I85PREP
⌘ K
Certification CGPC study materials
Certification CGPC study resources

Certification CGPC practice questions

One question at a time. Build your Certification CGPC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance Foundations

Which statement best describes the primary purpose of a governance, risk, and compliance (GRC) program?

  1. To guarantee that the organization will never experience a compliance violation
  2. To replace the internal audit function with automated monitoring tools
  3. To centralize all IT spending decisions under the security team
  4. To integrate risk management, compliance obligations, and business objectives into a coordinated set of activities Correct answer.

Explanation

A GRC program aligns governance (decision rights and oversight), risk management, and compliance activities so they reinforce business objectives rather than operate in silos. It enables informed risk-taking and coordinated oversight; it cannot eliminate violations entirely.

Question 2Governance, Risk, and Compliance Foundations

In governance terms, what distinguishes accountability from responsibility?

  1. Accountability applies only to external regulators, while responsibility applies to employees
  2. Accountability can be delegated to any team member, while responsibility stays with the board
  3. Accountability is optional documentation, while responsibility is mandatory reporting
  4. Accountability is the obligation to answer for outcomes, while responsibility is the duty to perform the work Correct answer.

Explanation

Accountability means owning and answering for the final outcome and cannot be fully delegated away, whereas responsibility refers to the obligation to carry out specific tasks. Clear separation of the two prevents gaps and duplicated ownership in control structures.

Question 3Governance, Risk, and Compliance Foundations

A company adopts a three lines model. Which group forms the first line?

  1. External regulators performing inspections
  2. The internal audit function
  3. Operational management that owns and manages risk day to day Correct answer.
  4. The board of directors

Explanation

In the three lines model, operational management owns and manages risk in the course of daily business, forming the first line. The second line provides risk and compliance oversight, and internal audit forms the third line of independent assurance.

Question 4Governance, Risk, and Compliance Foundations

Which of the following is the best example of a preventive control?

  1. An annual external audit opinion
  2. A post-incident root cause analysis report
  3. A monthly reconciliation performed after transactions post
  4. A mandatory approval workflow that blocks payments above a threshold Correct answer.

Explanation

Preventive controls stop an unwanted event before it occurs; an approval gate that blocks excessive payments is preventive because it intervenes before the transaction completes. Detective controls, by contrast, identify problems after the fact.

Question 5Governance, Risk, and Compliance Foundations

What is the core purpose of a risk register?

  1. To list every employee who has completed security awareness training
  2. To archive closed audit findings permanently without review
  3. To record identified risks with owners, ratings, and treatment status so they can be tracked and managed Correct answer.
  4. To document the organization's chart of accounts

Explanation

A risk register is the central record of identified risks, typically capturing description, owner, likelihood and impact ratings, and treatment status. It supports prioritization, monitoring, and reporting to governance bodies.

Question 6Governance, Risk, and Compliance Foundations

Which concept holds that the cost of a control should not exceed the benefit it provides?

  1. Segregation of duties
  2. Risk appetite
  3. Defense in depth
  4. Proportionality of controls Correct answer.

Explanation

Proportionality means controls are sized to the risk they address, so cost and effort remain reasonable relative to the benefit. This principle prevents over-control that burdens the business without meaningful risk reduction.

Question 7Governance, Risk, and Compliance Foundations

What does the term 'risk appetite' describe?

  1. The list of risks that have been fully eliminated
  2. The annual budget allocated to insurance premiums
  3. The maximum loss the organization has ever recorded
  4. The amount and type of risk an organization is willing to pursue or accept to meet its objectives Correct answer.

Explanation

Risk appetite expresses how much and what kind of risk the organization is willing to accept in pursuit of its objectives. It guides decision-making and sets boundaries for risk tolerance at lower levels.

Question 8Governance, Risk, and Compliance Foundations

Which activity is the primary responsibility of an independent internal audit function?

  1. Setting the organization's risk appetite on behalf of the board
  2. Providing objective assurance on the effectiveness of governance, risk, and control processes Correct answer.
  3. Approving business unit budgets
  4. Designing and operating the organization's internal controls

Explanation

Internal audit provides independent, objective assurance to the board and management about whether governance, risk management, and controls are working effectively. To preserve independence, it should not design or operate the controls it assesses.

Question 9Governance, Risk, and Compliance Foundations

An organization defines tolerance levels for a key risk indicator. Which statement best explains how tolerance differs from risk appetite?

  1. Tolerance is the acceptable variation around a target before action is triggered, while appetite is the overall level of risk the organization will accept Correct answer.
  2. Tolerance applies only to financial risks, while appetite applies only to operational risks
  3. Tolerance is set by regulators, while appetite is set by customers
  4. Tolerance and appetite are identical and can be used interchangeably

Explanation

Risk appetite is the high-level amount of risk the organization is willing to accept, while tolerance translates that into concrete acceptable ranges around specific metrics that trigger action when breached. Tolerance operationalizes appetite at the process level.

Question 10Governance, Risk, and Compliance Foundations

A compliance team maps each regulatory requirement to the specific policy, control, and evidence that satisfies it. What is this practice called?

  1. Penetration testing
  2. Business continuity planning
  3. Control mapping or obligation mapping Correct answer.
  4. Vendor risk tiering

Explanation

Mapping obligations to policies, controls, and evidence creates traceability between regulatory requirements and the mechanisms that satisfy them. This supports gap analysis, audit readiness, and change impact assessment when regulations shift.

Question 11Governance, Risk, and Compliance Foundations

A risk is assessed as high likelihood and high impact, but the organization decides to purchase cyber insurance to offset potential losses. Which risk treatment option is this?

  1. Avoidance
  2. Transfer Correct answer.
  3. Mitigation
  4. Acceptance

Explanation

Transferring risk shifts the financial consequence to a third party, and insurance is the classic example. The underlying risk still exists, but the organization is compensated for covered losses.

Question 12Governance, Risk, and Compliance Foundations

Which situation most clearly represents a segregation of duties conflict?

  1. An auditor samples transactions after period end
  2. A developer writes code and a separate tester validates it
  3. The same employee can create a vendor record and approve payments to that vendor Correct answer.
  4. A manager reviews a report produced by a subordinate

Explanation

Segregation of duties requires that no single person controls all stages of a sensitive transaction. Allowing one employee to both create a vendor and approve payments to it concentrates the ability to commit and conceal fraud.

Question 13Governance, Risk, and Compliance Foundations

A new regulation takes effect in six months. The compliance lead must determine which existing controls already satisfy it and where gaps exist. What is the most appropriate first step?

  1. Immediately purchase new compliance software
  2. Perform a gap assessment mapping the regulation's requirements to current controls Correct answer.
  3. Suspend all affected business processes until the deadline
  4. Wait until the regulation is enforced before acting

Explanation

A gap assessment compares the new requirements against existing controls to identify what is already covered and what must be built or changed. This scoping step ensures effort and budget target genuine gaps rather than duplicating existing coverage.

Question 14Governance, Risk, and Compliance Foundations

Which characteristic most distinguishes a key risk indicator (KRI) from a key performance indicator (KPI)?

  1. A KRI is always quantitative, while a KPI is always qualitative
  2. A KRI measures forward-looking risk exposure, while a KPI measures achievement of business objectives Correct answer.
  3. A KRI is reported only to external regulators, while a KPI is internal
  4. A KRI is reviewed annually, while a KPI is reviewed daily

Explanation

KRIs are designed to signal changes in risk exposure and often serve as early warnings, whereas KPIs track progress toward performance goals. Both can be quantitative or qualitative, and reporting frequency varies for each.

Question 15Governance, Risk, and Compliance Foundations

A control self-assessment (CSA) program asks business process owners to evaluate their own controls. What is the main governance benefit of this approach?

  1. It guarantees that no control failures will occur
  2. It transfers accountability for controls to the audit function
  3. It eliminates the need for any independent assurance
  4. It increases ownership and timely identification of control weaknesses by those closest to the process Correct answer.

Explanation

CSAs engage process owners in evaluating their controls, which strengthens ownership and surfaces issues early. They complement, but do not replace, independent assurance from internal audit.

Question 16Governance, Risk, and Compliance Foundations

An organization's board delegates day-to-day risk decisions to management but retains oversight of the risk framework. Which governance principle does this illustrate?

  1. Reservation of authority with delegated execution and retained oversight Correct answer.
  2. Separation of the audit committee from the board
  3. Complete abdication of board responsibility
  4. Outsourcing of governance to a third party

Explanation

Boards typically delegate operational decision-making to management while retaining responsibility for oversight of the risk framework and strategy. This balances efficient execution with accountable governance.

Question 17Governance, Risk, and Compliance Foundations

Which document typically defines the authority, scope, and reporting lines of a risk management function?

  1. A marketing plan
  2. A disaster recovery test script
  3. A risk management charter Correct answer.
  4. A purchase order

Explanation

A charter establishes the mandate, scope, authority, and reporting relationships of a function such as risk management or internal audit. It provides the formal basis for the function's independence and responsibilities.

Question 18Governance, Risk, and Compliance Foundations

A compliance officer discovers that a business unit has been interpreting a policy in a way that conflicts with the regulator's published guidance. What is the most appropriate immediate action?

  1. Publicly announce the issue before any internal review
  2. Immediately terminate the business unit manager
  3. Document the discrepancy, assess exposure, and escalate through governance channels for a decision Correct answer.
  4. Ignore the discrepancy because the policy is internally approved

Explanation

The officer should document the issue, assess the potential exposure, and escalate to the appropriate governance body so a reasoned decision can be made. This preserves evidence and ensures remediation is authorized and proportionate.

Question 19Governance, Risk, and Compliance Foundations

Which statement best captures the relationship between policies, standards, and procedures?

  1. Policies apply only to executives, standards to auditors, and procedures to customers
  2. Policies describe technical steps, standards set strategy, and procedures define intent
  3. Policies are optional guidelines, standards are suggestions, and procedures are legal contracts
  4. Policies are mandatory high-level intent, standards set specific requirements, and procedures describe step-by-step execution Correct answer.

Explanation

The hierarchy moves from policy (management's high-level intent and mandatory direction) to standards (specific, measurable requirements) to procedures (detailed steps for performing tasks). Each level becomes more specific and operational.

Question 20Governance, Risk, and Compliance Foundations

A risk owner is assigned to each entry in the risk register. What is the risk owner primarily accountable for?

  1. Approving the organization's overall budget
  2. Performing independent audit testing of the risk
  3. Deciding how the risk will be treated and ensuring treatment is carried out and monitored Correct answer.
  4. Maintaining the physical security of the data center

Explanation

The risk owner is accountable for managing a specific risk, including selecting and implementing a treatment approach and monitoring whether exposure stays within tolerance. This assigns clear ownership so risks are not left unmanaged.

Question 21Governance, Risk, and Compliance Foundations

An organization wants to compare its GRC maturity against peers and identify improvement priorities. Which approach is most appropriate?

  1. Adopting a recognized maturity model and conducting a structured self-assessment against its levels Correct answer.
  2. Copying a competitor's policy manual verbatim
  3. Relying solely on anecdotal feedback from one business unit
  4. Measuring only the number of audit findings closed

Explanation

A recognized maturity model provides a structured scale against which the organization can assess current practices and prioritize improvements. It enables benchmarking and a repeatable roadmap rather than isolated metrics.

Question 22Governance, Risk, and Compliance Foundations

A multinational firm must reconcile conflicting data protection requirements across jurisdictions where it operates. Which governance approach is most defensible?

  1. Delegate all compliance decisions to individual employees without guidance
  2. Ignore local laws where the headquarters country's rules are stricter
  3. Apply the least stringent requirement everywhere to reduce cost
  4. Identify the strictest applicable requirements and design a baseline that satisfies them while documenting justified local variations Correct answer.

Explanation

A common approach is to build a baseline aligned to the most stringent applicable requirements, then document and justify any local variations needed for specific jurisdictions. This reduces complexity while respecting local legal obligations.

Question 23Governance, Risk, and Compliance Foundations

A board committee wants assurance that the enterprise risk framework is operating as designed, not just that individual risks are within tolerance. Which evidence best addresses this?

  1. A list of the top ten risks with current ratings
  2. The number of risk workshops held during the year
  3. Results of independent testing of the framework's processes, combined with management's own monitoring metrics Correct answer.
  4. The total budget spent on risk software

Explanation

Assurance about the framework's operation requires independent evaluation of its processes plus management's monitoring data, showing both design and operating effectiveness. Individual risk ratings alone do not demonstrate that the framework itself functions.

Question 24Governance, Risk, and Compliance Foundations

An organization sets a risk appetite statement but business units routinely exceed it without consequence. What is the most significant governance weakness this reveals?

  1. The organization has too many risk owners
  2. The risk appetite statement was written in the wrong language
  3. There is no effective linkage between the appetite statement and decision-making, incentives, and escalation Correct answer.
  4. The internal audit plan is too broad

Explanation

A risk appetite only has force when it is embedded in decision rights, limits, incentives, and escalation paths so breaches trigger action. Without that linkage, the statement is aspirational and provides no real constraint on risk-taking.

Question 25Governance, Risk, and Compliance Foundations

During a regulatory examination, an examiner requests evidence that a specific control operated consistently throughout the year. Which combination best supports this assertion?

  1. The control's design document alone
  2. A single screenshot taken on the last day of the year
  3. A sample of operating evidence across the period plus the control description and any exceptions noted Correct answer.
  4. A verbal confirmation from the control owner

Explanation

Demonstrating consistent operation requires both a description of the control and evidence of its execution across the period, including any exceptions and how they were resolved. Design documents or single snapshots cannot show consistency over time.

Question 26Governance, Risk, and Compliance Foundations

Which statement best defines inherent risk in a GRC risk assessment?

  1. The portion of risk that is transferred to a third party through a contract
  2. The risk that remains after management has designed and implemented controls
  3. The variance between a key risk indicator and its approved tolerance threshold
  4. The exposure that exists before any controls or mitigations are applied Correct answer.

Explanation

Inherent risk is the level of exposure a process or activity carries before controls are applied, so it establishes the baseline against which control effectiveness is judged. Residual risk is calculated afterwards by considering how well those controls actually reduce the exposure. Keeping the two distinct lets management see whether a low residual rating reflects strong controls or simply an understated starting point.

Question 27Governance, Risk, and Compliance Foundations

A compliance program uses a three-lines model. Which group constitutes the second line?

  1. Front-line operations staff who own and execute the controls daily
  2. The risk and compliance function that sets frameworks and monitors the first line Correct answer.
  3. The external auditor engaged to opine on the financial statements
  4. Internal audit, which reports independently to the board

Explanation

In the three-lines model the first line owns and operates controls, the second line provides independent oversight, frameworks, and challenge, and the third line is internal audit giving independent assurance. The risk and compliance function therefore sits in the second line because it designs and monitors the control environment without owning the business process. External audit is outside the model entirely.

Question 28Governance, Risk, and Compliance Foundations

A risk register entry is rated low likelihood but severe impact. Which treatment decision is most consistent with that profile?

  1. Reduce monitoring because the annualized loss estimate is small
  2. Ignore the entry until a loss event actually occurs
  3. Transfer or insure the risk because the potential severity exceeds the appetite Correct answer.
  4. Accept the risk because the likelihood is low

Explanation

When impact is severe, even a low-probability event can breach the organization's risk appetite, so transferring or insuring the tail exposure is a defensible treatment. Acceptance is normally reserved for risks whose combined exposure falls within appetite. Low likelihood does not justify dropping monitoring, because rare events are exactly what tail-risk oversight is meant to catch.

Question 29Governance, Risk, and Compliance Foundations

Which statement correctly distinguishes a compliance obligation register from a control inventory?

  1. The control inventory lists external requirements, while the obligation register lists the safeguards that satisfy them
  2. The obligation register is used only by internal audit, while the control inventory is used only by operations
  3. Both documents are identical in purpose and differ only in the department that maintains them
  4. The obligation register lists external requirements the organization must meet, while the control inventory lists safeguards that address those requirements Correct answer.

Explanation

An obligation register captures the laws, regulations, and contractual duties that apply to the organization and is the source of 'what must we do'. A control inventory describes the safeguards the organization has put in place and is the source of 'how do we do it'. Mapping the two together is what demonstrates traceable compliance coverage.

Question 30Governance, Risk, and Compliance Foundations

An organization's risk appetite statement says the firm is conservative about regulatory breaches but willing to accept operational experimentation risk. A product team proposes a novel process with unproven controls. What should the risk function do first?

  1. Assess the proposal against the stated appetite and require compensating controls before launch Correct answer.
  2. Approve the proposal because operational experimentation is within appetite
  3. Reject the proposal outright because unproven controls are never acceptable
  4. Escalate directly to the regulator for pre-approval of the new process

Explanation

Risk appetite is expressed at the category level, so a proposal must be evaluated against the relevant category rather than treated as globally acceptable or unacceptable. The team should assess the exposure and attach compensating controls where the residual level is unclear. Blanket rejection ignores the stated willingness to take operational risk, while blanket approval ignores the unproven control environment.

Question 31Governance, Risk, and Compliance Foundations

Which item is best classified as a detective control rather than a preventive control?

  1. An access restriction that limits system entry to authorized staff
  2. A mandatory approval step before a purchase order is released
  3. A system rule that blocks a payment to an unapproved vendor
  4. A monthly reconciliation that identifies unauthorized changes after they occur Correct answer.

Explanation

Detective controls identify errors or irregularities after the fact, and a reconciliation performed after transactions post is the classic example. Preventive controls stop an event from happening in the first place, which is what blocking rules, approval gates, and access restrictions do. Classifying controls correctly matters because detective controls cannot prevent a loss, only surface it early.

Question 32Governance, Risk, and Compliance Foundations

A GRC team wants a single view showing how each regulatory requirement is covered by controls, what evidence exists, and who owns the residual risk. Which structure delivers this?

  1. A requirements-to-controls traceability matrix linked to the risk register Correct answer.
  2. An incident log recording past compliance failures
  3. A control self-assessment questionnaire distributed to business units
  4. A business impact analysis covering critical processes

Explanation

A traceability matrix links each requirement to the controls that satisfy it, the evidence that proves operation, and the accountable owner, which is exactly the consolidated view described. A self-assessment questionnaire gathers opinions on control performance but does not map requirements to controls. Incident logs and impact analyses support other GRC purposes and lack the requirement-to-control linkage.

Question 33Governance, Risk, and Compliance Foundations

Which element most distinguishes a compliance framework from a compliance policy?

  1. A framework applies only to regulated firms, while a policy applies to all firms
  2. A framework is a structured set of components and processes for managing compliance, while a policy states a mandatory position or requirement Correct answer.
  3. A framework is legally binding, while a policy is always voluntary guidance
  4. A framework is written by regulators, while a policy is written by auditors

Explanation

A compliance framework is the overarching structure, covering governance, risk assessment, controls, monitoring, and reporting, that an organization uses to manage its obligations. A policy is a specific mandatory statement of position that sits inside that structure. Confusing the two leads organizations to treat a single policy document as if it were a complete management system.

Question 34Governance, Risk, and Compliance Foundations

A control owner reports that a control operated without exception for the year but cannot produce evidence of operation for two months. How should the GRC function treat this result?

  1. Accept the control as fully effective because the owner's attestation is sufficient
  2. Remove the control from the inventory because it cannot be evidenced
  3. Reclassify the control as a design deficiency rather than an operating issue
  4. Record it as an operating effectiveness gap and assess the exposure for the unsupported period Correct answer.

Explanation

Operating effectiveness requires evidence that the control actually ran throughout the period, so an unevidenced interval is a gap regardless of what the owner reports. The right response is to log the gap and evaluate what exposure the organization carried during those months. The control's design may still be sound, so it should not be reclassified as a design deficiency or deleted.

Question 35Governance, Risk, and Compliance Foundations

Which statement best explains why a compliance risk assessment should be refreshed when a new regulation is issued?

  1. New obligations can change the likelihood and impact of noncompliance, which may shift risk ratings and control priorities Correct answer.
  2. Regulations automatically invalidate all existing policies and require a complete rewrite
  3. Risk assessments are refreshed on a fixed calendar and should never be triggered by external events
  4. A refresh is needed only to update the document's version number for audit purposes

Explanation

A compliance risk assessment estimates exposure from failing to meet obligations, so a new obligation can change both the likelihood and the impact of noncompliance. That shift can move a risk above appetite and reprioritize which controls need attention first. Treating the assessment as calendar-only would leave the register out of step with the actual obligation set.

Question 36Governance, Risk, and Compliance Foundations

Which metric is the clearest example of a key risk indicator for a third-party risk program?

  1. The average number of days from invoice receipt to payment
  2. The percentage of critical vendors that have not completed an annual security assessment Correct answer.
  3. The total spend committed to external suppliers this year
  4. The number of vendor contracts signed in the quarter

Explanation

A key risk indicator tracks exposure to a defined risk, and the share of critical vendors lacking a current assessment directly measures unmanaged third-party exposure. The other measures describe volume, cycle time, or spend, which are performance metrics rather than indicators of risk. The distinction matters because KRIs should be able to move a risk rating, while pure activity counts usually cannot.

Question 37Governance, Risk, and Compliance Foundations

A business unit wants to accept a risk that sits above the approved appetite for that category. Who should make that decision?

  1. The business unit manager, because the unit bears the operational consequences
  2. The internal audit function, because it provides independent assurance
  3. The escalation authority designated in the risk governance framework, such as a risk committee or executive Correct answer.
  4. The risk owner alone, because the owner is accountable for the risk

Explanation

Accepting exposure above appetite is an exception to the approved risk boundaries, so the governance framework should designate who can authorize it, typically a risk committee or senior executive above the risk owner. The risk owner can manage and monitor the risk but cannot unilaterally override the appetite set at a higher level. Internal audit provides assurance and must not make management risk decisions.

Question 38Governance, Risk, and Compliance Foundations

An organization discovers that a policy exception was granted verbally and never recorded. Which control weakness does this most directly represent?

  1. A design flaw in the underlying business process being governed by the policy
  2. A breakdown in the exception management and documentation process Correct answer.
  3. A failure of the business continuity plan to cover the affected process
  4. An excessive segregation of duties between approver and record keeper

Explanation

Exception management requires that deviations from policy be formally approved, time-bound, and documented so they can be monitored and closed. A verbal exception with no record breaks that process and leaves the organization unable to demonstrate who approved the deviation or when it expires. The underlying business process and continuity planning are separate concerns.

Question 39Governance, Risk, and Compliance Foundations

Which practice best demonstrates that a governance framework is being monitored for effectiveness rather than merely existing on paper?

  1. Distributing the framework to all staff during onboarding only
  2. Tracking framework-level metrics such as overdue risk treatments and repeat findings, and reporting them to a governing body Correct answer.
  3. Publishing the framework on the corporate intranet and requiring annual acknowledgment
  4. Retaining an external consultant to rewrite the framework every year

Explanation

Monitoring effectiveness requires measures that show whether the framework is producing the intended behavior, such as overdue treatments and repeat findings, reported upward so a governing body can act. Publication, acknowledgment, and onboarding distribution show awareness but not whether the framework works. Rewriting the document annually changes the artifact without demonstrating that it functions.

Question 40Governance, Risk, and Compliance Foundations

A GRC analyst must decide whether a finding is a control deficiency or a compliance breach. Which distinction is most accurate?

  1. A compliance breach relates only to financial reporting, while a control deficiency relates only to operations
  2. A control deficiency is reported to regulators, while a compliance breach is handled internally
  3. A control deficiency is a weakness in design or operation, while a compliance breach is an actual failure to meet an obligation Correct answer.
  4. A control deficiency always results in a compliance breach, so the terms are interchangeable

Explanation

A deficiency describes a weakness in how a control is designed or operated, whereas a breach describes an actual failure to satisfy a legal or regulatory obligation. A deficiency raises the likelihood of a breach but does not by itself constitute one, which is why the two are tracked and escalated differently. Conflating them either overstates weaknesses as violations or understates real failures.

Question 41Regulatory Environment and Legal Obligations

Under the CGPC framework, which document typically sets out the primary legal obligations a certified gaming professional must follow when operating in a regulated jurisdiction?

  1. The vendor's product roadmap
  2. The applicable gaming statute and its subsidiary regulations Correct answer.
  3. The internal marketing style guide
  4. The employee social calendar

Explanation

Legal obligations in regulated gaming flow from the governing statute and the regulations issued under it, which together bind licence holders and their certified staff. Internal guides and commercial documents cannot create or override those statutory duties.

Question 42Regulatory Environment and Legal Obligations

A CGPC-certified operator receives a formal information request from the gaming regulator. What is the most appropriate first compliance action?

  1. Respond within the stated deadline through the designated compliance channel Correct answer.
  2. Publish the request on social media
  3. Forward it to a competitor for advice
  4. Ignore it until a second reminder arrives

Explanation

Regulatory information requests carry legal deadlines, and responses must be coordinated through the designated compliance function so that accuracy and confidentiality are preserved. Delaying or disclosing the request externally can itself constitute a breach.

Question 43Regulatory Environment and Legal Obligations

Which principle best describes the purpose of anti-money laundering obligations for a CGPC-certified gaming professional?

  1. Maximising the number of high-value players
  2. Increasing advertising reach
  3. Detecting and reporting suspicious activity to protect the financial system Correct answer.
  4. Reducing staff training costs

Explanation

AML obligations exist to detect, deter, and report money laundering so that gaming operators do not become vehicles for criminal proceeds. Customer due diligence and suspicious transaction reporting are the core mechanisms.

Question 44Regulatory Environment and Legal Obligations

What does the 'know your customer' requirement primarily oblige a licensed gaming operator to do?

  1. Offer credit to all verified players
  2. Verify player identity and understand the nature of their activity Correct answer.
  3. Record only the player's nickname
  4. Collect marketing preferences at sign-up

Explanation

KYC requires identity verification and an understanding of the customer's activity and risk profile before and during the business relationship. It is a preventive control, not a marketing or credit function.

Question 45Regulatory Environment and Legal Obligations

Which of the following is generally a protected category under equality and anti-discrimination law in the gaming workplace?

  1. Age Correct answer.
  2. Favourite sports team
  3. Commuting route
  4. Preferred gaming product

Explanation

Age is a recognised protected characteristic in most anti-discrimination regimes, alongside characteristics such as sex, race, and disability. Personal preferences such as products or routes are not protected categories.

Question 46Regulatory Environment and Legal Obligations

A regulator issues a new directive that conflicts with an existing internal procedure. What should the certified professional do?

  1. Follow the regulatory directive and escalate the procedure for update Correct answer.
  2. Apply whichever is more convenient for the shift
  3. Ask a colleague to decide informally
  4. Continue using the internal procedure until annual review

Explanation

Regulatory directives take precedence over internal procedures, and the conflict must be escalated so the procedure is amended. Continuing under a superseded procedure creates a compliance breach.

Question 47Regulatory Environment and Legal Obligations

Which record-keeping practice best supports a CGPC-certified operator's ability to demonstrate compliance during a regulatory inspection?

  1. Keeping records in an undocumented spreadsheet on a personal device
  2. Storing records only in personal email accounts
  3. Deleting records once the shift ends
  4. Retaining dated, attributable records for the mandated retention period Correct answer.

Explanation

Compliance records must be complete, attributable, and retained for the period the regulator prescribes so that obligations can be evidenced later. Personal or ephemeral storage undermines integrity and availability.

Question 48Regulatory Environment and Legal Obligations

What is the primary purpose of a suspicious activity report filed by a gaming operator?

  1. To advertise the operator's compliance programme
  2. To alert the financial intelligence unit to potential criminal proceeds Correct answer.
  3. To close the player's account automatically
  4. To recover debts owed by the player

Explanation

A suspicious activity report informs the financial intelligence unit so it can analyse and act on potential money laundering or terrorist financing. It is not a debt recovery or marketing tool and does not itself close accounts.

Question 49Regulatory Environment and Legal Obligations

A player requests access to the personal data an operator holds about them. Under data protection law, what must the operator generally do?

  1. Delete all compliance records immediately
  2. Provide the requested personal data subject to lawful exemptions Correct answer.
  3. Refuse because the data belongs to the operator
  4. Sell the data to a third party instead

Explanation

Data protection law gives individuals rights of access to their personal data, subject to defined exemptions such as crime prevention. Refusal is only lawful where a specific exemption or restriction applies.

Question 50Regulatory Environment and Legal Obligations

Which statement correctly describes the relationship between a licence condition and general statutory duties?

  1. A licence condition replaces all statutory duties
  2. A licence condition adds specific requirements on top of the general statutory duties Correct answer.
  3. A licence condition has no legal effect once issued
  4. A licence condition applies only to marketing staff

Explanation

Licence conditions are binding, tailored requirements that operate alongside the general duties in the statute. Compliance therefore requires satisfying both layers rather than choosing one.