Which action is NOT a core element of a CIA?

• A. Hire a compliance officer
• B. Establish a confidential disclosure program
• C. Conduct annual external audits
• D. Submit a variety of reports to the OIG

Answer: (C)

A CIA program is built around internal governance that enables the organization to detect, report, and correct compliance issues. Hiring a compliance officer provides clear leadership and accountability for the program. Establishing a confidential disclosure program gives employees a safe channel to report concerns, which is essential for early detection and remediation. Submitting reports to the Office of the Inspector General supports oversight, regulatory coordination, and appropriate corrective actions.

External audits, while valuable for independent assurance, are not a core internal element of a CIA. They are performed by outsiders to validate controls or financial statements and occur outside the ongoing internal governance and reporting framework.