ABA Regulatory Compliance Manager (CRCM) Certification Sample Questions

02. First Trust Bank recently launched a new short-term unsecured consumer credit product with no performance history, alongside its long-standing installment loan product, which has a multi-year record of low exception rates and a stable, well-documented process. Compliance is allocating its upcoming testing cycle's time and sample sizes between the two products.
Which allocation approach BEST reflects sound risk-based scoping?
a) Test only the new product this cycle and omit the established product from the plan entirely
b) Split the testing time and sample size evenly between the new product and the established product
c) Direct a larger share of scope and more frequent testing to the new product given its higher, unproven risk
d) Base the split solely on which product currently generates more revenue for the bank, since higher revenue is assumed to reflect greater compliance risk

03. In testing compliance with Truth in Savings Act/Regulation DD disclosure requirements, a compliance monitoring team compares account-opening dates recorded in the bank's core deposit system against the dates recorded in a separate marketing database used to track account originations. For a meaningful share of the accounts tested, the two systems disagree on the account-opening date.
What should the team do BEFORE relying on either data source to draw conclusions from this test?
a) Determine which system is the authoritative system of record for this data before relying on either source to support a conclusion
b) Use whichever system produces the more favorable, lower-exception result for the accounts in question
c) Average the two systems' recorded dates to arrive at a single value for each account
d) Continue using the marketing database because it is easier for the team to query, since consistency of access matters more than occasional discrepancies

04. During an on-site regulatory examination, an examiner asks a business-unit manager directly for a set of loan files and an explanation of a specific underwriting practice. The manager is uncertain how much detail to provide and contacts the compliance officer, who serves as the institution's primary examination liaison.
What is the compliance officer's MOST appropriate role in this situation?
a) Instruct the manager to decline responding until the compliance officer independently rewrites the underwriting practice being questioned, ensuring the response reflects a fully corrected process before any information reaches the examiner.
b) Coordinate the response, ensuring the requested files and explanation are accurate, complete, and consistent with institution practice, while keeping the business unit engaged as the practice's owner.
c) Take over answering all examiner questions directly so that no business-unit staff interact with examiners for the remainder of the exam.
d) Advise the manager to provide only the minimum information legally required, since broader disclosure could increase examiner scrutiny.

05. Prairie State Bank is finalizing its written action plan in response to an examination finding. One draft commits the bank to "review and strengthen" the affected control by an unspecified future date. A revised draft instead lists discrete steps, names the accountable owner for each step, sets a target completion date, and describes how completion will be verified.
Which element MOST determines whether the examiner will view the action plan as credible?
a) Whether the plan avoids explicitly stating the root cause, so as not to concede greater fault than necessary.
b) The overall length and formality of the narrative describing the bank's intended response.
c) Whether the plan is signed by the most senior executive available, regardless of the specificity or ownership of the steps described.
d) Whether the commitments are specific, assigned, and verifiable - who will do what, by when, and how completion will be confirmed.

06. Every employee completed the assigned compliance training modules on schedule for the training cycle. Despite this, consumer complaints tied to a specific regulation's requirements have been trending upward, and monitoring results show frontline staff continuing to mishandle that regulation's requirements in practice.
What does this pattern best indicate about the training program?
a) Because completion was universal, the training program is fully effective and the root cause must lie entirely outside of training, most likely in how frontline supervisors enforce daily procedures.
b) Completion of assigned modules is not, by itself, a reliable indicator of program effectiveness; the training's content and delivery still need to be reviewed against actual staff performance.
c) The rise in complaints is a monitoring issue entirely unrelated to training and should be addressed without revisiting the training program.
d) Because staff have already completed training on this regulation, the training frequency for this topic should be reduced going forward, freeing capacity for other priorities.

07. A bank's currency-transaction reporting data is pulled automatically from the teller platform into its reporting system. The compliance officer wants to establish an ongoing control aimed specifically at ensuring the reported data itself is complete and accurate as it moves between the two systems. This is meant to be distinct from the bank's broader second-line monitoring/testing program, which separately reviews whether frontline staff correctly identified transactions that needed to be reported.
Which control BEST fits the description of a reporting-data-quality control, as distinct from monitoring/testing?
a) The compliance officer's periodic testing of a sample of transactions to confirm frontline staff correctly identified them as reportable.
b) Internal audit's periodic independent assessment of the overall effectiveness of the compliance function's reporting program.
c) The compliance officer's review of newly issued regulatory guidance addressing currency-transaction reporting expectations.
d) Periodically reconciling the population of currency transactions captured in the teller platform against the transactions appearing in the completed report, to confirm none were dropped or altered in the transfer between systems.

08. Horizon Community Bank's compliance function completes its annual assessment of the overall compliance management program. The assessment team examines whether the bank's policies and procedures, training, monitoring and testing, and consumer-complaint handling remain aligned with the bank's current products and risk profile, and whether issues identified in the prior year's monitoring and audit reports were fully corrected. The team is now finalizing the scope of the assessment and deciding how its conclusions should be communicated.
Which addition to the assessment's scope and reporting is MOST appropriate?
a) The assessment should confirm only that written policies exist for each required area, and its conclusions should be retained for internal audit's future reference rather than actively communicated.
b) The assessment should be narrowed to testing a sample of individual transactions for regulatory compliance, similar to the bank's ongoing monitoring activity.
c) The assessment should also evaluate whether compliance staffing and other resources remain adequate for the program's current scope, and its conclusions should be reported to the board, or a designated board committee, and to senior management.
d) Because the compliance officer designed the program, the assessment's conclusions should be reported to the compliance officer alone for internal use.

09. Continental Bank's internal audit department is building its annual audit plan. The audit team requests copies of the compliance function's completed testing workpapers from ongoing monitoring/testing conducted earlier in the year, intending to factor those results into how it scopes its own review of the compliance program.
Which statement BEST describes how this exchange fits within the three lines of defense?
a) Internal audit should simply adopt compliance's testing conclusions as its own audit findings, since both groups reviewed similar activity and are expected to reach the same conclusions, making a separate audit review unnecessary
b) Since compliance already tested these transactions, the audit review would be duplicative and can be skipped
c) The compliance function's ongoing monitoring/testing is itself a form of independent audit and satisfies the bank's third-line assurance obligation
d) Internal audit, as the third line, may consider the second line's monitoring output when scoping its review, but assurance over the compliance function must still be performed independently

10. Over several consecutive compliance monitoring cycles, testing has identified the same type of exception -- an adverse-action notice under the Equal Credit Opportunity Act/Regulation B missing a required disclosure element -- occurring in the same consumer-lending unit. Each time, the business unit responded by re-training the staff involved, yet the same exception type reappears in the following cycle.
What should this recurring pattern lead compliance monitoring to conclude, and how should the NEXT testing cycle be adjusted?
a) Treat each occurrence as an isolated clerical error unrelated to the earlier cycles, since training was refreshed each time, reinforcing an assumption that no broader process or system issue could plausibly be at play across multiple cycles
b) Conclude the matter is resolved, since retraining was provided again after the most recent cycle
c) The recurring pattern suggests the training-only response addressed a symptom rather than an underlying root cause; the next cycle's testing should look beyond the same narrow disclosure point
d) Reduce the scope of testing on this notice requirement going forward, since the unit is already aware of the issue