Mandate and risk diagnosis Review questions Mandate and risk diagnosis This module turns a request that assumes its conclusion into a bounded mandate with an evidence scope and decision owner. Learners separate observation from explanation: more alerts can coincide with a lower alert rate, and neither figure establishes monitoring quality. They build rival hypotheses and select tests that could weaken each one, such as reconciling feeds or comparing stable cohorts. They distinguish inherent exposure from control design, demonstrated operation and residual risk, writing conditional judgments when effectiveness is unproven. Finally, they allocate limited analyst days to evidence that could change an urgent decision, defer lower-value work with a review date and set an escalation gate. The outputs are an engagement charter, evidence ledger, risk register and test plan, rather than a predetermined failure verdict or legal compliance certificate.
Review questions Test your understanding with these questions. Marking and saved results are available with a free account.
Question 1 A sponsor asks you to prove that monitoring failed. You currently have alert aggregates and a rule-change log only. What should you do first? Frame a testable coverage question, identify evidence and reserve control decisions to management Accept the failure claim and plan an immediate shutdown because the sponsor owns the project Declare monitoring effective because more alerts mean better detection Question 2 Alerts rose from 800 to 1,280 while eligible transactions rose from 40,000 to 80,000. Which conclusion is supported? Detection improved by 60%, matching the rise in raw alerts The alert rate fell from 2% to 1.6%, but rates alone do not establish detection quality The alert rate rose from 2% to 3.2% because the new count uses July's denominator Question 3 A rule was designed to detect fragmented transfers, but there is no log proving that app transactions reach it. What residual-risk judgment is justified? Low, because the rule design matches the exposure No credible reduction until operation is tested, with inherent exposure and missing evidence stated Zero, because no operating log means no breach occurred Question 4 The team has two days and an entire transfer channel may be missing from monitoring. Which test should precede dashboard work or closure-speed calculation? Reconcile channel-feed completeness to source transactions Rebuild the committee dashboard from current alert totals to show its monthly trend Calculate average alert closure time alone because it shows operational capacity Question 5 A person has verified identity and expects limited domestic use, but offers non-conventional address evidence. What is the first due diligence design advice? Reject automatically because unusual documentation proves high risk Open without limits because expected use is small Verify locally permitted address evidence and assess a limited product with a review trigger Question 6 N owns 70% of M. E owns 40% of N and may appoint three of M's five directors. Which analysis is sound? E has 28% indirect equity and may have contractual control if the right is verified E owns 40% directly and the appointment right is irrelevant E owns 70% because N is M's largest owner Question 7 Two hundred reviews were due. One hundred fifty finished on time, thirty late and twenty remain open. What share missed on-time completion? 10%, counting only the still-open files 25%, since 50 of 200 missed the deadline 75%, since 150 of 200 finished on time Question 8 In a limited-access pilot eight of fifty customers exceed a use cap; alerts for three of the eight never reach investigators. What should happen before scaling? Scale because forty-two customers stayed within the cap Pause scaling, repair alert delivery and replay every breach type Expel all eight because crossing a cap proves crime Question 9 Source records show 400 app transfers; 360 reach monitoring, and 25 of those lack the customer ID needed by a fragmentation rule. How many can the rule not assess as designed? 25 of 400 because forty absent transfers are outside input 65 of 400: forty absent plus twenty-five present without the field 40 of 400 because alert count compensates for missing identity fields Question 10 A new threshold suppresses 200 alerts needing ten minutes' initial review each, but also removes four of twenty-five valuable referrals. What is a sound reading? Potentially 2,000 minutes saved, with a valuable-case gap needing testing before launch A guaranteed 2,000 minutes off total investigation time, because initial review is all the work The threshold is safe because four of twenty-five is under half Question 11 Payments of 4,000, 5,000 and 6,000 arrive from three senders; 5,000 later returns to one. Which description belongs in an investigation memo? Net movement is 10,000, so the returned payment need not be described The 5,000 return proves the original payment was commercial Gross receipts were 15,000 and net movement 10,000; the return's reason and link still need evidence Question 12 A feed gap affects thirty transactions and one links to an open investigation. Who receives what? Send every named case to the sponsor to decide reporting and repair Give the control owner the gap impact and authorised investigators the case ID; each acts within role Give everything to investigators; their case inquiry automatically repairs the feed Question 13 A committee asks internal audit to design and approve a monitoring rule, then test it later as an independent function. What is the defect? None; audit approval makes its later test more independent Only operations should test its own rule instead of audit Design and approval undermine audit's later independent challenge Question 14 A production log has thirty rule changes and the approval register twenty-seven. What is the first test finding before estimating detection failure? Three releases lack matched requests; identify and test them before calling operation failed Ten percent of all monitoring rules failed because 3/30=10% The logs nearly match, so the three do not need review Question 15 Ninety of a hundred priority cases close on time, but six of twenty sampled closures lack rationale. How should a dashboard present this? Full success because speed is 90%; quality can follow later Ninety percent timeliness and seventy percent adequate rationale in the sample, with cause review Sixty-three percent total effectiveness by multiplying 90% and 70% Question 16 After a pilot release, twenty of five hundred channel transactions miss input. The rollback plan requires a decision above 1% failure. What happens? Wait a week because alerts fell 15% Use all institutional transactions as denominator to lower the rate Verify reconciliation promptly and refer an authorised rollback decision; 20/500=4% Question 17 Replaying one thousand transactions at 250 daily and reviewing thirty intermediaries at ten daily run in parallel. What is the theoretical minimum work time? Seven days by adding four and three despite parallel teams Four days if work starts together and data are ready Three days because intermediary review ends first Question 18 Capacity for nine hundred reviews was three hundred daily, but forty percent is reassigned to urgent cases. What happens to a three-day completion promise? It stays three days because transaction count is unchanged It becomes four days by rounding forty percent of three to one Available capacity is 180 daily, requiring five days and revised conditional advice Question 19 ID repair takes two days then replay three; feed repair four then acceptance one; intermediary checks take three in parallel. What is earliest closure? End of day five if routes start together and tests pass End of day three because intermediary checks finish first End of day thirteen by adding every task duration Question 20 Of a thousand transactions, seven hundred have verified screening, two hundred need replay and one hundred lack reliable IDs. Which fact sentence fits the memo? All one thousand passed because most did The test supports seven hundred; the remaining three hundred need different actions, with no generalisation All one thousand failed because some records are deficient Create a free account to mark your answers and save your progress.
