Skip to content

ACCA Strategic Professional · Strategic Business Leader · Audit and compliance

Kestrel Bank must comply with a data protection law that requires notification of regulators within a fixed period after a personal data breach. The board is deciding between waiting to see if the breach is material, or notifying immediately on a precautionary basis. What does the legal compliance requirement imply for the board's decision?

The board must follow the statutory notification duty, because legal obligations are mandatory and cannot be set aside through the company's own judgment of materiality or reputation. Voluntary codes do not override law, and the decision is a management and board responsibility, not the external auditor's.

  1. AThe board must follow the statutory notification duty, since legal obligations are mandatory and not subject to materiality judgments by the companyCorrect
  2. BThe board may choose the timing that minimises reputational damage, as laws are guidance
  3. CThe board should rely on the voluntary governance code, which takes precedence over the law
  4. DThe decision belongs only to the external auditor

Explanation

Laws and regulations create mandatory obligations; the board cannot override them using its own view of materiality or reputational concerns. Codes are subordinate to law. The external auditor reports on, but does not make, such compliance decisions.

Did you get it right without looking?

One question tells you little. A timed set on Audit and compliance shows your real accuracy, how long you take and where you lose marks.

Practise Audit and complianceFree diagnostic mock

More Audit and compliance questions