I85PREP
⌘ K
CPP study materials
CPP study resources

CPP (ASIS) practice questions

One question at a time. Build your CPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals

In security risk management, risk is most commonly expressed as which combination?

  1. Likelihood and consequence of an adverse event Correct answer.
  2. Asset value plus the cost of the countermeasures installed to protect it
  3. The number of vulnerabilities found during the most recent security survey
  4. Threat capability multiplied by the number of access points at a facility

Explanation

Risk is a function of how probable an adverse event is and how severe the resulting impact would be, usually expressed as likelihood multiplied by consequence. Controls are chosen after risk is analyzed, not used to define it.

Question 2Security Fundamentals

Which CPTED principle is applied when landscaping and window placement are used to maximize the chance that an intruder will be observed?

  1. Natural surveillance Correct answer.
  2. Natural access control
  3. Activity support
  4. Territorial reinforcement

Explanation

Natural surveillance increases the visibility of people and activities so that legitimate users and staff can observe intruders without added technology. It relies on sightlines, lighting, and site design rather than on guards or barriers.

Question 3Security Fundamentals

In a physical protection program, defense in depth means:

  1. Layered controls so that the failure of one does not defeat the whole system Correct answer.
  2. Classifying every asset as critical so that all of them receive maximum protection
  3. Stationing guards at every entrance and exit of the building around the clock
  4. Relying on a single, highly reliable control installed at the perimeter of the site

Explanation

Defense in depth assumes that any single control can fail or be defeated, so protection is built from complementary layers such as perimeter, building envelope, interior, and asset-level controls. An adversary must then overcome multiple independent obstacles.

Question 4Security Fundamentals

Which of the following is a psychological deterrent rather than a physical barrier?

  1. A reinforced steel door fitted with a deadbolt lock
  2. A bollard rated for vehicle impact installed at the loading dock
  3. Signage warning that the area is under video surveillance Correct answer.
  4. A turnstile requiring badge-in and badge-out

Explanation

Psychological deterrents influence an offender's decision by signaling risk of detection or consequences, and signs are a classic example. Physical barriers instead delay or block movement through structural means.

Question 5Security Fundamentals

What is the primary function of a written organizational security policy?

  1. To state management's intent and the mandatory asset protection rules Correct answer.
  2. To serve as the contract between the organization and its security vendor
  3. To list the names and home phone numbers of the guard force
  4. To describe the step-by-step technical configuration of each alarm panel

Explanation

A policy captures senior management's direction and establishes mandatory, high-level requirements that subordinate standards and procedures implement. It is deliberately stable and broad rather than technical or administrative in detail.

Question 6Security Fundamentals

A hurricane in the region where a facility is located is best classified as which element of risk?

  1. A residual risk
  2. A vulnerability
  3. A threat Correct answer.
  4. A countermeasure

Explanation

A threat is a potential cause of harm, whether natural or human-caused, that exists independently of the facility. The facility's exposure to that threat, such as unbraced glazing, would be the vulnerability.

Question 7Security Fundamentals

Business continuity planning is primarily concerned with:

  1. Designing the perimeter lighting for the facility's parking areas
  2. Immediate life-safety evacuation of occupants during an incident
  3. Restoring critical business functions after a disruption Correct answer.
  4. Prosecuting persons who commit theft on company premises

Explanation

Continuity management focuses on keeping or resuming prioritized business functions during and after a disruptive event. Life safety and incident stabilization are handled by emergency response, which precedes continuity activity.

Question 8Security Fundamentals

Chain of custody documentation exists to:

  1. Confirm that the investigator is licensed in the jurisdiction
  2. Record the full cost of the investigation and charge it to the appropriate unit
  3. Summarize the final conclusions of the investigative report
  4. Show an unbroken record of who handled evidence and when Correct answer.

Explanation

Chain of custody is a chronological record of seizure, transfer, and storage of evidence that demonstrates integrity from collection to presentation. Gaps or undocumented handling can render evidence unreliable or inadmissible.

Question 9Security Fundamentals

An organization purchases an insurance policy to cover financial losses from a data breach. Which risk treatment strategy does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk reduction

Explanation

Transfer shifts the financial consequence of a risk to another party, commonly through insurance or contractual indemnity. The underlying risk still exists; only the economic burden moves.

Question 10Security Fundamentals

Which sequence best reflects a sound security risk assessment process?

  1. Select and install countermeasures first, then determine which assets were most at risk
  2. Estimate annualized loss expectancy before identifying which assets could be affected
  3. Interview employees about their security concerns, then write the report and recommendations
  4. Identify assets, assess threats and vulnerabilities, analyze risk, choose controls Correct answer.

Explanation

Assessment begins with knowing what must be protected, then examines what could harm it and how exposed it is, and only then characterizes risk. Countermeasure selection is an output of analysis and should never precede it.

Question 11Security Fundamentals

A business impact analysis is performed primarily to:

  1. Rank employees by seniority for evacuation purposes
  2. Determine the replacement cost of the company's physical assets and buildings
  3. Test whether the backup generator starts within ten seconds
  4. Identify critical processes and impact of their disruption Correct answer.

Explanation

A BIA identifies time-sensitive processes and quantifies how losses escalate as disruption lengthens, which establishes recovery priorities and tolerances. Asset valuation and equipment testing are supporting activities with different purposes.

Question 12Security Fundamentals

An office installs a low decorative fence, a gate, and contrasting paving at the edge of its parking area. Which CPTED principle does this illustrate?

  1. Maintenance
  2. Target hardening
  3. Territorial reinforcement Correct answer.
  4. Natural surveillance

Explanation

Territorial reinforcement uses physical and symbolic markers, such as fencing, signage, and paving changes, to define ownership and discourage unauthorized use. It creates a clear transition between public and private space.

Question 13Security Fundamentals

An employee reports that a coworker made a veiled threat toward a supervisor. What is the most appropriate first action?

  1. Refer the report to the organization's threat assessment team for evaluation Correct answer.
  2. Post the report on the company intranet to encourage other reports
  3. Wait for a second incident before taking any corrective action
  4. Confront the coworker directly and demand an explanation in front of the whole team

Explanation

Threats are handled by a multidisciplinary threat assessment team that evaluates intent, means, and escalation risk and coordinates an appropriate response. This protects the reporting employee and avoids actions that could inflame the situation.

Question 14Security Fundamentals

Restoring IT systems and reoccupying a fire-damaged facility belongs to which phase of emergency management?

  1. Response
  2. Mitigation
  3. Recovery Correct answer.
  4. Preparedness

Explanation

Recovery covers the activities that return the organization to normal or improved operations after the incident has been stabilized. Mitigation and preparedness occur before an event, and response covers immediate actions during it.

Question 15Security Fundamentals

Which measure best indicates that a security awareness program is changing employee behavior?

  1. Fewer tailgating incidents seen during random audits Correct answer.
  2. The number of posters displayed in the lobby
  3. The percentage of staff who attended a mandatory briefing
  4. The total budget allocated to the program this year

Explanation

Awareness programs succeed when observable behavior improves, and audit data on a specific behavior such as tailgating measures that directly. Attendance and budget track activity and inputs rather than results.

Question 16Security Fundamentals

Which control most directly reduces tailgating at a lobby entrance?

  1. Removing the visitor sign-in log from the reception desk
  2. A mantrap with anti-passback and one-person detection Correct answer.
  3. Adding a second receptionist desk to greet visitors in the lobby
  4. Increasing the read range of the badge readers at the doors

Explanation

A mantrap permits one authenticated person through at a time and anti-passback prevents a credential from being reused to admit a second person. This structurally limits piggyback entry rather than relying on observation or staffing.

Question 17Security Fundamentals

The primary purpose of maintaining vehicle standoff distance from a building is to:

  1. Reduce blast pressure and fragmentation reaching the structure Correct answer.
  2. Improve the appearance of the front elevation
  3. Provide convenient parking for executives close to the main entrance
  4. Shorten the response time of emergency vehicles

Explanation

Standoff distance causes blast energy to dissipate over distance, lowering the pressure and fragment load on the structure and its occupants. It is a siting and site-planning control, not a convenience or aesthetic measure.

Question 18Security Fundamentals

During a walk-through security survey, an assessor observes employees propping open a rear door for smoke breaks. The finding should be recorded as:

  1. A threat to the facility
  2. A procedural vulnerability requiring corrective action Correct answer.
  3. A natural hazard with no security relevance
  4. An acceptable practice if the door is within the fence line

Explanation

A propped door is a human-caused weakness in procedure that defeats the access control layer, so it is a vulnerability requiring corrective action. Threats are potential sources of harm, not the observed weakness itself.

Question 19Security Fundamentals

Which practice best mitigates insider threat in a high-value warehouse?

  1. Two-person integrity for high-value moves and rotating duties Correct answer.
  2. Allowing staff to take inventory records home for convenience
  3. Issuing master keys to all supervisors so they can respond faster
  4. Limiting background checks to senior management only

Explanation

Controls that remove single-person control over valuable assets and disrupt predictable routines reduce opportunity for internal theft and collusion. Least privilege and accountability are the guiding principles.

Question 20Security Fundamentals

Which of the following is a leading indicator of security program performance?

  1. Percentage of access reviews completed on schedule Correct answer.
  2. Number of incidents closed by the investigations unit per quarter
  3. Number of security incidents recorded in the previous twelve months
  4. Total annual cost of the guard services contract

Explanation

Leading indicators measure preventive activity that predicts future outcomes, such as timely completion of access reviews. Incident counts and closure rates are lagging measures of what already happened.

Question 21Security Fundamentals

Equipment and data valued at $2,000,000 are housed in a facility where a flood would damage 30 percent of that value and is expected once every four years. What is the annualized loss expectancy?

  1. $2,000,000
  2. $600,000
  3. $500,000
  4. $150,000 Correct answer.

Explanation

Single loss expectancy equals asset value times exposure factor, or $2,000,000 × 0.30 = $600,000. The annualized rate of occurrence is one event every four years, or 0.25, so ALE = $600,000 × 0.25 = $150,000.

Question 22Security Fundamentals

Which statement best reflects enterprise security risk management (ESRM)?

  1. Physical and cyber risks are managed as separate programs with no shared governance or reporting
  2. Security risk is owned by business units and aligned with organizational objectives Correct answer.
  3. Security decisions are made solely by the security department and then communicated downward to staff
  4. Every identified risk must be eliminated regardless of cost or business impact

Explanation

ESRM treats security risk as a business risk, with business leaders accountable for it and security professionals providing advice and assurance. Prioritization follows the organization's mission and risk appetite rather than a mandate to eliminate all risk.

Question 23Security Fundamentals

Which relationship between the recovery time objective and the maximum tolerable downtime is correct?

  1. RTO must be longer than MTD so that testing can be completed
  2. RTO is calculated by multiplying the MTD by the annualized rate of occurrence
  3. RTO must be shorter than MTD to keep disruption within tolerance Correct answer.
  4. RTO and MTD are unrelated; only the RPO matters

Explanation

MTD is the longest outage the business can absorb; the RTO is the target time to restore the function and must fall inside that window. Designing an RTO longer than the MTD guarantees unacceptable impact.

Question 24Security Fundamentals

Security convergence is best described as:

  1. Merging the security department into the finance function
  2. Integrating physical and cyber security functions and governance Correct answer.
  3. Replacing all security officers with automated monitoring systems
  4. Standardizing all security policies across international sites

Explanation

Convergence brings physical and information security under shared management, technology, and policy so that risks are addressed holistically. The driver is the overlap of threats and systems, not headcount reduction or organizational reshuffling.

Question 25Security Fundamentals

In a three lines of defense model, a security function that sets standards and monitors compliance while operational management owns the risk is best described as:

  1. A second-line oversight function Correct answer.
  2. An external audit function
  3. A first-line operational function
  4. A third-line assurance function

Explanation

The first line owns and manages risk operationally, the second line provides frameworks, standards, and monitoring, and the third line gives independent assurance. A function that sets standards and monitors compliance without owning the risk is therefore second line.

Question 26Security Fundamentals

A newly hired employee is scheduled to start work next week and will need access to a sensitive claims system. What should happen before that access is granted?

  1. Issue a permanent badge and update the records later
  2. Delay the screening until the probation period ends
  3. Verify identity and complete the background check Correct answer.
  4. Grant read-only access until the screening is complete

Explanation

Personnel security requires that identity be verified and suitability checks be completed before a person is entrusted with sensitive access. Screening after access has already been granted inverts the order of control and leaves a window of unvetted exposure. Limited or temporary access is not a substitute for completing the check.

Question 27Security Fundamentals

A written policy requires employees to lock their workstations whenever they leave their desks. Which category of control does this policy represent?

  1. An administrative control, such as a written policy Correct answer.
  2. A detective control, such as a log review
  3. A physical control, such as a locked door
  4. A technical control, such as an automatic screen lock

Explanation

Controls are grouped by how they are implemented: administrative (policies, procedures, training), physical (barriers, locks, guards), and technical (hardware, software, configuration). A written directive telling people how to behave is a management or administrative control. The category depends on the mechanism, not on the behavior being directed.

Question 28Security Fundamentals

A data center is protected by a perimeter fence, card-controlled doors, and full-disk encryption on its servers. Which concept does this arrangement best illustrate?

  1. Least privilege, applied to each user account
  2. Defense in depth Correct answer.
  3. Due diligence in procurement
  4. Separation of duties among administrators

Explanation

Defense in depth places multiple independent protective layers so that an adversary must defeat several different controls to succeed. Fences, access-controlled doors, and encryption operate at different points and against different attack methods. A single failure therefore does not by itself expose the asset.

Question 29Security Fundamentals

A clerk at a small firm can both create new vendor records and approve payments to those vendors. Which control most directly addresses this exposure?

  1. Install cameras in the accounts payable work area
  2. Require the clerk to take an annual security awareness course
  3. Encrypt the vendor master file at rest
  4. Separate the vendor setup and payment approval duties Correct answer.

Explanation

Separation of duties divides a sensitive transaction so that no single person can initiate and authorize it, which removes the opportunity for concealed fraud. The exposure here is concentrated authority over both record creation and payment. Other controls may add value but do not break the conflicting combination of duties.

Question 30Security Fundamentals

A data center installs two badge readers at its main entrance so either can grant access if the other fails, but both units are the same model, run the same firmware, and draw power from the same panel. Which conclusion is most accurate?

  1. Two readers guarantee availability of the entrance
  2. A common-mode failure could disable both units at once Correct answer.
  3. Redundancy automatically enforces least privilege
  4. Layering two identical readers provides defense in depth

Explanation

Redundancy only improves availability when the redundant components do not share a single point of failure. Identical hardware, firmware, and power feed create a common-mode failure path that can take out both readers simultaneously. Effective redundancy requires diversity in at least the shared dependency.

Question 31Business Principles and Practices

Why is a payroll department typically classified as a cost center rather than a profit center?

  1. It is reported on the balance sheet rather than the income statement
  2. It bills other departments for the work it performs
  3. It delivers services that do not directly generate revenue Correct answer.
  4. It generates income by investing funds held for payroll

Explanation

A cost center is a unit that incurs costs to support the organization but does not directly produce revenue, which describes payroll. Payroll exists to pay employees accurately and on time, not to sell goods or services. Its costs are therefore budgeted and monitored as overhead.

Question 32Business Principles and Practices

Which two payroll duties should be separated to reduce the risk of undetected fraud?

  1. Preparing the payroll and reconciling the payroll bank account Correct answer.
  2. Calculating gross pay and calculating net pay
  3. Distributing pay stubs and answering employee payroll questions
  4. Collecting time records and entering hours into the payroll system

Explanation

Segregation of duties requires that the person who creates a transaction not also verify or reconcile it. Preparing payroll and reconciling the bank account lets one person both create and conceal an improper payment. Assigning reconciliation to an independent person provides a detective control.

Question 33Business Principles and Practices

Under accrual accounting, wages earned by employees in the last week of December but paid in January should be recorded as:

  1. A reduction of retained earnings
  2. An expense in January only
  3. A liability and an expense in December Correct answer.
  4. A prepaid asset in December

Explanation

The matching principle requires that payroll expense be recognized in the period in which employees performed the work. Because the cash has not yet been paid, the offsetting entry is an accrued liability. The January payment then reduces the liability rather than creating a new expense.

Question 34Business Principles and Practices

Sarbanes-Oxley Section 404 primarily requires public companies to do what?

  1. Require the external audit firm to rotate its lead partner every five years
  2. Assess and report on internal control over financial reporting Correct answer.
  3. Submit payroll tax deposits electronically to the federal government
  4. Disclose the compensation of the chief executive officer in the annual proxy

Explanation

Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, with an independent auditor attestation for larger filers. Payroll processing controls are part of that control environment. The other requirements listed come from different rules or statutes.

Question 35Business Principles and Practices

Under FLSA recordkeeping rules, how long must an employer keep payroll records showing wage rates, amounts paid, and deductions?

  1. Two years
  2. Three years Correct answer.
  3. Seven years
  4. One year

Explanation

The FLSA requires employers to preserve payroll records, including wage rates, hours worked, amounts paid, and deductions, for at least three years. Certain supplementary records such as time cards carry a shorter two-year requirement. State laws may impose longer retention periods.

Question 36Business Principles and Practices

An outstanding check on a payroll bank reconciliation is a check that:

  1. Was returned unpaid for insufficient funds
  2. Has been written and recorded but not yet cleared the bank Correct answer.
  3. Cleared the bank but was never recorded in the ledger
  4. Was voided before it was released to the employee

Explanation

An outstanding check has been issued and recorded in the company's books but has not yet been presented to and paid by the bank. It is a timing difference that is added back or deducted when reconciling book balance to bank balance. It is not an error in either set of records.

Question 37Business Principles and Practices

Which is a primary benefit of direct deposit for an employer?

  1. It eliminates the need to withhold payroll taxes
  2. It guarantees that employees will not overdraw their accounts
  3. It removes the need for a payroll register
  4. It reduces check printing, postage, and reconciliation costs Correct answer.

Explanation

Direct deposit lowers administrative cost by eliminating check stock, printing, postage, and much of the manual reconciliation and escheatment work associated with paper checks. It also reduces fraud exposure from stolen or forged checks. Tax withholding and payroll register requirements are unaffected.

Question 38Business Principles and Practices

Applying the principle of least privilege to a payroll system means:

  1. All users share a single administrative login
  2. Users receive only the access required for their job duties Correct answer.
  3. Every employee can view the payroll register
  4. Access rights are granted to the payroll vendor only

Explanation

Least privilege limits each user's access to the minimum needed to perform assigned duties. This reduces the chance that a single compromised or misused account can alter pay rates, bank details, or tax data across the organization. It also simplifies audit and access reviews.

Question 39Business Principles and Practices

An employer spends $48,000 per year on payroll processing and issues 2,400 paychecks annually. What is the cost per paycheck?

  1. $20 Correct answer.
  2. $12
  3. $24
  4. $48

Explanation

Cost per paycheck equals total annual processing cost divided by the number of paychecks issued. Dividing $48,000 by 2,400 paychecks yields $20 per paycheck. This metric is a common benchmark for comparing payroll operations.

Question 40Business Principles and Practices

Benchmarking a payroll operation typically involves:

  1. Setting every employee's pay rate at the market median for the job
  2. Converting all salaried employees to hourly status to control overtime
  3. Comparing payroll cost and performance metrics with peer organizations Correct answer.
  4. Auditing the payroll tax filings submitted for the prior four calendar quarters

Explanation

Benchmarking compares measures such as cost per paycheck, error rates, and processing time against similar organizations or published survey data. The purpose is to identify performance gaps and set improvement targets. It does not itself change pay levels or employee status.

Question 41Business Principles and Practices

When selecting a new payroll service provider, an RFP is used primarily to:

  1. Obtain comparable proposals from multiple vendors Correct answer.
  2. Satisfy IRS requirements for electronic filing
  3. Set the pay rates the vendor will charge employees
  4. Transfer legal liability for payroll errors to the vendor

Explanation

A request for proposal states the organization's requirements and asks vendors to respond in a consistent format so proposals can be compared. It structures the evaluation of functionality, service levels, and price. The employer retains legal responsibility for payroll compliance regardless of vendor.

Question 42Business Principles and Practices

How does a business continuity plan differ from a disaster recovery plan?

  1. Continuity planning is mandated by Sarbanes-Oxley; recovery planning remains optional for employers
  2. Continuity keeps core business functions running; recovery restores technology and data Correct answer.
  3. Continuity planning applies only to hourly employees; recovery planning applies to salaried staff
  4. Continuity addresses only the technology infrastructure; recovery addresses only staffing

Explanation

Business continuity focuses on keeping essential functions such as payroll and pay delivery operating during a disruption, often through manual workarounds. Disaster recovery is the narrower technical plan for restoring systems, data, and infrastructure after an outage. The two plans work together.

Question 43Business Principles and Practices

Unclaimed wages owed to a former employee who cannot be located must generally be:

  1. Reported to the state as unclaimed property after the dormancy period Correct answer.
  2. Kept permanently by the employer as abandoned funds once the employee leaves
  3. Distributed to the employee's former co-workers on the same shift
  4. Donated to a charitable organization selected by the employer

Explanation

Most states require holders of unclaimed wages to perform due diligence and then remit the funds under escheat laws after a dormancy period. The state holds the funds for the rightful owner. Employers cannot keep, redirect, or donate those wages.

Question 44Business Principles and Practices

An imprest payroll bank account is one that:

  1. Pays all company expenses from a single general account
  2. Holds a fixed balance that is replenished for each payroll Correct answer.
  3. Earns interest that is paid to employees
  4. Is used only for payroll tax deposits

Explanation

An imprest account is maintained at a fixed amount; the employer deposits exactly the net payroll each cycle and the account is drawn down as checks clear. This separates payroll cash from operating funds and makes reconciliation easier. Interest or residual balances do not belong to employees.

Question 45Business Principles and Practices

Float in a payroll context refers to:

  1. The variance between budgeted payroll cost and actual payroll cost
  2. Funds available between the time payroll is funded and checks clear Correct answer.
  3. The accrued value of paid time off that employees have earned but not taken
  4. The unused portion of an employee's federal withholding allowance

Explanation

Float is the short interval during which payroll funds have been deposited but the related checks or electronic debits have not yet cleared. Some employers historically earned interest on those balances, although faster electronic settlement has reduced the effect. It is a cash management concept, not a tax or accrual concept.

Question 46Business Principles and Practices

Which control best mitigates the risk of an unauthorized change to an employee's direct deposit account?

  1. Requiring employee authorization plus independent review of the change Correct answer.
  2. Recalculating the employee's gross pay each period before the payroll run
  3. Rotating payroll staff through different job assignments every quarter
  4. Mailing a printed pay stub to the employee's home address every pay period

Explanation

Bank account changes are a common fraud target, so best practice is to require the employee's authenticated request and a second person's verification before the change takes effect. Independent review prevents a single insider from redirecting pay. Pay stub mailings and gross pay checks occur after the change is already in place.

Question 47Business Principles and Practices

Which is the most useful driver for forecasting hourly payroll expense in an annual budget?

  1. The number of vendors paid during the year
  2. The corporate income tax rate for the year
  3. Last year's total company revenue
  4. Budgeted hours and planned pay rates by department Correct answer.

Explanation

Hourly payroll cost is built from hours to be worked multiplied by the applicable pay rates, including overtime and shift premiums. Budgeting at the department level improves accountability and allows variance analysis. Revenue, vendor counts, and income tax rates do not drive hourly wage cost.

Question 48Business Principles and Practices

In a typical payroll journal entry, the credit side records:

  1. Gross wages expense for the period
  2. The employer's share of payroll taxes as revenue
  3. Depreciation of payroll equipment
  4. Payroll tax withholdings and net pay payable Correct answer.

Explanation

Payroll expense is debited for gross wages, while credits record the liabilities created: employee withholdings payable to tax authorities and other recipients, and net pay payable to employees. When payment occurs, the liabilities are debited and cash is credited. Recording withholdings as revenue would misstate the financial statements.

Question 49Business Principles and Practices

When converting to a new payroll system, parallel testing means:

  1. Installing two servers so that either one can process the payroll run
  2. Having two vendors process payroll on alternating pay cycles
  3. Testing the new system only after the old system has been permanently retired
  4. Running the old and new systems at the same time and comparing results Correct answer.

Explanation

Parallel testing processes at least one payroll cycle in both systems and compares the outputs to confirm the new system calculates pay, taxes, and deductions correctly. It provides evidence before cutover and reduces the risk of employee pay errors. It is a temporary validation step, not a permanent operating model.

Question 50Business Principles and Practices

A service level agreement with a payroll provider typically specifies:

  1. The exact number of employees the client will hire during the contract term
  2. Measurable performance standards such as accuracy and turnaround time Correct answer.
  3. The payroll tax rates the provider will charge the client each year
  4. The annual salary paid to the provider's chief executive officer

Explanation

A service level agreement defines measurable standards the provider must meet, such as processing accuracy, timeliness, and issue resolution, along with remedies for misses. It supports vendor oversight and gives the client a basis for performance reviews. Staffing levels, tax rates, and vendor executive pay are outside its scope.