An FTC Safeguards Rule-covered lender that is not eligible for the small-institution exemption keeps only two lines saying risks were discussed, with no evaluation criteria or risk-treatment documentation. Does this satisfy the written risk-assessment requirement?
Correct Answer
B) No: the assessment must document the required risk-evaluation criteria and how identified risks will be addressed
B. A note that risks were discussed lacks the required assessment content. The written assessment needs criteria for evaluating and categorizing threats and assessing information-system protections. It must also describe how identified risks are accepted or mitigated and addressed by the security program. Scope and exceptions: The question excludes the relevant exemption. Periodic reassessment is also required; a compliant initial document does not eliminate the duty to revisit changing risks and safeguard adequacy. Source: 16 CFR 314.4(b)(1)–(2) — https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
Why This Is the Correct Answer
B. A note that risks were discussed lacks the required assessment content. The written assessment needs criteria for evaluating and categorizing threats and assessing information-system protections. It must also describe how identified risks are accepted or mitigated and addressed by the security program. Scope and exceptions: The question excludes the relevant exemption. Periodic reassessment is also required; a compliant initial document does not eliminate the duty to revisit changing risks and safeguard adequacy.
Why the Other Options Are Wrong
Option A: No: only an outside auditor may conduct the assessment
The requirement is substantive; it does not mandate an outside auditor for every assessment.
Option C: Yes: frequent meetings replace the assessment's required content
Frequent meetings do not supply omitted content.
Option D: Yes: any written meeting note is automatically sufficient
Writing something down does not establish compliance.
Exam Tip
Assess documented methods and decisions, not just evidence that a meeting occurred.
More Federal Laws Questions
Before the team acts on a production meeting, a training manager must address SCRA Interest Rate Cap. Which response is most defensible?
A team member asks about RESPA Kickbacks and Referrals in an investor-delivery review while trying to confirm the rule-based response. Which response should the loan team use?
During a disclosure desk review, the loan team encounters an RESPA Servicing Transfer issue. Which response should avoid a shortcut that would misapply the rule?
A disciplinary-risk review raises a question about TILA APR and finance-charge rules. Which action should the renewal specialist recommend?
An MLO is reviewing procedures for a case where a compliance analyst asks why covered mortgage application data is collected. What is the proper handling?
A consumer complaint response raises a question about GLBA privacy requirements. Which action should the state compliance officer recommend?
Before the team acts on a branch training session, a policy analyst must address RESPA Servicing Transfer Notice. Which response is most defensible?
A training manager is resolving RESPA Referral Fees during an internal audit sample. Which action best fits the rule?
An operations lead is resolving ECOA Prohibited Discrimination Bases during a loan-team coaching session. Which action best fits the rule?
In a file escalation meeting, a disclosure specialist sees facts tied to TILA Closing Disclosure. What should the file reflect?
People Also Study
General Mortgage Knowledge
20% of exam
Mortgage Loan Origination Activities
27% of exam
Ethics, Fraud & Consumer Protection
18% of exam
Uniform State Test Content
11% of exam