I85PREP
⌘ K
III IC-85 study materials
III IC-85 study resources

III IC-85 practice questions

One question at a time. Build your III IC-85 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Subject content for IC-85 (not enumerated in the official source)

In the context of an insurance company's internal control system, what is the primary purpose of the segregation of duties principle?

  1. To allow one person to authorize, record, and reconcile the same transaction
  2. To prevent any single individual from having control over all aspects of a transaction Correct answer.
  3. To ensure that all employees receive identical levels of training
  4. To guarantee that the company earns a profit on every underwriting decision

Explanation

Segregation of duties splits authorization, custody, and recordkeeping among different people so that no one person can both commit and conceal an error or fraud. It is a core preventive control in insurance operations such as premium handling and claims payment.

Question 2Subject content for IC-85 (not enumerated in the official source)

An insurer's claims department pays a claim before the policy's waiting period has expired. Which control weakness does this most directly illustrate?

  1. Inadequate verification of coverage conditions before payment Correct answer.
  2. Poor segregation between underwriting and marketing
  3. Failure to reconcile the claims bank account monthly
  4. Excessive reliance on actuarial reserving models

Explanation

Paying before a waiting period ends means the payment was released without confirming that all policy conditions for coverage were satisfied. Effective claims controls require verification of coverage, deductibles, and waiting periods before any disbursement.

Question 3Subject content for IC-85 (not enumerated in the official source)

Which document typically establishes the authority of an insurer's internal audit function and defines its reporting lines?

  1. The agent's appointment agreement
  2. The audit committee charter approved by the board Correct answer.
  3. The reinsurance treaty schedule
  4. The policyholder's certificate of insurance

Explanation

An audit committee charter formally grants the internal audit function its mandate, scope, and independence, including reporting lines to the board or audit committee. Without such a charter, internal audit lacks clearly defined authority.

Question 4Subject content for IC-85 (not enumerated in the official source)

A compliance officer discovers that a producer has been submitting applications with altered applicant signatures. What is the most appropriate immediate control response?

  1. Ignore the issue because the policies were ultimately issued
  2. Wait until the next scheduled regulatory examination to disclose the matter
  3. Adjust the producer's commission rate to reflect the risk
  4. Escalate the finding through the established reporting channel and suspend the affected submissions pending review Correct answer.

Explanation

Altered signatures indicate potential fraud and require prompt escalation and suspension of the affected business so the exposure does not continue. Delaying disclosure or treating it as a compensation matter fails to address the integrity risk.

Question 5Subject content for IC-85 (not enumerated in the official source)

Which of the following best describes the role of a whistleblower hotline within an insurer's governance framework?

  1. It provides a confidential channel for reporting suspected misconduct and supports early detection Correct answer.
  2. It is used primarily to market new insurance products to employees
  3. It replaces the need for an internal audit department
  4. It serves as the final adjudicator of claim disputes

Explanation

A whistleblower hotline gives employees and others a confidential route to report misconduct, which strengthens the control environment through early detection. It complements, rather than substitutes for, other governance functions.

Question 6Subject content for IC-85 (not enumerated in the official source)

An insurer's board wants assurance that risk management is functioning across all business units. Which arrangement best supports independent oversight of enterprise risk?

  1. The marketing director approves all risk reports before they reach the board
  2. The chief executive personally chairs the risk committee and sets all risk limits
  3. A board-level risk committee with members independent of management reviews risk exposures and limits Correct answer.
  4. Risk reporting is delegated entirely to the external actuarial consultant

Explanation

Independent board-level oversight allows risk exposures and limits to be challenged objectively rather than accepted at face value. Independence is compromised when management both sets and reviews its own risk limits.

Question 7Subject content for IC-85 (not enumerated in the official source)

Under a typical insurance regulatory framework, which activity generally requires a license from the supervisory authority?

  1. Soliciting and selling insurance products to the public Correct answer.
  2. Designing office furniture layouts
  3. Drafting an insurer's employee handbook
  4. Preparing internal management accounts

Explanation

Insurance regulation typically requires licensing of those who solicit or sell insurance to protect consumers. Internal administrative activities such as accounting, handbook drafting, and office design are not licensable insurance activities.

Question 8Subject content for IC-85 (not enumerated in the official source)

A regulator requires an insurer to maintain a minimum solvency margin. What is the primary purpose of this requirement?

  1. To cap the amount of premium the insurer may write in a year
  2. To guarantee that policyholders never experience a claim denial
  3. To standardize the commission rates paid to all producers
  4. To ensure the insurer has sufficient capital buffer to absorb adverse experience and meet obligations Correct answer.

Explanation

Solvency margin requirements ensure an insurer holds capital above its liabilities so it can withstand adverse experience and still pay claims. They are a prudential safeguard, not a cap on premium volume or a guarantee against claim denials.

Question 9Subject content for IC-85 (not enumerated in the official source)

Which of the following is the most reliable evidence that an insurer's anti-money-laundering controls are operating effectively?

  1. Suspicious activity reports are filed promptly and customer due diligence records are complete Correct answer.
  2. The AML training budget has increased year over year
  3. The AML policy document is long and detailed
  4. Senior management has verbally endorsed the AML program

Explanation

Effectiveness is demonstrated by outputs and records, such as timely suspicious activity reporting and complete customer due diligence files. Policy length, budget size, and verbal endorsement are inputs or intentions rather than evidence of operation.

Question 10Subject content for IC-85 (not enumerated in the official source)

In a risk-based approach to compliance, how should an insurer allocate monitoring resources?

  1. Only toward the largest customers by premium volume
  2. Toward higher-risk customers, products, and channels where the potential for harm is greatest Correct answer.
  3. Equally across all customers regardless of risk profile
  4. Randomly, to avoid any appearance of bias

Explanation

A risk-based approach directs greater scrutiny to areas with higher likelihood and impact of non-compliance, such as high-risk customers or distribution channels. Equal or random allocation ignores differences in risk and wastes resources.

Question 11Subject content for IC-85 (not enumerated in the official source)

Which statement best captures the relationship between an insurer's risk appetite statement and its operational limits?

  1. Operational limits are set independently and need not reflect the risk appetite statement
  2. The risk appetite statement is a marketing document with no link to limits
  3. Operational limits apply only to the investment function
  4. Operational limits should translate the board-approved risk appetite into measurable thresholds for business units Correct answer.

Explanation

A risk appetite statement expresses how much risk the board is willing to accept, and operational limits convert that intent into measurable thresholds. Without this cascade, the appetite statement remains aspirational and unenforceable.

Question 12Subject content for IC-85 (not enumerated in the official source)

What is the main objective of a regulatory market conduct examination of an insurer?

  1. To audit the insurer's actuarial assumptions for tax purposes
  2. To review the insurer's office lease agreements
  3. To assess whether the insurer's sales, claims, and disclosure practices treat policyholders fairly Correct answer.
  4. To determine the insurer's share price for listing purposes

Explanation

Market conduct examinations focus on how the insurer interacts with customers, including sales practices, claims handling, and disclosure. They are not concerned with share pricing, tax actuarial work, or property leases.

Question 13Subject content for IC-85 (not enumerated in the official source)

An insurer's internal audit finds that reconciliations of premium receivables are performed irregularly. Which risk does this most directly increase?

  1. The risk that employee parking allocations are unfair
  2. The risk that the insurer's brand logo is used incorrectly
  3. The risk that misappropriated or unrecorded premiums go undetected Correct answer.
  4. The risk that actuarial mortality tables become outdated

Explanation

Irregular reconciliation of premium receivables allows discrepancies, including misappropriation or unrecorded collections, to persist undetected. Regular reconciliation is a key detective control over cash and receivable balances.

Question 14Subject content for IC-85 (not enumerated in the official source)

Which element is essential for a compliance function to be considered independent within an insurer?

  1. The compliance officer reports solely to the sales director whose activities are monitored
  2. The compliance function has unfettered access to the board or a board committee and is free from business-line influence Correct answer.
  3. The compliance officer also manages the underwriting department
  4. The compliance budget is controlled by the marketing team

Explanation

Independence requires that compliance can report findings without business-line interference and has direct access to the board or its committee. Reporting to the very function being monitored, or holding operational roles, compromises objectivity.

Question 15Subject content for IC-85 (not enumerated in the official source)

Which of the following is the best example of a detective control in an insurance operation?

  1. Requiring new employees to sign a code of conduct
  2. Requiring dual signatures before releasing a large claim payment
  3. Performing a monthly review comparing claims paid against policy coverage limits Correct answer.
  4. Locking claims files in a secure cabinet

Explanation

Detective controls identify problems after they occur, and a monthly comparison of paid claims against coverage limits is a review that reveals exceptions. Dual signatures, physical locks, and code-of-conduct acknowledgments are preventive in nature.

Question 16Subject content for IC-85 (not enumerated in the official source)

What does the term 'tone at the top' refer to in an insurer's governance?

  1. The musical background used in call-center hold messages
  2. The level of premium charged to the largest corporate clients
  3. The ethical culture and behavior modeled by senior leadership that shapes the control environment Correct answer.
  4. The style of advertising used in the insurer's marketing campaigns

Explanation

Tone at the top describes how senior leaders' values and conduct set the ethical expectations for the whole organization. It is a foundational element of the control environment rather than a marketing or pricing concept.

Question 17Subject content for IC-85 (not enumerated in the official source)

An insurer outsources its claims processing to a third-party administrator. Which control should the insurer prioritize to manage the associated risk?

  1. Assume the administrator's own controls are sufficient without verification
  2. Eliminate the insurer's internal claims oversight function
  3. Transfer all liability for errors to policyholders
  4. Establish contractual audit rights and monitor the administrator's performance and controls Correct answer.

Explanation

Outsourcing does not transfer accountability, so the insurer should retain contractual audit rights and actively monitor the administrator's controls and performance. Blind reliance or removal of oversight leaves the insurer exposed.

Question 18Subject content for IC-85 (not enumerated in the official source)

Which of the following best describes the purpose of a business continuity plan for an insurer?

  1. To increase the insurer's market share during a crisis
  2. To reduce the insurer's tax liability
  3. To enable critical operations such as claims handling to continue or recover promptly after disruption Correct answer.
  4. To replace the need for cybersecurity controls

Explanation

A business continuity plan sets out how critical functions will keep running or be restored quickly after a disruption. It supports resilience and is not a tool for market share, tax reduction, or a substitute for security controls.

Question 19Subject content for IC-85 (not enumerated in the official source)

A compliance monitoring program finds repeated late responses to policyholder complaints. Which action best reflects a corrective-control response?

  1. Removing complaints from the monitoring scope to improve the metrics
  2. Publishing the complaint statistics without changing processes
  3. Recording the finding in the risk register and taking no further action
  4. Root-cause analysis followed by revised procedures, staff training, and follow-up testing Correct answer.

Explanation

A corrective response addresses the cause of a finding through procedural change, training, and retesting to confirm improvement. Merely logging, hiding, or publicizing the issue leaves the underlying problem unresolved.

Question 20Subject content for IC-85 (not enumerated in the official source)

Which of the following is a key principle of fair treatment of customers in insurance distribution?

  1. Producers should recommend the product with the highest commission
  2. Products should be sold based on the customer's needs and circumstances Correct answer.
  3. Complaints should be discouraged to protect the insurer's reputation
  4. Disclosure should be minimized to avoid confusing customers

Explanation

Fair treatment requires that products be matched to the customer's needs and circumstances, supported by clear disclosure and accessible complaint handling. Prioritizing commission, minimizing disclosure, or discouraging complaints undermines this principle.

Question 21Subject content for IC-85 (not enumerated in the official source)

In an insurer's data governance framework, what is the primary purpose of data quality controls?

  1. To eliminate the need for data privacy safeguards
  2. To allow unrestricted sharing of customer data with third parties
  3. To ensure data used for reporting, reserving, and decisions is accurate, complete, and timely Correct answer.
  4. To increase the volume of data collected from customers

Explanation

Data quality controls ensure that information relied on for reporting, reserving, and decisions is accurate, complete, and timely. They support reliability and do not justify collecting more data or bypassing privacy protections.

Question 22Subject content for IC-85 (not enumerated in the official source)

Which scenario most clearly indicates a potential conflict of interest requiring disclosure or management?

  1. An underwriter declines a risk that falls outside the insurer's appetite
  2. A claims adjuster documents a claim decision in the file
  3. An actuary uses approved mortality tables in reserving
  4. A senior underwriter holds a financial interest in a broker that places business with the insurer Correct answer.

Explanation

A personal financial interest in a party that transacts business with the insurer can bias decisions and must be disclosed or managed. Routine underwriting, claims documentation, and actuarial work do not by themselves create conflicts.

Question 23Subject content for IC-85 (not enumerated in the official source)

Which of the following best explains why an insurer should separate the underwriting and claims functions organizationally?

  1. It reduces the risk that the same person manipulates both risk acceptance and claim payment Correct answer.
  2. It guarantees that the insurer will never face a fraudulent claim
  3. It removes the need for any external audit
  4. It allows the insurer to avoid maintaining reserves

Explanation

Separating underwriting from claims reduces the opportunity for one person to accept a risk and then approve a related payment improperly. It mitigates a specific fraud risk but does not eliminate fraud, remove reserving needs, or replace external audit.

Question 24Subject content for IC-85 (not enumerated in the official source)

What is the primary purpose of an insurer conducting an internal control self-assessment?

  1. To replace the external auditor's opinion on financial statements
  2. To have process owners evaluate their own controls and identify gaps for remediation Correct answer.
  3. To determine the salaries of the executive team
  4. To set the insurer's premium rates for the coming year

Explanation

A control self-assessment engages process owners in evaluating the design and operation of their controls and identifying gaps to remediate. It complements external audit and has no role in rate-setting or executive compensation.

Question 25Subject content for IC-85 (not enumerated in the official source)

A regulator introduces a new reporting requirement with a short deadline. Which governance step best ensures the insurer can respond effectively?

  1. Apply the requirement only to new policyholders
  2. Assign clear ownership of the regulatory change and assess its impact on systems and controls Correct answer.
  3. Delegate the requirement entirely to a junior clerk without oversight
  4. Wait until the deadline passes to see whether enforcement occurs

Explanation

Effective regulatory change management assigns ownership and assesses the impact on processes, systems, and controls so the insurer can comply on time. Waiting, delegating without oversight, or applying partial compliance creates regulatory risk.

Question 26Subject content for IC-85 (not enumerated in the official source)

In the IC-85 context, which statement best describes the role of a compliance officer when an insurer enters a new product line?

  1. Delegate all regulatory mapping to the external auditor and wait for the first report
  2. Postpone any compliance review until the first policyholder complaint is received
  3. Confirm that the new line is profitable before considering any compliance requirements
  4. Assess the regulatory obligations attached to the new line and embed them in policies before launch Correct answer.

Explanation

Compliance work is proactive: obligations attached to a new product line must be identified and built into procedures before the business begins. Waiting for auditors or complaints leaves the insurer exposed to breaches from day one. Profitability is a commercial question and does not displace regulatory duties.

Question 27Subject content for IC-85 (not enumerated in the official source)

An insurer's compliance function reports to the head of sales. Which consequence most directly undermines effective compliance?

  1. The compliance budget may be reviewed more frequently
  2. Compliance recommendations can be diluted by commercial pressure from the reporting line Correct answer.
  3. Sales staff may not understand the compliance manual
  4. Compliance staff may need additional training on sales incentives

Explanation

Independence matters because compliance must be able to challenge commercial behavior without fear of its own reporting line. When compliance reports to sales, findings that threaten revenue can be softened or suppressed. Training and budget issues are secondary and do not by themselves destroy independence.

Question 28Subject content for IC-85 (not enumerated in the official source)

Which document typically sets out an insurer's zero-tolerance position on bribery and explains how staff should report suspected payments?

  1. The anti-bribery and corruption policy Correct answer.
  2. The actuarial valuation report
  3. The investment mandate
  4. The reinsurance treaty summary

Explanation

An anti-bribery and corruption policy states prohibited conduct and usually includes reporting channels and consequences. Investment, reinsurance and actuarial documents address financial arrangements rather than staff conduct standards. The policy is the instrument that communicates the tolerance level and escalation route.

Question 29Subject content for IC-85 (not enumerated in the official source)

A customer service team receives a call from someone claiming to be a policyholder and asking for the surrender value and bank details on file. What is the most appropriate first step?

  1. Ask the caller to send an email confirming the request
  2. Provide the surrender value but withhold the bank details
  3. Transfer the caller to the sales team to handle the enquiry
  4. Verify the caller's identity using the insurer's authentication procedures before disclosing anything Correct answer.

Explanation

Personal and financial data should only be released after the caller's identity is verified under the insurer's authentication standard. Partial disclosure of the surrender value is still a data leak. Redirecting to sales or relying on an unverified email does not establish identity.

Question 30Subject content for IC-85 (not enumerated in the official source)

Which of the following is the clearest example of a conflict of interest that an insurer should record in its conflicts register?

  1. A junior analyst attends an industry conference paid for by the insurer
  2. A claims manager owns shares in a repair firm that the insurer uses for motor claims Correct answer.
  3. An underwriter completes mandatory ethics training
  4. A board member reads the insurer's annual report

Explanation

A personal financial interest in a supplier that benefits from the insurer's spending can bias decisions and must be registered and managed. The other situations are routine activities with no private interest that could distort judgment. Recording such interests allows the insurer to apply safeguards such as recusal.

Question 31Subject content for IC-85 (not enumerated in the official source)

What is the primary purpose of an insurer's whistleblowing channel?

  1. To publish staff grievances in the annual report
  2. To collect customer complaints about claim delays
  3. To let employees raise concerns about misconduct confidentially without fear of retaliation Correct answer.
  4. To replace the internal audit function

Explanation

A whistleblowing channel gives staff a protected route to report wrongdoing, supporting early detection of misconduct. It is distinct from customer complaint handling and does not substitute for audit. Confidentiality and protection against retaliation are the features that make it effective.

Question 32Subject content for IC-85 (not enumerated in the official source)

Which activity is most central to a compliance monitoring plan?

  1. Negotiating reinsurance commissions
  2. Testing samples of business activity against regulatory requirements on a scheduled basis Correct answer.
  3. Setting the insurer's underwriting appetite
  4. Approving the insurer's marketing budget

Explanation

Compliance monitoring involves planned, risk-based testing of actual business activity against regulatory requirements. Budget approval, underwriting appetite and reinsurance terms belong to other functions. Monitoring produces evidence on whether controls and rules are being followed.

Question 33Subject content for IC-85 (not enumerated in the official source)

An insurer wants to confirm that its staff understand the code of conduct. Which measure provides the most direct evidence?

  1. Completion records and assessment scores from mandatory code-of-conduct training Correct answer.
  2. The seniority of the person who signed the code
  3. The date the code was last printed
  4. The number of pages in the code of conduct document

Explanation

Training completion and assessment results show whether staff have actually engaged with the code. Document length, printing date and signatory seniority describe the document rather than staff understanding. Direct evidence of comprehension comes from testing and completion data.

Question 34Subject content for IC-85 (not enumerated in the official source)

An insurer is designing controls for an agent who sells policies on its behalf. Which control most directly addresses the risk of mis-selling?

  1. Increasing the agent's commission for higher sales volumes
  2. Allowing the agent to set its own complaint handling process
  3. Reviewing recorded sales conversations against suitability and disclosure requirements Correct answer.
  4. Removing the insurer's name from the agent's marketing materials

Explanation

Reviewing sales conversations tests whether suitability and disclosure obligations were met at the point of sale. Raising commissions can worsen mis-selling incentives, and letting the agent control complaints removes oversight. Removing branding does not address conduct risk and may confuse customers.

Question 35Subject content for IC-85 (not enumerated in the official source)

A new regulation requires insurers to send customers an annual summary of charges. Which sequence best reflects a sound implementation approach?

  1. Apply the rule only to new customers until further notice
  2. Wait for the regulator to inspect before making any changes
  3. Ask the IT team to build a report without defining the requirement
  4. Interpret the requirement, update procedures and templates, train staff, then monitor compliance Correct answer.

Explanation

Sound implementation moves from interpreting the rule through operational changes and training to ongoing monitoring. Waiting for an inspection leaves the insurer non-compliant in the interim. Building reports without a defined requirement or limiting the rule to new customers risks incomplete compliance.

Question 36Subject content for IC-85 (not enumerated in the official source)

Two compliance analysts disagree about whether a proposed promotion breaches advertising rules. What is the most appropriate escalation route?

  1. Refer the question to the compliance head or committee with the relevant rule and analysis documented Correct answer.
  2. Ask the regulator to approve the campaign in advance
  3. Let the marketing team decide because it owns the campaign
  4. Approve the promotion and review it after launch

Explanation

Unresolved interpretation questions should be escalated within compliance with the rule and reasoning recorded so the decision is defensible. Letting marketing decide removes the control, and post-launch review exposes customers to a possible breach. Regulators are not normally asked to pre-approve individual campaigns.

Question 37Subject content for IC-85 (not enumerated in the official source)

An insurer's outsourcing agreement with a cloud provider does not mention regulatory access to data. Why is this a compliance concern?

  1. Cloud providers are exempt from data protection law
  2. Supervisors may need to inspect outsourced records, so the contract must preserve access and information rights Correct answer.
  3. Outsourcing automatically transfers regulatory responsibility to the provider
  4. Regulators only review contracts above a set financial value

Explanation

The insurer remains accountable for outsourced activities, and supervisors need rights to access records and premises. Contracts should therefore secure access, audit and information rights. Outsourcing does not transfer regulatory responsibility, and no exemption or value threshold removes the need for access clauses.

Question 38Subject content for IC-85 (not enumerated in the official source)

A compliance officer notices that a senior manager repeatedly approves exceptions to a premium payment rule without documentation. What is the most appropriate response?

  1. Raise the pattern through the compliance escalation process and require documented justification for exceptions Correct answer.
  2. Ignore the issue because senior managers are accountable for their own decisions
  3. Quietly reverse the exceptions without telling anyone
  4. Report the manager to the media

Explanation

Undocumented exceptions weaken controls and should be escalated through governance so that approvals are justified and recorded. Ignoring the pattern or reversing decisions silently leaves the underlying weakness unaddressed. External disclosure is disproportionate and would breach confidentiality.

Question 39Subject content for IC-85 (not enumerated in the official source)

Which set of records best supports an insurer's ability to demonstrate compliance with a sales conduct rule?

  1. The insurer's share price history
  2. Dated sales scripts, training logs, call recordings and review results Correct answer.
  3. A list of competitor products
  4. The marketing team's annual social calendar

Explanation

Demonstrating compliance requires contemporaneous evidence that the rule was applied in practice, such as approved scripts, training and monitoring results. Social calendars, share prices and competitor lists do not show how the insurer treated customers. Records should be dated and retrievable.

Question 40Subject content for IC-85 (not enumerated in the official source)

An insurer uses a risk-based approach to customer due diligence. Which customer profile would normally justify enhanced measures?

  1. A long-standing customer renewing a motor policy
  2. A politically exposed person structuring large single-premium policies Correct answer.
  3. A salaried employee buying a small term life policy
  4. A student opening a low-value savings plan

Explanation

Enhanced due diligence is triggered by higher-risk features such as political exposure, large premiums and unusual structuring. Small term life, routine renewals and low-value savings plans present lower risk and normally receive standard measures. The risk-based approach concentrates effort where the risk is greatest.

Question 41Subject content for IC-85 (not enumerated in the official source)

What distinguishes a compliance policy from a compliance procedure?

  1. The policy applies to customers, while the procedure applies to shareholders
  2. The policy is optional, while the procedure is legally binding
  3. The policy is written by external counsel, while the procedure is written by the regulator
  4. The policy states the required position, while the procedure describes the steps staff follow to meet it Correct answer.

Explanation

Policies set out the insurer's position and requirements, whereas procedures translate them into operational steps. Authorship and audience do not define the distinction, and both documents are binding internally. This split lets management set standards while operations define how they are met.

Question 42Subject content for IC-85 (not enumerated in the official source)

A regulator asks an insurer to explain how it ensures fair treatment of vulnerable customers. Which response best demonstrates a mature approach?

  1. Describing identified vulnerability indicators, tailored processes, staff training and outcome monitoring Correct answer.
  2. Confirming that vulnerable customers are handled by the complaints team only
  3. Stating that all customers are treated equally and no special steps are needed
  4. Noting that vulnerability is assessed solely from the customer's age

Explanation

A mature approach identifies vulnerability through multiple indicators, adapts processes, trains staff and monitors outcomes. Treating everyone identically can disadvantage vulnerable customers, and confining the issue to complaints is too narrow. Age alone is an incomplete indicator of vulnerability.

Question 43Subject content for IC-85 (not enumerated in the official source)

Why should an insurer's compliance function have direct access to the board or a board committee?

  1. So compliance can vote on board resolutions
  2. So significant compliance issues can be reported without being filtered by executive management Correct answer.
  3. So the board can delegate its legal duties to compliance
  4. So compliance can set the insurer's commercial strategy

Explanation

Direct board access ensures that material compliance matters reach decision-makers unfiltered. Compliance does not vote on resolutions, take over the board's duties or set commercial strategy. The arrangement preserves the flow of assurance information to those who govern the insurer.

Question 44Subject content for IC-85 (not enumerated in the official source)

An insurer discovers that a third-party administrator has been sharing policyholder data with an unapproved marketing firm. Which action should the insurer take first?

  1. Publicly announce the issue before investigating
  2. Terminate all customer policies administered by the provider
  3. Stop the unauthorized sharing and assess the scope and legal notification obligations Correct answer.
  4. Wait for the provider to resolve the matter independently

Explanation

The immediate priority is to stop the unauthorized data flow and establish its scope so that any legal notification duties can be met. Cancelling policies harms customers, and premature public statements may be inaccurate. Leaving resolution to the provider ignores the insurer's own accountability.

Question 45Subject content for IC-85 (not enumerated in the official source)

Which indicator most reliably signals a weak compliance culture within a business unit?

  1. Staff routinely bypass required approvals and face no consequences Correct answer.
  2. Staff complete mandatory training on time
  3. Managers discuss compliance at team meetings
  4. Issues raised by staff are logged and resolved

Explanation

A culture is weak when required controls are routinely bypassed without consequence, because this shows conduct standards are not enforced. Timely training, discussion of compliance and logged issues are positive signals. Culture is revealed by what is tolerated in practice.

Question 46Subject content for IC-85 (not enumerated in the official source)

An insurer's compliance risk assessment ranks a business line as high risk. How should this ranking affect the monitoring plan?

  1. The line should be monitored less often to save resources
  2. The ranking should have no effect on monitoring frequency
  3. The line should receive more frequent and deeper monitoring than lower-risk lines Correct answer.
  4. The line should be excluded from monitoring until a breach occurs

Explanation

A risk-based monitoring plan directs greater frequency and depth of testing to higher-risk areas. Reducing monitoring, ignoring the ranking or excluding the line until a breach occurs inverts the logic of risk-based allocation. Resources follow the assessed level of risk.

Question 47Subject content for IC-85 (not enumerated in the official source)

An insurer operates in several jurisdictions with differing data retention rules. What is the most defensible compliance approach?

  1. Let each local office choose its own retention period without coordination
  2. Apply the rule of the head office jurisdiction everywhere
  3. Map each jurisdiction's requirements and apply controls that satisfy the strictest applicable obligation for shared systems Correct answer.
  4. Retain all data indefinitely to avoid deleting something required

Explanation

A defensible approach identifies the requirements in each jurisdiction and designs controls that meet the strictest obligation where systems are shared. Applying only head office rules can breach local law, and indefinite retention conflicts with deletion duties. Uncoordinated local choices create gaps and inconsistencies.

Question 48Subject content for IC-85 (not enumerated in the official source)

A compliance review finds that a control is well documented but staff cannot explain how it works. What conclusion is most appropriate?

  1. The control is effective if the auditor signed the document
  2. The control is effective because documentation exists
  3. The control may be operating as a paper exercise, so its design and effectiveness need testing Correct answer.
  4. The control should be removed because staff are unfamiliar with it

Explanation

Documentation alone does not prove a control works; if staff cannot explain it, the control may exist only on paper. Effectiveness requires evidence that it operates as designed. Removing the control or relying on a signature avoids the real question of whether it functions.

Question 49Subject content for IC-85 (not enumerated in the official source)

An insurer wants to use aggregated complaint data to improve conduct risk management. Which approach best turns the data into actionable compliance insight?

  1. Rank complaints by the seniority of the complainant
  2. Segment complaints by product, root cause and outcome, then track trends against conduct risk indicators Correct answer.
  3. Archive complaints without analysis once they are closed
  4. Count total complaints only and report the number to the board

Explanation

Actionable insight comes from segmenting complaints by product, root cause and outcome and linking trends to conduct risk indicators. A single total hides where problems arise, and ranking by complainant seniority is irrelevant to conduct risk. Archiving without analysis discards the learning.

Question 50Subject content for IC-85 (not enumerated in the official source)

A regulator signals a thematic review of add-on products. How should the insurer's compliance function prepare most effectively?

  1. Destroy records that may be requested to limit exposure
  2. Instruct staff not to speak to reviewers without legal approval
  3. Wait for the regulator's formal information request before taking any action
  4. Self-assess the add-on product lifecycle against likely review themes and remediate gaps before the review Correct answer.

Explanation

Proactive self-assessment against the expected review themes allows gaps to be identified and remediated early. Destroying records is unlawful and obstructs the review, and blanket instructions to staff impede cooperation. Waiting passively forfeits the chance to correct issues.