Which steps demonstrate a sound governance framework? (Select Two.)

A sound governance framework is demonstrated by senior management's tangible support and a dynamic, risk-based approach. Providing resources for investigation (B) shows direct management commitment, a cornerstone of effective governance as it empowers the compliance function. Updating the sanctions risk assessment based on the root cause of a violation (C) illustrates a proactive and adaptive compliance program that learns from failures to prevent recurrence. Together, these actions represent both the "tone from the top" through resource allocation and the operational effectiveness of the compliance function, which are essential elements of a robust framework as outlined by key regulatory guidance.

A. This is an administrative action resulting from a policy, but it is less foundational to the overall governance framework than management support or risk assessment.
D. This reflects a complacent and flawed view; the absence of a regulatory penalty does not confirm the sufficiency or effectiveness of a compliance program.
E. While setting a "tone from the top" is important, providing tangible resources (B) is a more concrete and empowering demonstration of management's commitment.

1. U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC). (2019). A Framework for OFAC Compliance Commitments.

For Answer B: Page 3, Section A, "Management Commitment," states that senior management should "ensure that the compliance unit(s) are given adequate resources (including human capital, expertise, information technology, and other resources) to perform their responsibilities effectively."

For Answer C: Page 5, Section B, "Risk Assessment," notes that a sanctions compliance program should be updated "to account for the root causes of any apparent violations or systemic deficiencies identified by the organization during its routine and ongoing assessment."

2. The Wolfsberg Group. (2019). The Wolfsberg Group Sanctions Statement.

For Answer B & C: Page 2 states that an effective program requires "the allocation of adequate resources" and that Financial Institutions should "implement a risk-based approach to sanctions compliance." This supports providing resources for investigation and using findings to update the risk profile.