A company wants its compliance function to support organizational trust. Which actions are consistent with the course material?

### Why this is right - **A** is true: risk analysis informs the selection of risk-based controls. - **B** is true: monitoring and quick response are explicit program steps. - **C** is true: the course frames compliance as part of an organization's duties to its community and stakeholders. - **E** is true: the material identifies consistency and fewer unforced errors as benefits. ### The concept Trust depends partly on whether an organization can show that it takes its obligations seriously. Risk analysis helps the organization focus on relevant issues. Controls put risk responses into practice, and monitoring checks whether the arrangements are followed. Policies communicate expectations, but they do not by themselves prove that employees follow them. Compliance therefore requires both documented direction and continuing attention to how work is performed. ### The other options - **D. Assume that a written policy alone proves that people follow it.**: a policy states an expectation; monitoring is needed to check whether it is followed. ### Terms - **Risk-based controls**: safeguards chosen in response to assessed risks. - **Stakeholder**: a person or group with an interest in, or affected by, the organization. ### Remember Written requirements need controls and monitoring before they provide evidence of compliance.