CBA Cheat Sheet 2026

The 30 highest-yield CBA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does the term 'wrong-way risk' refer to in the context of counterparty credit risk? → Risk that collateral value falls when counterparty creditworthiness deteriorates
2. Under the Dodd-Frank Act, systemically important financial institutions (SIFIs) are subject to enhanced prudential standards primarily to: → Reduce the risk that their failure could destabilize the broader financial system
3. An IT auditor is reviewing a bank's data encryption practices. Which finding would be MOST critical to report? → Customer PII is transmitted over internal networks without encryption
4. A politically exposed person (PEP) is subject to enhanced due diligence because they: → Pose higher AML risk due to potential for corruption and abuse of public positions
5. When must a financial institution file a SAR after initially identifying suspicious activity? → Within 30 calendar days, or 60 days if no suspect is identified
6. Which regulatory body published the 'Principles for Enhancing Corporate Governance' that are widely used as a global benchmark for banks? → Basel Committee on Banking Supervision (BCBS)
7. Which audit procedure is most effective for detecting unrecorded deposit liabilities at a bank? → Reviewing interest expense recorded for reasonableness relative to average deposits
8. Under the Basel Committee's corporate governance principles, the board of directors is responsible for: → Setting the bank's risk appetite and overseeing senior management
9. When a bank auditor identifies that loan loss reserves are systematically below expected loss estimates, this MOST directly indicates a problem with: → Allowance for Credit Loss (ACL) adequacy
10. Under the Community Reinvestment Act (CRA), federal regulators evaluate a bank's record of meeting credit needs in its: → Assessment area, typically its local communities
11. When auditing a bank's data governance framework, which of the following is the MOST critical principle for an auditor to verify? → The establishment of clear ownership and accountability for critical data elements.
12. When auditing overdraft protection programs, the auditor should PRIMARILY evaluate whether the program complies with: → Regulation E opt-in requirements for ATM and one-time debit transactions
13. A bank's return on assets (ROA) is 0.85% while its return on equity (ROE) is 12.5%. The difference is primarily driven by: → Financial leverage (equity multiplier)
14. Which risk category encompasses losses resulting from inadequate internal processes, people, systems, or external events? → Operational risk
15. Under the Bank Secrecy Act, which of the following scenarios requires a bank to file a Suspicious Activity Report (SAR)? → A series of transactions totaling $15,000 that appear structured to evade CTR reporting
16. An auditor is assessing the completeness assertion for off-balance-sheet exposures at a bank. Which procedure is most relevant? → Reviewing unfunded commitment records and comparing to loan origination documentation
17. When a bank sells mortgages and retains the servicing rights, the retained servicing rights create exposure to which specific risk? → Prepayment risk
18. Which regulatory guidance specifically addresses the audit committee's oversight responsibilities for internal controls at U.S. banks? → OCC Handbook on Corporate and Risk Governance
19. A bank's fraud risk assessment identifies wire transfer origination as high-risk. Which control is most effective at mitigating this risk? → Requiring dual authorization and call-back verification for large wire transfers
20. In auditing a bank's consolidated financial statements, which variable interest entity (VIE) scenario requires consolidation by the bank? → The bank is the primary beneficiary that absorbs the majority of a VIE's expected losses
21. Under the FinCEN CDD Rule, a bank must identify and verify beneficial owners of a legal entity customer who own what minimum percentage of equity interests? → 25%
22. A bank's internal audit charter should PRIMARILY document which of the following? → The purpose, authority, responsibility, and independence of internal audit
23. Under U.S. banking regulations, the Federal Reserve's Regulation YY requires large bank holding companies to maintain which governance structure? → A Risk Committee of the board composed of independent members
24. Which control is MOST effective at detecting kiting schemes in a bank's demand deposit operations? → Float analysis and interbank account reconciliation
25. Which approach under Basel III for credit risk uses external credit ratings to assign risk weights to exposures? → Standardized Approach (SA)
26. What is a red flag during an audit of teller operations? → Frequent cash discrepancies
27. What is the role of stress testing in risk management? → To evaluate resilience under adverse scenarios
28. A bank auditor performing a credit review should focus on the 'five Cs of credit.' Which of the following is NOT one of the five Cs? → Compliance
29. An IT auditor is evaluating a bank's controls over API security for open banking integrations. Which control is MOST important to verify? → OAuth 2.0 implementation with proper token scoping and expiration controls
30. In the context of model risk management (SR 11-7), what is the primary purpose of model validation? → To independently verify that models are conceptually sound and performing as intended