Examiner Question Bank

Question 1

What is the Examiner Question Bank?

Accepted Answer

A searchable library of the questions examiners and auditors ask regulated institutions, each with a plain answer, the artifact that proves it, and the finding most often written up.

Question 2

Where do these questions come from?

Accepted Answer

They are written from published examination and audit expectations, including FFIEC, NCUA, HIPAA, NIST, and NAIC guidance, and phrased the way a real examiner phrases them.

Question 3

How do I use it?

Accepted Answer

Filter to your sector and topic, mark the questions you cannot yet evidence, and print your prep list. Many leaders take six to eight of them into a board or risk-committee agenda.

Question 4

Is my prep list saved anywhere?

Accepted Answer

It is stored in your own browser, so it is there when you come back. Nothing is sent to ImageQuest unless you choose to share it.

Question 5

Does using the bank commit me to anything?

Accepted Answer

No. It is free to search, expand, and print. The confidential conversation that follows is optional.

Question 6

Who is your designated information security officer, and to whom do they report?

Accepted Answer

One named individual holds the seat, is independent of day to day IT operations, and reports to the board or a board committee on a defined cadence. Sharing the role across a committee, or leaving it with the person who also administers the systems, is not a defensible answer. Evidence that proves it: Board minutes recording the appointment, a current position description, and the reporting calendar with dated packets delivered.

Question 7

How often does the board receive an information security report, and what is in it?

Accepted Answer

At least annually in full, and more often in summary. The report covers program status, risk assessment results, testing outcomes, incidents, third party risk, and the remediation still open with owners and dates. Evidence that proves it: Dated board packets and minutes showing the report was received and discussed.

Question 8

When was your information security risk assessment last updated, and what changed?

Accepted Answer

Within the last twelve months, and again after any material change: a new core system, a new location, a significant vendor, or a new AI tool. The assessment must show inherent risk, controls applied, and residual risk by asset or process. Evidence that proves it: The dated assessment, the change log, and the approval record.

Question 9

Who approves your information security policy, and when was it last approved?

Accepted Answer

The board or its designated committee approves the policy at least annually. Management approval alone does not satisfy the expectation at most institutions. Evidence that proves it: The approved policy with a version and date, plus the minutes recording approval.

Question 10

How does management decide what to fund in security, and what was deferred?

Accepted Answer

Funding decisions trace back to the risk assessment. An examiner is comfortable with deferral when the deferral is documented, risk accepted by a named person, and revisited. Evidence that proves it: Budget request tied to risk items, and a risk acceptance record with a name and date.

Question 11

What security training does staff receive, and how do you know it worked?

Accepted Answer

Annual training for all staff, role specific training for higher risk roles, and periodic phishing simulation. The proof is not attendance, it is completion rates and the trend in simulation failure rates over time. Evidence that proves it: Completion reports by employee, simulation results by campaign, and the follow up for repeat failures.

Question 12

Is the board able to ask informed questions about technology and security risk?

Accepted Answer

Directors receive periodic education so oversight is real rather than ceremonial. Examiners increasingly probe whether the board understands what it approved. Evidence that proves it: Director training records and agendas showing technology topics presented at board level.

Question 13

Who performs your IT audit, and how is independence maintained?

Accepted Answer

IT audit is performed by a party independent of the function being audited, with findings reported to the audit committee and tracked to closure. Evidence that proves it: Engagement letter, audit report, and the tracked remediation log with closure dates.

Question 14

Which vendors are critical to your operations, and how did you decide that?

Accepted Answer

A maintained inventory classifies vendors by the impact of their failure, the data they touch, and whether they can access your network. Criticality drives the depth of diligence and the monitoring cadence. Evidence that proves it: The vendor inventory with criticality ratings and the documented rating criteria.

Question 15

Do you obtain and review SOC 2 reports for critical vendors, and who reads them?

Accepted Answer

The report is obtained annually, read by someone competent to read it, and the review documents the exceptions noted, the complementary user entity controls you must perform, and the bridge letter covering the gap period. Evidence that proves it: The report, a written review memo, and evidence you perform the user entity controls listed.

Question 16

Do your critical vendor contracts address security, breach notice, and audit rights?

Accepted Answer

Contracts specify security obligations, breach notification timeframes, subcontractor terms, data return or destruction at exit, and your right to review audit reports. Evidence that proves it: Executed contracts with the relevant clauses identified in the vendor file.

Question 17

Do you know who your critical vendors depend on?

Accepted Answer

Concentration and subcontractor risk are assessed for critical vendors, including where data is hosted and which cloud providers are involved. Evidence that proves it: Vendor questionnaires or SOC reports identifying subservice organizations, and your analysis of the concentration.

Question 18

What happens to your data when a vendor relationship ends?

Accepted Answer

A defined exit process confirms data return or certified destruction, terminates all vendor access, and records the confirmation. Evidence that proves it: Termination checklist, destruction certificate, and access removal record.

Question 19

Do you have a current business associate agreement with every entity touching PHI?

Accepted Answer

Every business associate has an executed agreement in place before any protected health information is disclosed, and the inventory of those agreements is current. Evidence that proves it: Executed agreements matched line by line against the vendor inventory.

Question 20

How do you flow security requirements down to your own suppliers?

Accepted Answer

Contract clauses pass required safeguards to suppliers who handle controlled or sensitive information, and compliance is verified rather than assumed. Evidence that proves it: Flow down clauses in supplier agreements and supplier attestations on file.

Question 21

Do you use AI today, and do you plan to adopt it in the next 24 months?

Accepted Answer

The answer is a documented yes or no for both today and the planning horizon, approved by management. Planned use is examined too, so an institution with no AI today still needs a stated position and a governance path before the first tool arrives. Evidence that proves it: Strategic plan or technology roadmap entry for AI, and the minutes where it was discussed.

Question 22

What AI tools are in use, which departments use each one, and who approved them?

Accepted Answer

A maintained inventory lists every AI tool, its business purpose, the departments using it, the data it can reach, the approver, and the review date. This includes tools embedded in software you already own. Evidence that proves it: The AI inventory with departments and approval records, and the discovery method you use to catch unapproved use.

Question 23

Does any proprietary or customer information enter your AI tools, and are those tools private or public?

Accepted Answer

For each tool you can state what data enters it and whether it is an enterprise deployment under your control or a public service. Customer, member, patient, or confidential data belongs only in private tools approved for that data class. Evidence that proves it: The inventory column for data classes and deployment type, tied to the data classification policy.

Question 24

What controls keep information confidential once it is given to an AI tool?

Accepted Answer

Access is limited to approved users, retention and sharing settings are configured and documented, activity is logged, and data loss controls cover the tool. The controls are tested, not just described. Evidence that proves it: Configuration records, the user access list, and a sample of log or data loss review output.

Question 25

Is there a board approved AI policy, and has every employee reviewed it?

Accepted Answer

The policy defines permitted and prohibited uses, the data classes that may never be entered into a general purpose tool, human review requirements for decisions affecting people, and the approval path for new tools. Every employee acknowledges it, and new hires do so at onboarding. Evidence that proves it: The approved policy, the board minutes, and complete staff acknowledgement records.

Question 26

Which managers and employees are responsible for day to day oversight of AI?

Accepted Answer

Named individuals own AI oversight, with defined duties for approving tools, monitoring use, and escalating issues. Ownership is written down, not implied by job title. Evidence that proves it: The policy or charter naming the owners, and job descriptions or delegations reflecting the role.

Question 27

Which committee oversees AI, and do its minutes accurately reflect AI discussions?

Accepted Answer

A named committee has AI oversight in its charter, AI is a standing agenda item, and the minutes record what was reviewed, what was decided, and who will act. Examiners read the minutes, so a conversation that was not recorded did not happen. Evidence that proves it: The committee charter and a run of minutes showing substantive AI discussion and decisions.

Question 28

Is the board routinely informed of AI activity?

Accepted Answer

The board receives regular reporting on the AI inventory, new approvals, risk assessments, issues, and planned initiatives, on a set schedule rather than only when something goes wrong. Evidence that proves it: Board packets and minutes showing recurring AI reporting.

Question 29

Has every AI tool been risk assessed?

Accepted Answer

Each tool on the inventory has a documented risk assessment covering data exposure, accuracy, vendor dependence, and regulatory impact, completed before deployment and refreshed on a schedule. Evidence that proves it: A completed risk assessment for every tool on the inventory, with dates and approvers.

Question 30

For AI vendors, does a contract state how your data is used, and whether it trains their model?

Accepted Answer

The contract states plainly whether inputs are retained, used for training, or shared, and the diligence file records that determination for each tool. Evidence that proves it: Contract terms or the vendor's data processing addendum, cited in the vendor file.

Question 31

Which technology service providers help you deliver AI, and are they in your vendor program?

Accepted Answer

Every provider that implements, hosts, or supports AI for you is named, has completed due diligence, and is monitored under the third party risk program like any other critical vendor. Evidence that proves it: The vendor inventory entries and due diligence files for each AI provider.

Question 32

Have you experienced any issues with your use of AI to date?

Accepted Answer

Issues such as inaccurate output, data entered where it should not be, or vendor incidents are logged, investigated, and reported to the committee. An honest log is more defensible than an answer of none. Evidence that proves it: The AI issue log, with root cause and remediation for each entry.

Question 33

How do you know staff are not using unapproved AI tools with institutional data?

Accepted Answer

Technical controls detect or restrict access to consumer AI services, and the monitoring output is reviewed. Policy alone is not a control an examiner can test. Evidence that proves it: Filtering or monitoring configuration, plus a sample of the review output.

Question 34

Where AI touches a decision about a person, who reviews the output before it is used?

Accepted Answer

A named human reviews and owns any output that influences credit, coverage, care, employment, or member and customer treatment. The review is recorded, not assumed. Evidence that proves it: Procedure documenting the review step and a sample of reviewed outputs with reviewer names.

Question 35

Is your AI use treated as a model under your model risk framework?

Accepted Answer

Where AI informs a quantitative or judgmental decision, it is inventoried as a model with documented purpose, limitations, validation, and ongoing performance monitoring. Evidence that proves it: Model inventory entry, validation documentation, and monitoring results.

Question 36

How do you test that AI assisted decisions do not produce disparate outcomes?

Accepted Answer

Outcomes are tested periodically for unexplained disparity, results are documented, and the testing method is defensible to a compliance examiner as well as an IT examiner. Evidence that proves it: Testing methodology, results by period, and the remediation taken on any finding.

Question 37

Can protected health information enter any AI tool you have deployed?

Accepted Answer

Tools that may touch PHI are covered by a business associate agreement, configured to prevent retention where required, and restricted to approved users. Evidence that proves it: Agreement, configuration record, and the user access list for the tool.

Question 38

Where is multifactor authentication enforced, and where is it not?

Accepted Answer

Enforced on email, remote access, administrative accounts, and every externally reachable system. The honest answer names the exceptions and the compensating controls behind them. Evidence that proves it: Configuration export showing enforcement scope and a documented exception list with expiry dates.

Question 39

How many people hold administrative privileges, and why does each one need it?

Accepted Answer

Administrative access is limited, separate from daily use accounts, individually attributable, and reviewed on a defined cadence. Shared administrator credentials are a finding in nearly every framework. Evidence that proves it: Current privileged account list with business justification and the last review record.

Question 40

When did you last review who has access to your core systems, and what did you remove?

Accepted Answer

Reviews run at least annually, more often for critical systems, and are certified by the business owner rather than by IT. A review that removes nothing invites scrutiny. Evidence that proves it: Signed review certifications with the removals actually processed.

Question 41

How quickly is access removed when someone leaves, and how do you prove it?

Accepted Answer

Same day for voluntary departures, immediate for involuntary, across every system including vendor portals and remote tools. The proof is a timestamp, not a policy. Evidence that proves it: Termination checklist with system by system timestamps for a sample of recent departures.

Question 42

How do vendors access your environment, and is that access supervised?

Accepted Answer

Vendor access is time limited, individually credentialed, logged, and enabled only when needed rather than standing open. Evidence that proves it: Access request records, session logs, and the configuration showing access is not permanent.

Question 43

Can one person originate and approve a transaction or a system change?

Accepted Answer

Duties are separated in the system configuration, not just in procedure, and any unavoidable overlap has a documented compensating review. Evidence that proves it: System configuration showing enforced dual control and the compensating review records.

Question 44

Are your backups immutable or otherwise protected from an administrator with credentials?

Accepted Answer

At least one copy is immutable or logically separated so that a compromised administrative account cannot delete or encrypt it. Ransomware operators target backups first. Evidence that proves it: Backup platform configuration showing retention locks or separated credentials.

Question 45

When did you last restore from backup, and what did you learn?

Accepted Answer

A real restoration test within the last twelve months, covering a meaningful system rather than a single file, with the elapsed time recorded and the gaps fixed. Evidence that proves it: Test record with date, scope, elapsed time, issues found, and remediation.

Question 46

What are your recovery time and recovery point objectives, and can you meet them?

Accepted Answer

Objectives are set by the business through impact analysis, not by IT, and tested results are compared against them honestly. Evidence that proves it: Business impact analysis with stated objectives, and test results measured against them.

Question 47

When was your business continuity plan last exercised, and who took part?

Accepted Answer

An annual exercise involving business leadership rather than only IT, with a written after action report and tracked corrective actions. Evidence that proves it: Exercise scenario, participant list, after action report, and the corrective action log.

Question 48

If ransomware encrypted your environment tonight, what is the first hour?

Accepted Answer

A named decision maker, a documented isolation procedure, out of band communications, counsel and insurer contacts, and a recovery sequence prioritized by business function. Evidence that proves it: The playbook, the contact list held offline, and the exercise record showing it was walked through.

Question 49

Have you participated in your core processor's recovery testing?

Accepted Answer

Your institution participates in or reviews the results of the provider's testing, and understands your own responsibilities in their recovery plan. Evidence that proves it: Participation record or the provider's test report with your documented review.

Question 50

Do you have a written incident response plan, and when was it last exercised?

Accepted Answer

A current plan with defined roles, severity levels, escalation paths, notification obligations, and evidence preservation steps, exercised at least annually. Evidence that proves it: The plan with a version date and the exercise record with participants and lessons learned.

Question 51

Who must you notify after an incident, and within what window?

Accepted Answer

Regulatory notification timeframes are written into the plan with the specific contacts and thresholds, so the clock is understood before an event rather than researched during one. Evidence that proves it: The notification matrix in the plan naming each authority, threshold, and deadline.

Question 52

Show me your incident log for the past year.

Accepted Answer

A log exists and contains entries. An empty log usually indicates that events are not being recognized and recorded, not that nothing happened. Evidence that proves it: The log with dates, classification, response actions, and closure.

Question 53

What security logs do you collect, how long are they kept, and who reviews them?

Accepted Answer

Logs from identity, endpoints, network edge, and critical applications are centralized, retained long enough to investigate a discovery months later, and reviewed by someone accountable. Evidence that proves it: Log source inventory, retention configuration, and review records or alerting workflow.

Question 54

Who responds at two in the morning on a holiday weekend?

Accepted Answer

A named, staffed, and contractually committed response capability with a defined response time, not a best efforts arrangement with a single individual. Evidence that proves it: The coverage schedule, the contracted response commitment, and after hours response records.

Question 55

Do your incident procedures match what your cyber insurance policy requires?

Accepted Answer

The policy's notification window, approved vendor panel, and control warranties are reflected in the plan, so a response does not void coverage. Evidence that proves it: The policy alongside the plan, with the required steps cross referenced.

Question 56

What is your patching standard, and what percentage of systems meet it?

Accepted Answer

Defined timeframes by severity, applied to servers, workstations, network devices, and third party applications, with a measured compliance rate rather than an assumption. Evidence that proves it: The standard, and a current report showing compliance percentage by system class.

Question 57

How often do you scan for vulnerabilities, and who remediates the findings?

Accepted Answer

Regular internal and external scanning with named remediation owners, target dates by severity, and evidence that findings actually close. Evidence that proves it: Scan reports across several periods showing the same findings closing rather than recurring.

Question 58

When was your last independent penetration test, and what did you fix?

Accepted Answer

An annual test by a party independent of the people who built and run the environment, with a tracked remediation plan and retest of the significant findings. Evidence that proves it: The report, the remediation tracker with closure dates, and the retest confirmation.

Question 59

What systems in your environment no longer receive security updates?

Accepted Answer

Unsupported systems are inventoried, risk accepted by a named person with an end date, and isolated with compensating controls until replaced. Evidence that proves it: End of life inventory, the risk acceptance record, and the replacement plan with dates.

Question 60

How are changes to production systems approved and documented?

Accepted Answer

Changes are requested, reviewed for risk, approved, tested where practical, and recorded with a backout plan. Emergency changes follow an abbreviated path with retrospective approval. Evidence that proves it: Change records for a sample period, including at least one emergency change with its retrospective approval.

Question 61

What is your secure configuration baseline, and how do you detect drift?

Accepted Answer

Documented baselines for servers, workstations, and network devices, with periodic comparison against the running configuration and remediation of the differences. Evidence that proves it: The baseline documents and drift reports over consecutive periods.

Question 62

How long would it take you to produce evidence for the request list we just sent?

Accepted Answer

Days, from a maintained evidence library organized by control, not weeks of assembly across vendors and inboxes. Assembly time is the clearest signal of whether controls are continuously monitored. Evidence that proves it: The evidence library itself, organized by control with current artifacts and dates.

Question 63

For each control in your program, who owns it and how is it tested?

Accepted Answer

A control matrix maps each control to a named owner, the testing method, the frequency, and the last result. Ownership at department level is not ownership. Evidence that proves it: The control matrix with owner names and last test dates.

Question 64

What happened to the findings from your last examination or audit?

Accepted Answer

Every prior finding is tracked to closure with evidence of the corrective action. Repeat findings are treated far more seriously than first time findings. Evidence that proves it: The finding tracker with corrective action, evidence, closure date, and validation.

The Examiner Question Bank

AI Use and Oversight

Knowing the question is the easy part. Holding the evidence is the work.

Straight answers about the bank.