{
  "question_text": "Under Advanced Compliance Technology, Inc.'s risk assessment framework, which of the following events qualifies as a material change requiring an out-of-cycle assessment to be completed within 30 days?",
  "options": [
    "Issuance of a Geographic Targeting Order affecting Advanced Compliance Technology, Inc.'s market area",
    "A sustained 10% increase in transaction volume over a single quarter",
    "Completion of the annual control testing cycle",
    "Appointment of a new teller who has not yet completed AML training"
  ],
  "correct_answer": "Issuance of a Geographic Targeting Order affecting Advanced Compliance Technology, Inc.'s market area",
  "correct_response": "Correct. A GTO affecting Advanced Compliance Technology, Inc.'s market area is one of three material change triggers requiring an out-of-cycle assessment within 30 days. The other two are an ownership change at or above 25% and a significant shift in the customer population.",
  "incorrect_response": "Issuance of a Geographic Targeting Order affecting Advanced Compliance Technology, Inc.'s market area is one of the three material change triggers. The others are an ownership change at or above 25% and a significant shift in the customer population. Each requires an out-of-cycle assessment completed within 30 days. A 10% volume shift, a testing cycle, and a new hire do not qualify.",
  "unsure_response": null,
  "question_bank": [
    {
      "question_text": "The five-step risk assessment methodology requires BSA/AML Compliance Officer to determine the risk remaining after controls have been applied. Which step addresses this?",
      "options": [
        "Calculate residual risk",
        "Assess inherent risk",
        "Evaluate controls",
        "Document and recommend"
      ],
      "correct_answer": "Calculate residual risk",
      "correct_response": "Correct. Step 4 — calculate residual risk — determines the risk remaining after controls are applied and flags any dimension where residual risk exceeds acceptable levels.",
      "incorrect_response": "Step 4, 'Calculate residual risk,' determines what risk remains after controls operate. Assessing inherent risk (Step 2) rates risk before controls; evaluating controls (Step 3) assesses their adequacy. Residual risk is the gap that remains after both steps.",
      "unsure_response": null
    },
    {
      "question_text": "When BSA/AML Compliance Officer rates a risk dimension residual-high after applying controls, what is required before the next assessment cycle?",
      "options": [
        "A documented remediation commitment with a target completion date",
        "Immediate suspension of operations in the affected dimension",
        "A filing with FinCEN describing the identified control gap",
        "A waiver from the owner/principal deferring corrective action"
      ],
      "correct_answer": "A documented remediation commitment with a target completion date",
      "correct_response": "Correct. Any dimension rated residual-high requires a documented remediation commitment with a target completion date. This creates an auditable record and drives timely corrective action.",
      "incorrect_response": "A residual-high rating requires a documented remediation commitment with a target completion date — not suspension of operations, a FinCEN filing, or a deferral waiver. The documented commitment creates an auditable record and ensures corrective action is completed on a defined schedule.",
      "unsure_response": null
    }
  ],
  "enrichment_content": "<p><strong>Material change triggers:</strong> Three events require an out-of-cycle risk assessment completed within 30 days: (1) an ownership change at or above 25%, (2) a significant shift in the customer population, and (3) issuance or modification of a Geographic Targeting Order affecting Advanced Compliance Technology, Inc.'s market area.</p><p><strong>The five assessment steps:</strong> Define scope → Assess inherent risk → Evaluate controls → Calculate residual risk → Document and recommend. Each risk dimension receives both an inherent risk rating (before controls) and a residual risk rating (after controls). Any dimension rated residual-high requires a documented remediation commitment with a target completion date.</p>"
}