1) Which of the following is true of outsourcing?

a. It needs to be avoided by policy when the processes deal with sensitive information

b. Policies related to delegation of authority are needed to manage risk and maintain control

c. Purchase restrictions and PCI DSS compliance are key areas for audits and controls

d. Performance measurement and reporting requirements are elements for contracts rather than policies or procedures.

12) Once a treasury policy has been developed, what should be part of the formal approval process?

1. Review by senior treasury staff, internal audit and/or a compliance group only
2. Review by senior treasury staff only
3. Review by senior treasury staff, internal auditors, the board of directors, and shareholders
4. Review by senior treasury staff, non-treasury functional area managers, internal auditors, and a board of directors committee

1. Proper segregation of duties significantly reduces which risk?
2. 1. Legal and regulatory/compliance risk
   2. Counterparty risk
   3. Fidelity risk
   4. External theft risk