Crane Capital Risk & Compliance Training 2025

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is one of the criteria for incident closing when reported to WSIB?

Conducting employee surveys

Preparation of a financial summary report

Completion of all internal audits

Meeting with WSIB’s Director of Operations (correct)

Which of the following is crucial for incident closure?

Internal control verification and completion of tasks (correct)

Notification of all stakeholders

Public announcement of the incident

Incident report submission only

What is emphasized in communication effective for stakeholders after an incident?

Uniform communication for all stakeholders

No communication required until the incident is resolved

Tailored communication plans for different stakeholders (correct)

Only formal communication with external parties

What should be completed before considering incident closure?

Completion of a post-incident review (C) Signup and view all the answers

What role does the Investment Operational Due Diligence Officer play in the incident closing process?

They attend the closure meeting with WSIB. (D) Signup and view all the answers

What does the policy prohibit in relation to hospitality during a tender?

Offering gifts to gain influence (A) Signup and view all the answers

Which situation is considered inappropriate according to the prevention measures?

Hospitality exceeding established thresholds (D) Signup and view all the answers

What is required for gift purchases according to the Travel & Expense Reimbursement Policy?

Gifts must be submitted through Concur and approved (C) Signup and view all the answers

Which of the following practices is prohibited under Crane Capital's bribery and corruption policies?

Making donations to political organizations (A), Providing gifts to foreign public officials (D) Signup and view all the answers

What action should be taken if a potential bribe is identified?

Report it according to the Whistleblowing Policy (A) Signup and view all the answers

According to the provided information, which of these roles are specifically mentioned in the escalation process for red flags noted during due diligence?

Operations Director and Risk & Compliance (C) Signup and view all the answers

Which of the following is NOT explicitly mentioned as a step in the due diligence process for suppliers/vendors?

Red Flag Escalation (D) Signup and view all the answers

What is the purpose of a Non-Disclosure Agreement (NDA) in the context of the provided information?

To protect confidential information shared between the parties (B) Signup and view all the answers

According to the information provided, what is the primary responsibility of 'Third Party Risk Rating and Due Diligence'?

To assess the risks associated with engaging third parties and ensure their suitability (C) Signup and view all the answers

What does the phrase 'prior to engagement of third party' signify in the context of the provided information?

All necessary approvals and documentation should be finalized before engaging with a third party (A) Signup and view all the answers

What level of severity is indicated by an uncontained incident impacting multiple countries?

Level 2 - ORANGE (B) Signup and view all the answers

Which of the following responsibilities does the Crisis Management Team (CMT) hold?

Ensure Crane Capital can continue operating during a crisis (D) Signup and view all the answers

In a Level 3 - YELLOW incident, what is primarily impacted?

A single site or location (C) Signup and view all the answers

Which member is listed as the CMT Lead for Crane Capital?

Ricky Lau (B) Signup and view all the answers

What level indicates a moderate risk requiring external agency responses?

Level 2 - ORANGE (B) Signup and view all the answers

Which of the following is NOT a responsibility of the CMT?

Keeping the company informed about external threats (D) Signup and view all the answers

What defines Level 2 - ORANGE incidents?

Moderate risk to life, reputation, or operations (C) Signup and view all the answers

What is indicated by a Level 3 - YELLOW incident?

Contained incidents with controls in place (D) Signup and view all the answers

What is the primary goal of Business Continuity Planning?

To ensure operations continue during and after a crisis (B) Signup and view all the answers

What does Disaster Recovery primarily involve?

Restoring IT infrastructure and data access after a disaster (A) Signup and view all the answers

Which team is primarily responsible for Communication with Clients during a crisis?

Investment (C) Signup and view all the answers

What is an example of an alternate recovery strategy for IT equipment?

Contact managed service provider. (A) Signup and view all the answers

How is a Level 1 RED crisis classified?

Wide-scale threat to life, reputation or operations (B) Signup and view all the answers

What does Crisis Management primarily focus on?

Responding to unexpected events to minimize impact (C) Signup and view all the answers

What is an important aspect of a Recovery Strategy?

Establishing a detailed communications plan (C) Signup and view all the answers

In the context of Business Continuity, where does the Accounting/Finance team typically operate during a crisis?

At home (B) Signup and view all the answers

What is a key factor in restoring internet connectivity after a disaster?

Collaborating with internet service providers (A) Signup and view all the answers

Which of the following is NOT a focus of Business Continuity Planning?

Responding to customer complaints (D) Signup and view all the answers

Which of the following methods is NOT mentioned as a way criminals can manipulate property values to avoid scrutiny?

Using funds generated illegally overseas to conceal from authorities in their home jurisdiction (B) Signup and view all the answers

What is a common method criminals use to distance themselves from the property they own?

Using shell companies, trusts, and company structures (A) Signup and view all the answers

Which of these actions is NOT necessarily a red flag for possible criminal activity?

Making renovations and improvements to a property (D) Signup and view all the answers

What is a reason criminals might structure cash deposits in multiple smaller transactions?

To avoid triggering transaction reports and detection by authorities (B) Signup and view all the answers

Which of the following is a method criminals might use to cover up the source of their illicit funds?

Using rental income to legitimize illicit funds (D) Signup and view all the answers

What is the maximum amount an employee can spend on a gift without requiring approval?

US$100 (B) Signup and view all the answers

What is a requirement for an employee to make a gift expenditure?

The recipient company must be listed in the gift request (A) Signup and view all the answers

Which of these is stated as a requirement for gifts exceeding US$100?

A valid explanation must be provided (D) Signup and view all the answers

Study Notes

Crane Capital Risk & Compliance Training - February 2025

Training Focus: 2025 Crane Capital's key risk and compliance focus
Agenda Topics:
- Policies, Procedures, and Guidelines
- Third-Party Risk Management Program
- Anti-Fraud, Corruption, Money Laundering, and Terrorism Financing
- Data Privacy and Cybersecurity Hygiene
- Business Continuity and Crisis Management
- Incident Reporting
- Quiz
- Closing Remarks

2025 Crane's Key Risk & Compliance Focus

Focus Areas:
- Reinforce Compliance Commitment
- Foster a Culture of Accountability
- Strengthen Internal Controls
- Adapt to Evolving Risks
- Enhance Crisis Management and Resilience
- Cybersecurity and Data Protection

Third-Party Risk Management (TPRM) - Lifecycle

Stages: Onboarding, Ongoing, Offboarding
Components: Risk Assessment and Due Diligence, Procurement and Sourcing, Vendor Creation, Vendor Maintenance (Governance), Vendor Monitoring, Oversight and Accountability, Documentation, and Reporting, Independent Review, Termination, Exit Strategy, Third-Party Closure

Third-Party Risk Management (TPRM) - Workflow

Processes: Identification of Third Parties, Assessment, Due Diligence, Policies and Procedures, Tools (outsourcing policy, materiality assessment, procurement policy, vendor management policy, due diligence questionnaire, etc), Other Compliance Requirements, Supplier Code of Conduct Letter of Commitment, Procurement Request Form

Money Laundering Red Flags

Use of Third Parties: Using a friend or family member to purchase property on behalf of the owner, settling differences with undisclosed cash payments, and using multiple banks for deposits to avoid transaction limits
Manipulation of Property Values: Buying and selling property at a price exceeding or falling below market value
Use of Illicit Funds: Paying for unneeded renovations and improvements
Shell Companies/Trusts: Using shell companies or trusts to disguise ownership

Real Estate – Prime Target for Money Laundering

Reasons for Attractiveness: Ease of cash transactions, stability, and reliability as investment, and the ability to improve property value
Targeting of Regions: Regions with opaque real estate markets and limited regulatory oversight

Gifts Declaration

Gift Policy: Gifts to external parties must be under US$100. Any exceeding US$100 requires a valid reason stated in the request and approved by the Managing Partner.
Company Recipient Specification: Recipient company must be specified in the gift request. If gifts are to individuals within the company, individual names and gift amounts need listing.
Restrictions:
- Offering gifts or hospitality may be seen as influence-seeking.
- Gifts/hospitality offered during tenders or contract renewals to foreign officials.
- Gifts exceeding company thresholds.
- Using vouchers/discounts to circumvent rules
- Donations or sponsorships may appear as undisclosed bribes.
- Actions disregarding red flags.
- Actions that are inappropriate in nature.
- Actions taken during pending business decisions.
- Violations of laws or regulations
Prohibited Activities: Crane Capital does not support charitable or political donations.

Prevention Measures

Fraud Prevention: Information Technology Policy Framework and Procedures, Multifactor Authentication, Biometric authentication, Segregation of Duties, Invoice and Cash Management, Whistleblowing Policy, Whistleblower Protection
Bribery & Corruption Prevention: Policies for gift allowance, zero tolerance for bribery, due diligence screening for adverse news reports, anti-fraud, corruption, money laundering, and terrorism financing policy and global compliance regulations

Key Fraud, Bribery, Corruption, AML/CFT Cases of 2024

Evergrande: China property giant and its founder accused of $78bn fraud
Mas Imposes Composition Penalty: S$2.5M on Swiss-Asia for AML/CFT Breaches.
TD Bank: Hit with record $3 billion fine over drug cartel money laundering
UK Engineering Firm Arup: Victim of a £20 million deepfake scam
Deepfake Elon Musk: AI-generated scams contributing to billions in fraud

Cybersecurity Hygiene

Problems: Weak passwords, ignoring updates, clicking on suspicious links, not backing up data and sharing too much online.
Solutions: Regular software updates, strong passwords, phishing awareness, secure Wi-Fi practices, system & network security, regular patching, secure third-party access, monitoring

Business Continuity

Business Continuity Planning: Ensure Crane Capital can continue operating during and after a crisis, plans for uninterrupted business operations
Disaster Recovery: Process of restoring IT infrastructure and data access, reestablish access to applications and data quickly
Crisis Management Response: Focus on responding effectively to unexpected events

Crisis Management Team (CMT)

Responsibilities: Ensuring continued operations, response-to-disruptions, allocating resources, providing updates to board, coordinating crisis-related tasks, implementation of communication plans with stakeholders

Information Security Incidents:

Types: Unauthorized disclosure of sensitive information, theft/loss of devices, virus/malware outbreaks, denial-of-service attacks, unauthorized access to systems/data, compromised user accounts from phishing attempts by criminals.
Reporting Process: Report to the Crisis Management Team (CMT)

Incident Reporting

Key Elements: Incident Types (fraud, theft, cyber threats, operational disruptions, financial reporting irregularities, etc), Response Strategy (timely notification to CMT, investigation, validation, communication to WSIB), Incident Notification Process (who, when, where, why, how data received, how reported to CMT), Incident Investigation, Reporting (escalation process, reports to WSIB), Incident Closing and Follow-Up

Data Protection Principles

Data Protection: Technologies, processes, practices for data availability
Data Security: Protecting data from theft, corruption, unauthorized access throughout its lifecycle
Data Privacy: Ensuring data users and sources understand data collection, usage, management, and monetization of sensitive data.
Data Minimisation: Only the necessary data is collected.
Principle of Least Privilege: Only authorized users get necessary access, reducing compromise risks
Data Classification: Categorizing data based on sensitivity (personal, work, protected, confidential, highly confidential) for prevention
Encryption: Protecting data using encryption techniques

Closing Remarks

Reduce Risk: Reduce likelihood of misconduct, regulatory violations, and reputational harm
Promote Ethical Culture: Foster a workplace culture of integrity, honesty, and transparency.
Employee Engagement: Engage employees in ethics and compliance, making them more likely to act responsibly.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

This quiz covers key topics from the Crane Capital Risk & Compliance Training for February 2025. It focuses on essential policies, third-party risk management, anti-fraud measures, data privacy, and crisis management. Test your understanding of the proactive steps necessary to reinforce compliance and strengthen internal controls.