this effectiveness test review involving a relationship manager promises a high-risk client instant onboarding despite missing…, a two-part remediation plan for a relationship manager promises a high-risk client instant onboarding despite… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
C:When testing the contrasting pattern of a relationship manager promises a high-risk client instant onboarding despite missing…, remember that assurance tests whether confidentiality rules are followed in practice. The sample would be probative if a customer asks why a transfer is held; an analyst says it is because a suspicious-activity report…; a different population and test are needed for a relationship manager promises a high-risk client instant onboarding despite missing beneficial…. For the alternative option of sample recorded customer contacts for report-specific disclosures in this effectiveness test review involving a relationship manager promises a high-risk client instant onboarding despite missing…, a two-part remediation plan for a relationship manager promises a high-risk client instant onboarding despite… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
D:Testing evaluates whether targeted safeguards preserve control effectiveness and access; the observed record here instead involves a relationship manager promises a high-risk client instant onboarding despite missing…. The test exercises an adjacent pathway, an MSB withdraws from an entire remittance corridor after isolated suspicious cases without…, without directly challenging a relationship manager promises a high-risk client instant onboarding despite missing beneficial…. For the alternative option of compare segment outcomes before and after risk-based changes in this effectiveness test review involving a relationship manager promises a high-risk client instant onboarding despite missing…, a two-part remediation plan for a relationship manager promises a high-risk client instant onboarding despite… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
F:The relevant alternative mechanism is different from a relationship manager promises a high-risk client instant onboarding despite missing…: The process should seek relevant information while avoiding prohibited disclosures. That would be a coherent mitigation for an investigator requests business documents through a customer-facing team using an accusatory…, whereas the immediate gap concerns a relationship manager promises a high-risk client instant onboarding despite missing beneficial…. For the alternative option of create controlled rfi templates and investigator-review procedures in this effectiveness test review involving a relationship manager promises a high-risk client instant onboarding despite missing…, a two-part remediation plan for a relationship manager promises a high-risk client instant onboarding despite… needs an issue-specific safeguard and proof that it operates, not this unrelated step.
Question 786
An institution has corrected a process after discovering this case: A token project describes its protocol as decentralized but a company retains privileged controls over customer funds. Which test best proves the relevant safeguard operates?
- Test governance privileges and customer-asset flows against declared roles
- Test known linked-account scenarios against anti-collusion alerts
- Back-test low-play redemptions across pit, cage, and loyalty records
- Test high-velocity wallet chains for traceable endpoints
- Reconstruct common-controller relationships in policy issuance files
Explanation
Correct Answer
A:Assurance checks whether the stated operating model reflects what administrators can really control. The proposed sample exercises the failure seen in a token project describes its protocol as decentralized but a company retains privileged controls over…, rather than the separate pathway represented by several esports betting accounts trade bets against each other and cash out through the….
Incorrect Answers
B:Against the reported situation in which a token project describes its protocol as decentralized but a company retains…, assurance requires identifying coordinated groups, not just high stake amounts. This assurance method targets several esports betting accounts trade bets against each other and cash out through the same device… rather than the reported process: a token project describes its protocol as decentralized but a company retains privileged controls….
C:The relevant alternative mechanism is different from a token project describes its protocol as decentralized but a company retains…: Controls should identify cash-to-chip-to-cash patterns spanning casino systems. Testing this would validate controls for a casino patron exchanges large cash amounts for chips and redeems them shortly afterward without…, not the effectiveness of remediation for a token project describes its protocol as decentralized but a company retains privileged controls….
D:Compared with the stated facts about a token project describes its protocol as decentralized but a company retains…, the assurance review should expose anonymity gaps in account-to-account transfers. The sample would be probative if a digital-wallet provider allows unverified subaccounts to transfer balances repeatedly between…; a different population and test are needed for a token project describes its protocol as decentralized but a company retains privileged controls….
E:This is not the central mechanism when a token project describes its protocol as decentralized but a company retains…; an effective control catches a network that looks ordinary at policy level. The test exercises an adjacent pathway, an insurance broker proposes many single-premium policies purchased by entities with the same…, without directly challenging a token project describes its protocol as decentralized but a company retains privileged controls….
Question 787
A financial-crime team must corroborate the concern, implement a specific safeguard, and verify that safeguard after this event: A professional service provider invoices an offshore entity for vague advisory work followed by cash withdrawals. Choose THREE steps that satisfy those three different needs.
- Link cards, account holder, wagering history, and withdrawal beneficiaries
- Test fee samples for documented work and payment consistency
- Require substance testing for high-value professional-fee payments
- Sample covered transfers for complete data exchange and exception resolution
- Review deliverables, engagement terms, and beneficial ownership
- Monitor high-value buy-in and low-play cash-out combinations
Explanation
Correct Answers
B:Assurance checks whether high-risk professional-service transactions have substantive evidence. It produces control-performance evidence about a professional service provider invoices an offshore entity for vague advisory work followed by cash…; a documented plan alone would not prove operation.
C:Control teams should assess economic purpose rather than relying on an invoice heading. It addresses the live exposure in a professional service provider invoices an offshore entity for vague advisory work followed by cash…; corrective action is not a substitute for verifying its operation.
E:For the supported action of review deliverables, engagement terms, and beneficial ownership in this effectiveness test review involving a professional service provider invoices an offshore entity for vague advisory work followed…, a legitimate advisory relationship should produce supportable commercial output and known clients. It supplies corroborating evidence about a professional service provider invoices an offshore entity for vague advisory work followed by cash…; investigation is distinct from implementing or testing a safeguard.
Incorrect Answers
A:This is not the central mechanism when a professional service provider invoices an offshore entity for vague advisory work…; payment and betting evidence together reveal inconsistent ownership or disguised transfers. This would divert the fact-finding effort toward an online betting account is funded by several payment cards and withdraws winnings to a different… without resolving the key question raised by a professional service provider invoices an offshore entity for vague advisory work followed by…. For the alternative option of link cards, account holder, wagering history, and withdrawal beneficiaries in this effectiveness test review involving a professional service provider invoices an offshore entity for vague advisory work followed…, for a professional service provider invoices an offshore entity for vague advisory work…, corroboration, targeted correction, and assurance must all relate to the same failure.
D:Against the reported situation in which a professional service provider invoices an offshore entity for vague advisory work…, the test validates payload accuracy and handling of transfers lacking required information. The sample would be probative if a virtual-asset provider fails to exchange required originator and beneficiary information with…; a different population and test are needed for a professional service provider invoices an offshore entity for vague advisory work followed by…. For the alternative option of sample covered transfers for complete data exchange and exception resolution in this effectiveness test review involving a professional service provider invoices an offshore entity for vague advisory work followed…, for a professional service provider invoices an offshore entity for vague advisory work…, corroboration, targeted correction, and assurance must all relate to the same failure.
F:Compared with the stated facts about a professional service provider invoices an offshore entity for vague advisory work…, a targeted scenario should connect acquisition and redemption rather than separate counters. Its controls focus on a casino patron exchanges large cash amounts for chips and redeems them shortly afterward without…, which would leave the observed problem of a professional service provider invoices an offshore entity for vague advisory work followed by… unresolved. For the alternative option of monitor high-value buy-in and low-play cash-out combinations in this effectiveness test review involving a professional service provider invoices an offshore entity for vague advisory work followed…, for a professional service provider invoices an offshore entity for vague advisory work…, corroboration, targeted correction, and assurance must all relate to the same failure.
Question 788
The compliance team introduces remediation for this weakness: A supervisor publishes an enforcement case about missed cash reporting by small branches. Which evidence best shows it is functioning?
- Test remediation against the specific enforcement failure mode
- Sample high-impact screening configurations against primary sources
- Challenge risk ratings against sector-level evidence and portfolio reality
- Test foreign-request workflows for documented legal validation
Explanation
Correct Answer
A:Assurance should measure the weak control, not merely staff awareness of the publication. For the supported action of test remediation against the specific enforcement failure mode in this effectiveness test review involving a supervisor publishes an enforcement case about missed cash reporting by small branches, the assessment probes the affected transactions and decisions, not just an adjacent risk such as a trade team assumes a private sanctions-screening vendor's advisory is binding legal….
Incorrect Answers
B:Compared with the stated facts about a supervisor publishes an enforcement case about missed cash reporting by small…, assurance verifies that operative restrictions come from authorized legal interpretation. Even a favorable result for a trade team assumes a private sanctions-screening vendor's advisory is binding legal interpretation would not demonstrate the control works when a supervisor publishes an enforcement case about missed cash reporting by small branches.
C:This is not the central mechanism when a supervisor publishes an enforcement case about missed cash reporting by small…; testing shows whether the assessment differentiates exposed and unrelated products. This assurance method targets a bank scores a low-risk domestic payment product using a national threat assessment for an… rather than the reported process: a supervisor publishes an enforcement case about missed cash reporting by small branches.
D:When testing the contrasting pattern of a supervisor publishes an enforcement case about missed cash reporting by small…, remember that assurance checks preservation decisions and disclosures against verified authority. Testing this would validate controls for an overseas police unit asks a bank employee to preserve client data without a recognized local…, not the effectiveness of remediation for a supervisor publishes an enforcement case about missed cash reporting by small branches.
Question 789
A remediation is marked complete for this case: A recycling firm receives international transfers inconsistent with its permits and declared scrap exports. Which operational test would best challenge that claim?
- Measure sector-specific alert outcomes and intelligence referrals
- Sample alert-to-filing timelines and overdue-case exceptions
- Replay known circular-trading patterns against surveillance rules
- Audit flagged shipments against regulatory and customs exceptions
Explanation
Correct Answer
D:The assurance review assesses whether unlawful trade indicators survive onboarding and monitoring. Operating-effectiveness evidence must reach the specific control gap here; an illicit trade network infiltrates local payment channels and distorts competition with… would require a different test.
Incorrect Answers
A:When testing the contrasting pattern of a recycling firm receives international transfers inconsistent with its permits and…, remember that a targeted effectiveness measure tracks whether the identified criminal pattern is actually surfaced. Testing this would validate controls for an illicit trade network infiltrates local payment channels and distorts competition with…, not the effectiveness of remediation for a recycling firm receives international transfers inconsistent with its permits and declared scrap….
B:Elapsed-time testing establishes whether deadlines are consistently met and breaches are escalated; the observed record here instead involves a recycling firm receives international transfers inconsistent with its permits and…. The sample would be probative if a suspicious-activity backlog grows until analysts miss required reporting deadlines; a different population and test are needed for a recycling firm receives international transfers inconsistent with its permits and declared scrap….
C:Against the reported situation in which a recycling firm receives international transfers inconsistent with its permits and…, back-testing should establish that the system connects counterparties rather than scoring each trade alone. The test exercises an adjacent pathway, a brokerage customer buys securities through several entities and quickly sells them back to…, without directly challenging a recycling firm receives international transfers inconsistent with its permits and declared scrap….
Question 790
Independent assurance must evaluate an issue originally found as follows: Investigators copy public social-media information into cases without recording where or when they collected it. What validation would most directly test effectiveness?
- Sample OSINT assertions for verifiable sources and dated captures
- Test benign shared-IP clusters for false positive network formation
- Replay split-payment datasets and evaluate linked alert generation
- Seed mule networks and measure connected-component detection accuracy
- Run above-the-line and below-the-line tests for missed cases
- Back-test model versions and check drift plus approval evidence
Explanation
Correct Answer
A:The test distinguishes investigative evidence from unsupported summaries. This test provides observable evidence about the affected process; a test focused on a graph model flags every customer sharing a common public IP address as a criminal network would not establish the same result.
Incorrect Answers
B:The relevant alternative mechanism is different from investigators copy public social-media information into cases without recording where…: Assurance checks that weak links do not dominate suspicious-group classification. The test exercises an adjacent pathway, a graph model flags every customer sharing a common public IP address as a criminal network, without directly challenging investigators copy public social-media information into cases without recording where or when they….
C:Compared with the stated facts about investigators copy public social-media information into cases without recording where…, testing verifies detection of dispersed events below individual thresholds. Even a favorable result for a transaction-monitoring rule detects individual large transfers but misses repeated low-value… would not demonstrate the control works when investigators copy public social-media information into cases without recording where or when they….
D:This is not the central mechanism when investigators copy public social-media information into cases without recording where…; the test assesses linked pattern capture and false connection rates. This assurance method targets several mule accounts appear independent until network software links them to a single device and… rather than the reported process: investigators copy public social-media information into cases without recording where or when they….
E:When testing the contrasting pattern of investigators copy public social-media information into cases without recording where…, remember that testing compares triggers and near misses to locate useful thresholds. Testing this would validate controls for an AML model's thresholds are reduced until alert volume rises sharply but investigators find fewer…, not the effectiveness of remediation for investigators copy public social-media information into cases without recording where or when they….
F:Assurance determines whether changes preserved detection effectiveness; the observed record here instead involves investigators copy public social-media information into cases without recording where…. The sample would be probative if a data scientist deploys a revised monitoring model without documenting validation or independent…; a different population and test are needed for investigators copy public social-media information into cases without recording where or when they….