CAIIB · Advanced Bank Management · Module D — Compliance in Banks and Corporate Governance
CAIIB ABM Unit 29 — Framework for Identification of Compliance Issues and Compliance Risks: Free MCQs with Explanations
By Swarnakshi Jha (ex-banker) · Updated 29 October 2026 · Paper I of the December 2026 cycle (Sunday 6 December 2026)
This is the free practice page for CAIIB ABM Unit 29 — Framework for Identification of Compliance Issues and Compliance Risks (Module D — Compliance in Banks and Corporate Governance). The CAIIB Mock Centre holds 117 questions on this unit alone, every one with a why-right / why-wrong explanation; below are the facts examiners keep returning to, five practice questions with explanations, and the traps that cost marks.
ABM · Module D117 MCQs in the Mock Centre5 free belowPaper on 6 December
Key facts examiners test from this unit
Compliance issues and today's compliance challenges — fintech and fast change make compliance harder; banks must manage geopolitics, divergent rules, data, resilience, credit cycles, crime, trust and ethics.
Compliance risk and its management — compliance risk is the risk of sanctions, loss or reputational damage from non-compliance, managed by an independent, risk-based function that can prove due diligence.
Inherent, control and residual risk; compliance risk assessment — inherent risk is risk before controls, residual risk what remains after them; the compliance risk score from 1 to 10 drives the yearly action plan.
Changed since the textbook
Data protection law brought into force in phases (13 November 2025). The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, bringing the Digital Personal Data Protection Act, 2023 into force in phases: the provisions setting up the Data Protection Board took effect at once; registration of consent managers follows after 12 months; and the main obligations on data fiduciaries, including notice and consent, security safeguards and personal data breach notification, apply after 18 months, from May 2027. Source: AZB & Partners
RBI's guidance note on operational risk management and operational resilience (30 April 2024). RBI's Guidance Note on Operational Risk Management and Operational Resilience (RBI/2024-25/31) replaced its 2005 guidance note on operational risk for banks, co-operative banks, all-India financial institutions and NBFCs. Source: RBI
5 free practice questions — tap an option
Five practice questions from this unit. Answers lock on the first tap, exactly as in the exam, and an explanation opens underneath. The Mock Centre has all 117 questions on this unit, from easy to tough, with caselets and key-in numericals, why every other option is wrong and the exam tip — and tracks your score and revision dates.
Question 1 of 5
Which of these is a task of the compliance function rather than of internal audit?
Why (a): The compliance function works pro-actively: it identifies, documents and assesses compliance risks, including those of new products, practices and customer relationships, and then advises and monitors. Independent after-the-event testing of controls, rating of branches and reporting audit findings to the Audit Committee are internal audit's work. (b) is wrong: After-the-event testing of controls is internal audit's work. (c) is wrong: Rating branches is part of risk-based internal audit. (d) is wrong: Audit findings reach the ACB through internal audit.
Question 2 of 5
Within how many days of the quarter's close must branches send their compliance certificate to the RO or ZO?
Why (b): Branches certify compliance quarterly, as on the last working day of the quarter, within 5 days of its close. (a) is wrong: 10 days is for the RO/ZO and functional departments. (c) is wrong: The limit is 5 days. (d) is wrong: The limit is 5 days.
Question 3 of 5
A bank estimates a 50% chance of an attack attempt on its new internet-banking platform in a year and a 40% chance that, without controls, the platform is vulnerable to it. With controls, attacks would succeed a quarter of the time. Using the textbook's formulas, what is the residual risk?
Why (d): Inherent risk = threats × vulnerability = 0.5 × 0.4 = 0.20, the risk before any controls. Residual risk = inherent risk × control risk = 0.20 × 0.25 = 0.05, or 5%: the probability of loss that remains once controls work. 20% is the inherent risk, the figure before controls. (a) is wrong: 20% is the inherent risk, before controls. (b) is wrong: 10% multiplies vulnerability by control risk and leaves out the threat. (c) is wrong: 12.5% multiplies the threat by control risk and leaves out vulnerability.
Question 4 of 5
To whom are breaches reported, in the structured format, under the reporting framework?
Why (c): Breaches are reported in the policy's structured format to the central compliance department, with copies to the FGMO and the functional department. (a) is wrong: Breaches are not exchange disclosures. (b) is wrong: Reporting is internal. (d) is wrong: The central compliance department must know.
Question 5 of 5
Within what period after sanction are fresh and renewal proposals covered by loan review?
Why (a): Loan review covers all fresh proposals and renewals within 3–6 months from the date of sanction. (b) is wrong: The period is 3–6 months. (c) is wrong: The period is 3–6 months. (d) is wrong: Review comes early, not at maturity.
0 of 5 answered.
Traps in this unit
Compliance covers internal rules and ethics too.
Reputational risk is not part of operational risk.
Compliance and internal audit are separate in Indian banks.
Practise all 117 questions on Unit 29. The free CAIIB demo opens Units 1–2 of every paper with full explanations; the ABM Online Mock Centre unlocks all 4,600+ ABM questions, the full-length papers with caselets and key-ins, module mocks and Smart Revision for 18 months (₹1,499).
Independent study aid — not affiliated with, endorsed by, or sponsored by the Indian Institute of Banking & Finance (IIBF). Exam pattern, dates, fees and passing criteria are set by IIBF — always confirm the current rules at iibf.org.in. CAIIB content follows rules and developments up to IIBF's cut-off of 30 June 2026 (where a rule changed later, the update box says so); verify from official sources before relying on them in practice.