{
  "question_text": "Which of the four monitoring records BSA/AML Compliance Officer maintains specifically cross-references flagged transaction alerts with SAR case numbers?",
  "options": [
    "SAR referral log",
    "Investigation file",
    "Alert log",
    "Threshold review log"
  ],
  "correct_answer": "SAR referral log",
  "correct_response": "Correct. The SAR referral log cross-references monitoring alerts with SAR case numbers. Each of the four records serves a distinct purpose: the alert log records all flagged transactions, the investigation file holds supporting documents, and the threshold review log documents all threshold adjustments.",
  "incorrect_response": "The SAR referral log specifically cross-references monitoring alerts with SAR case numbers. The alert log records flagged transactions; the investigation file holds transaction records, CIP copies, and investigation notes; and the threshold review log records threshold adjustments with supporting analysis.",
  "unsure_response": null,
  "question_bank": [
    {
      "question_text": "Outside the annual review cycle, which condition requires you to adjust monitoring thresholds?",
      "options": [
        "A confirmed-suspicious capture rate below 80% over any 90-day window",
        "A confirmed-suspicious capture rate below 80% over any 60-day window",
        "A false positive rate exceeding 25% over any 90-day window",
        "An alert volume increase of 50% compared to the prior review period"
      ],
      "correct_answer": "A confirmed-suspicious capture rate below 80% over any 90-day window",
      "correct_response": "Correct. A confirmed-suspicious capture rate below 80% over any 90-day window requires an ad hoc threshold adjustment — it means the program is missing actual suspicious activity. A false positive rate exceeding 40% over the same window is the other condition requiring immediate action.",
      "incorrect_response": "Two conditions trigger ad hoc threshold adjustments: a false positive rate exceeding 40% over any 90-day window, and a confirmed-suspicious capture rate below 80% over any 90-day window. Both the threshold and the window matter — 80% over 60 days, or 25% false positive rate, are not the stated triggers.",
      "unsure_response": null
    },
    {
      "question_text": "When you assign a 'Continued monitoring' disposition to an escalated alert, what happens next?",
      "options": [
        "The alert is flagged for 30-day follow-up",
        "The alert is escalated to an external compliance reviewer within one business day",
        "A SAR is filed as a precautionary measure while the investigation continues",
        "The alert is closed and the customer is added to a watch list"
      ],
      "correct_answer": "The alert is flagged for 30-day follow-up",
      "correct_response": "Correct. A 'Continued monitoring' disposition means the alert is inconclusive. It is flagged for 30-day follow-up — not closed, not escalated externally, and not treated as confirmed suspicious activity.",
      "incorrect_response": "The 'Continued monitoring' disposition applies when an alert is inconclusive. It does not trigger a SAR or external escalation — it flags the alert for 30-day follow-up. The disposition must still be documented, just like 'Cleared' and 'SAR filed.'",
      "unsure_response": null
    }
  ],
  "enrichment_content": "<p><strong>Four records, four purposes — all retained for five years.</strong></p><ul><li><strong>Alert log</strong> — all flagged transactions with triggering parameter, date, disposition, and reviewer identity</li><li><strong>Investigation file</strong> — transaction records, CIP copies, and investigation notes for each escalated alert</li><li><strong>SAR referral log</strong> — cross-references monitoring alerts with SAR case numbers</li><li><strong>Threshold review log</strong> — all threshold adjustments with supporting analysis</li></ul><p>Records not retained for the full five years cannot be produced during an examination.</p>"
}