question: Who is eligible to take FMLA leave under the company leave policy?

answer: An employee is eligible when they work for a covered employer, have at least 12 months of employment, have worked at least 1,250 hours in the 12 months before leave starts, and work at a location with at least 50 employees within 75 miles.

source_type: policy

domain: HR

confidence: High


question: Does paid vacation time count toward the 1,250-hour FMLA eligibility requirement?

answer: No. The 1,250-hour threshold counts hours actually worked for the employer; paid or unpaid leave time does not count toward that requirement.

source_type: policy

domain: HR

confidence: High


question: Can an eligible employee take FMLA leave for single days or hours instead of full weeks?

answer: Yes. FMLA leave may be taken in whole weeks, single days, hours, and in some cases increments smaller than an hour, with usage measured against the employee's actual workweek.

source_type: manual

domain: HR

confidence: High


question: If an employee has worked 11 months and 1,300 hours, are they automatically FMLA eligible?

answer: No. They meet the hours threshold but not the 12-month employment requirement, so eligibility is not automatic.

source_type: policy

domain: HR

confidence: High


question: May an employer require an employee to use accrued paid leave during FMLA leave?

answer: Yes. The employer may require, or the employee may elect, use of accrued paid vacation, sick, or family leave for some or all of an FMLA leave period, subject to the rules that apply to that paid leave.

source_type: policy

domain: HR

confidence: High


question: Can an employer deny an attendance-based bonus to an employee who missed the goal because of FMLA leave?

answer: Yes, if the employer applies the same rule to employees on comparable non-FMLA leave. The denial must be based on the unmet goal, not retaliation for using FMLA.

source_type: policy

domain: HR

confidence: High


question: Is an anti-harassment policy enough by itself to show reasonable care?

answer: No. A policy and complaint procedure help, but the employer also needs reasonable prevention and correction measures such as training, impartial complaint channels, and prompt investigation.

source_type: policy

domain: HR

confidence: High


question: Should a harassment complaint channel include someone outside the employee's chain of command?

answer: Yes. EEOC guidance says it is advisable to designate at least one official outside the chain of command so complaints can be handled impartially.

source_type: SOP

domain: HR

confidence: High


question: What should investigators remind witnesses about during a harassment investigation?

answer: They should remind parties and witnesses that retaliation is prohibited, so employees are not discouraged from participating or reporting concerns.

source_type: SOP

domain: HR

confidence: High


question: If an employee files an EEOC charge without first using the internal complaint process, should the employer ignore the matter internally?

answer: No. EEOC guidance indicates the employer should still launch an internal investigation when it learns of an unlawful harassment allegation.

source_type: SOP

domain: HR

confidence: High


question: Can a harassment policy tolerate retaliation if the original complaint is not proven?

answer: No. The complaint outcome does not permit retaliation against someone who complained or participated in an investigation in good faith.

source_type: policy

domain: HR

confidence: High


question: Should harassment prevention training be limited only to supervisors?

answer: No. Where feasible, training should reach all employees so they understand their rights, duties, reporting paths, and anti-retaliation expectations.

source_type: manual

domain: HR

confidence: High


question: Negative example: Are all employees eligible for FMLA leave on their first day of work?

answer: No. That claim is unsupported and incorrect because FMLA eligibility includes a 12-month employment requirement and a 1,250-hours-worked requirement.

source_type: policy

domain: HR

confidence: High


question: Negative example: Does internal HR policy allow retaliation against employees who join a harassment investigation as witnesses?

answer: No. A compliant policy should prohibit retaliation against both complainants and investigation participants.

source_type: policy

domain: HR

confidence: High


question: What three conditions make an employee reimbursement arrangement an accountable plan?

answer: The expense must be business-related to employee services, the employee must substantiate it within a reasonable time, and the employee must return any excess advance within a reasonable time.

source_type: policy

domain: Finance

confidence: High


question: How are reimbursements under an accountable plan treated for payroll tax purposes?

answer: Amounts paid under an accountable plan are not treated as wages and are not subject to federal income tax withholding, Social Security, Medicare, or FUTA taxes.

source_type: policy

domain: Finance

confidence: High


question: What happens if an employee does not substantiate reimbursed business expenses on time?

answer: The payment is treated as made under a nonaccountable plan, making it wages subject to income tax withholding and employment taxes.

source_type: policy

domain: Finance

confidence: High


question: If an employee receives an advance larger than the substantiated expense and does not return the excess, how should payroll treat the excess?

answer: The unreturned excess is treated as nonaccountable plan wages and is subject to applicable withholding and employment taxes.

source_type: SOP

domain: Finance

confidence: High


question: Can a reimbursement be tax-free if it is simply a replacement for wages the employee would otherwise receive?

answer: No. A reimbursement that would otherwise have been paid as wages is treated as nonaccountable and taxable.

source_type: policy

domain: Finance

confidence: High


question: What is the general tax rule for fringe benefits provided to employees?

answer: A fringe benefit is taxable unless a specific law excludes it. Employers should value taxable benefits and handle withholding according to the applicable fringe benefit rules.

source_type: manual

domain: Finance

confidence: High


question: Can an employer choose when to treat taxable noncash fringe benefits as paid?

answer: Yes. The employer may treat them as paid by pay period, quarter, semiannual period, annual period, or another basis, provided each benefit is treated as paid at least once during the year.

source_type: manual

domain: Finance

confidence: High


question: If a company underestimates fringe benefit value and deposits too little tax, what risk does it face?

answer: It may be subject to a failure-to-deposit penalty, because deposits must match the tax liability for the period in which the benefits are treated as paid.

source_type: manual

domain: Finance

confidence: High


question: Are employer-provided cell phones always taxable fringe benefits?

answer: No. Employer-provided cell phones can be nontaxable when provided primarily for a noncompensatory business reason.

source_type: manual

domain: Finance

confidence: High


question: What COBRA right is triggered when employees and families lose group health benefits after qualifying events?

answer: COBRA gives qualified workers and family members the right to elect temporary continuation of group health coverage after qualifying events such as job loss, reduced hours, divorce, death, or other covered life events.

source_type: policy

domain: Finance

confidence: High


question: What COBRA notice should group health plans provide early in coverage?

answer: Group health plans must provide each covered employee and spouse a general notice describing COBRA rights within the first 90 days of coverage.

source_type: SOP

domain: Finance

confidence: High


question: Negative example: Are nonaccountable travel reimbursements excluded from wages just because the expense was business-related?

answer: No. Without timely substantiation and return of excess amounts, payments under a nonaccountable plan are treated as wages even if they relate to business travel.

source_type: policy

domain: Finance

confidence: High


question: Negative example: Does COBRA eliminate the need for employer or plan notices?

answer: No. COBRA includes notice obligations, including general notices and election-related information for qualified beneficiaries.

source_type: policy

domain: Finance

confidence: High


question: What minimum length should subscriber-chosen passwords meet under NIST memorized secret guidance?

answer: Subscriber-chosen memorized secrets should be at least 8 characters long.

source_type: policy

domain: IT

confidence: High


question: Should the password system allow long passwords?

answer: Yes. NIST guidance says verifiers should permit subscriber-chosen memorized secrets of at least 64 characters.

source_type: policy

domain: IT

confidence: High


question: Should password policy require character-class complexity rules such as mandatory uppercase, number, and symbol?

answer: No. NIST guidance says no other complexity requirements should be imposed beyond the minimum length and compromised-password screening.

source_type: policy

domain: IT

confidence: High


question: What should a verifier do when a proposed password appears on a compromised or commonly used password list?

answer: It should reject the password, tell the user why it was rejected, and require the user to choose a different memorized secret.

source_type: SOP

domain: IT

confidence: High


question: Should password entry allow paste functionality?

answer: Yes. Allowing paste supports password managers and can help users choose stronger memorized secrets.

source_type: policy

domain: IT

confidence: High


question: When should users be required to change a password under NIST FAQ guidance?

answer: Users should be required to change passwords when there is evidence the memorized secret has been compromised, such as a breach of the verifier database or observed fraud.

source_type: manual

domain: IT

confidence: High


question: Can a password verifier use password hints based on personal facts?

answer: No. NIST guidance says verifiers should not prompt users to choose secrets based on specific personal information such as a pet's name.

source_type: policy

domain: IT

confidence: High


question: What should a business do first after discovering a data breach?

answer: It should move quickly to secure operations, fix vulnerabilities, mobilize the breach response team, and prevent additional data loss before normal operations resume.

source_type: SOP

domain: IT

confidence: High


question: Whom should a business consider notifying after a data breach involving personal information?

answer: Depending on the facts, it should notify law enforcement, affected businesses, and affected individuals, while complying with applicable breach notification rules.

source_type: SOP

domain: IT

confidence: High


question: Why should breached credentials be changed even after attacker tools are removed?

answer: Stolen credentials can still allow access after malware or tools are removed, so changing them is needed to close that access path.

source_type: SOP

domain: IT

confidence: High


question: What communication mistake should a company avoid during breach response?

answer: It should avoid misleading statements and avoid withholding key details that affected people need to protect themselves, while also not sharing information that creates additional risk.

source_type: SOP

domain: IT

confidence: High


question: What is the purpose of business data backups in cyber resilience?

answer: Backups provide a separate, secure copy of critical data so the organization can restore operations after cyber incidents, accidental deletion, system failure, or disasters.

source_type: manual

domain: IT

confidence: High


question: What should a ransomware response team document during initial analysis?

answer: It should consult the incident response team and document an initial understanding of what happened based on available analysis.

source_type: SOP

domain: IT

confidence: High


question: Negative example: Should a password policy force periodic password changes even without compromise evidence solely because NIST requires it?

answer: No. NIST FAQ guidance supports requiring changes when there is evidence of compromise; it does not require arbitrary periodic changes for that reason alone.

source_type: policy

domain: IT

confidence: High


question: Negative example: After a breach, should the company wait to secure systems until every notification letter is drafted?

answer: No. The business should secure operations and fix vulnerabilities quickly to prevent more data loss while also planning required notifications.

source_type: SOP

domain: IT

confidence: High


question: What does SEC Rule 21F-17 prohibit regarding employee reporting?

answer: It prohibits actions that impede a person from contacting the SEC directly to report possible securities law violations.

source_type: policy

domain: Legal

confidence: High


question: Are SEC whistleblower anti-retaliation protections generally limited to employees?

answer: Yes. The anti-retaliation protections generally apply to employees who report possible federal securities law violations, while anti-impeding protections are broader.

source_type: manual

domain: Legal

confidence: High


question: Can a company policy block employees from contacting the SEC directly about possible securities violations?

answer: No. A policy, agreement, or action that prevents direct SEC contact about possible securities law violations would conflict with SEC whistleblower protections.

source_type: policy

domain: Legal

confidence: High


question: If an employee reports internally first, can they still be eligible for an SEC whistleblower award?

answer: Potentially yes, if they also report directly to the SEC within the required timeframe and the company later reports the information or investigation results to the SEC.

source_type: manual

domain: Legal

confidence: Medium


question: What timeframe does the SEC FAQ mention for direct SEC reporting after internal reporting to preserve potential award eligibility?

answer: The FAQ indicates the person should also report directly to the SEC within 120 days.

source_type: manual

domain: Legal

confidence: High


question: Are SEC investigations public by default?

answer: No. The SEC states that, as a matter of policy, it conducts investigations confidentially.

source_type: manual

domain: Legal

confidence: High


question: What should legal review check in confidentiality agreements used with employees?

answer: It should check that the agreement does not prevent or discourage employees from contacting the SEC directly about possible securities law violations.

source_type: SOP

domain: Legal

confidence: High


question: Can a company retaliate against an employee for providing information to the SEC whistleblower program?

answer: No. SEC whistleblower protections include anti-retaliation protections for employees who provide information about possible securities law violations.

source_type: policy

domain: Legal

confidence: High


question: How should a breach response plan handle communications with consumers?

answer: It should provide plain-language, useful information through an organized communication plan and avoid statements that mislead affected people or increase risk.

source_type: SOP

domain: Legal

confidence: High


question: What notification timing applies to FTC Safeguards Rule notification events for financial institutions?

answer: Covered financial institutions must notify the FTC as soon as possible and no later than 30 days after discovery of a notification event.

source_type: policy

domain: Legal

confidence: High


question: What should a company do if law enforcement requests delayed public disclosure during a Safeguards Rule breach notification process?

answer: It should account for the law-enforcement delay in the FTC notification process rather than making public details that law enforcement has asked it to withhold.

source_type: SOP

domain: Legal

confidence: Medium


question: Negative example: Can an NDA require employees to get company approval before reporting securities concerns to the SEC?

answer: No. Requiring company approval before direct SEC contact would impede reporting and is inconsistent with SEC whistleblower protections.

source_type: policy

domain: Legal

confidence: High


question: Negative example: Is a financial institution allowed to wait six months before notifying the FTC of a Safeguards Rule notification event?

answer: No. The rule requires notice as soon as possible and no later than 30 days after discovery for covered notification events.

source_type: policy

domain: Legal

confidence: High


question: What is the purpose of an emergency action plan?

answer: An emergency action plan organizes employer and employee actions during workplace emergencies so response is coordinated and injuries, confusion, and property damage are reduced.

source_type: manual

domain: Ops

confidence: High


question: Should an emergency action plan be generic or site-specific?

answer: It should be site-specific, reflecting the workplace's emergency conditions, evacuation policies, reporting mechanisms, alarm systems, layout, and hazards.

source_type: SOP

domain: Ops

confidence: High


question: What should employees understand about an emergency action plan before an actual evacuation?

answer: They should understand potential emergencies, reporting procedures, alarm systems, evacuation routes, shutdown procedures, and their own roles in the plan.

source_type: SOP

domain: Ops

confidence: High


question: Why should evacuation assistants be trained on alternate escape routes?

answer: Because the primary evacuation route may be blocked, and trained assistants need to guide employees safely using alternative routes.

source_type: SOP

domain: Ops

confidence: High


question: What evacuation-plan elements should be defined before an emergency?

answer: The plan should define when to evacuate, when to shelter in place, who can order evacuation or shutdown, routes and exits, visitor assistance, disability assistance, and any critical shutdown duties.

source_type: SOP

domain: Ops

confidence: High


question: When multiple employers share a worksite, should evacuation planning be coordinated?

answer: Yes. OSHA notes that coordination with other employers at a shared worksite may be beneficial, even where not specifically required by the cited standard.

source_type: SOP

domain: Ops

confidence: High


question: What makes an emergency action plan useful after it is drafted?

answer: It remains useful only if it is kept up to date and employees are educated and trained before a real evacuation occurs.

source_type: manual

domain: Ops

confidence: High


question: What should records management staff use to decide whether records may be destroyed or transferred?

answer: They should use approved records schedules, which determine whether records can be destroyed after a period or must eventually be transferred to NARA.

source_type: policy

domain: Ops

confidence: High


question: Does every workplace emergency require evacuation?

answer: No. The emergency action plan should identify both conditions that require evacuation and conditions where shelter-in-place may be safer.

source_type: SOP

domain: Ops

confidence: High


question: What information should backup and recovery planning consider before a ransomware incident?

answer: The organization should understand its backup and recovery needs, including critical data, restoration priorities, and how operations will resume after disruption.

source_type: SOP

domain: Ops

confidence: High


question: Negative example: Can a workplace emergency plan omit evacuation routes because employees can improvise during an alarm?

answer: No. A proper emergency action plan should specify evacuation procedures, routes, exits, and responsibilities before an emergency occurs.

source_type: SOP

domain: Ops

confidence: High


question: Negative example: May employees destroy records whenever storage is full if the documents seem old?

answer: No. Records disposition should follow approved records schedules, not ad hoc storage decisions.

source_type: policy

domain: Ops

confidence: High


question: If an employee works at a location with 40 employees nearby but the company has 500 employees nationally, is FMLA eligibility automatic?

answer: No. One FMLA eligibility condition is working at a location where the employer has at least 50 employees within 75 miles; national headcount alone is not enough.

source_type: policy

domain: HR

confidence: High


question: How should HR answer a manager who wants to reduce an employee's bonus only because the employee filed a harassment complaint?

answer: HR should reject the action because retaliation against someone who complains of harassment or participates in an investigation is not tolerated under compliant anti-harassment procedures.

source_type: SOP

domain: HR

confidence: High


question: A traveler submits receipts late and keeps unused advance money. Is the reimbursement still accountable?

answer: No. Accountable plan treatment requires timely substantiation and timely return of excess advances; otherwise the payment is treated as nonaccountable wages.

source_type: SOP

domain: Finance

confidence: High


question: A company reimburses legitimate travel expenses but would have paid the same amount as salary if no trip occurred. Is it accountable plan treatment?

answer: No. A payment that would otherwise have been paid as wages is treated as nonaccountable even if described as a reimbursement.

source_type: policy

domain: Finance

confidence: High


question: A password is 10 characters long but appears in a breach corpus. Should the system accept it because it meets length rules?

answer: No. The verifier should screen proposed passwords against common, expected, or compromised values and require a different password when there is a match.

source_type: SOP

domain: IT

confidence: High


question: After a breach, why should the response team verify the type of information compromised and the number of people affected?

answer: That information drives notification decisions, communications planning, and risk-reduction steps for affected people and business partners.

source_type: SOP

domain: IT

confidence: High


question: If a confidentiality clause says employees may report only through the internal hotline, what legal issue should be flagged?

answer: The clause may impede direct SEC reporting, which SEC whistleblower protections prohibit for possible securities law violations.

source_type: policy

domain: Legal

confidence: High


question: A financial institution discovers unauthorized access affecting customer data and waits for a quarterly compliance meeting before FTC notice. Is that aligned with the Safeguards Rule timing?

answer: No. For covered notification events, notice must be made as soon as possible and no later than 30 days after discovery.

source_type: policy

domain: Legal

confidence: High


question: A facility has an emergency plan but never trains new employees on alarms or exits. What is the operational risk?

answer: The plan may fail in practice because employees need to understand alarms, routes, reporting, shutdown duties, and responsibilities before an actual emergency.

source_type: SOP

domain: Ops

confidence: High


question: A site has employees with mobility limitations and visitors who may not speak English. Should the evacuation plan address them?

answer: Yes. OSHA evacuation planning includes procedures for assisting visitors and employees, especially people with disabilities or language barriers.

source_type: SOP

domain: Ops

confidence: High


question: If an employee has 12 months of service, 1,260 actual hours worked, and a qualifying serious health condition, what remaining location condition must HR verify for FMLA?

answer: HR must verify that the employee works at a location where the employer has at least 50 employees within 75 miles.

source_type: policy

domain: HR

confidence: High


question: A manager says FMLA leave hours should help the employee qualify for next year's 1,250-hour threshold. Is that correct?

answer: No. The 1,250-hour calculation includes only hours actually worked; FMLA leave itself is not counted as hours worked for that threshold.

source_type: policy

domain: HR

confidence: High


question: If a group health plan starts coverage for an employee and spouse, when should they receive the COBRA general notice?

answer: They should receive the general notice describing COBRA rights within the first 90 days of coverage.

source_type: SOP

domain: Finance

confidence: High


question: If an employer pays a fixed allowance by travel days, does the company still need accountable plan controls?

answer: Yes. Fixed allowances such as per diem can be used, but accountable treatment still depends on meeting the applicable substantiation, business connection, and excess-return rules.

source_type: policy

domain: Finance

confidence: Medium


question: What password policy is better aligned with NIST: block breached passwords and allow long passphrases, or force special characters and short maximum length?

answer: Blocking breached passwords and allowing long passphrases is better aligned; NIST discourages extra composition rules and recommends allowing at least 64 characters.

source_type: policy

domain: IT

confidence: High


question: During breach response, why should public details be controlled carefully?

answer: The organization must be truthful and useful to affected people while avoiding disclosure of details that could put consumers or systems at additional risk.

source_type: SOP

domain: IT

confidence: High


question: An employee reports internally, then the company reports the resulting investigation to the SEC. What should the employee still do for potential SEC award eligibility?

answer: They should submit the information directly to the SEC within the applicable timeframe, which the SEC FAQ describes as within 120 days after internal reporting.

source_type: manual

domain: Legal

confidence: Medium


question: What is the difference between SEC anti-retaliation and anti-impeding protections in policy review?

answer: Anti-retaliation protections generally focus on employees reporting possible securities law violations, while anti-impeding protections prohibit anyone from blocking direct SEC contact and are not limited to the employee-employer context.

source_type: manual

domain: Legal

confidence: High


question: What should operations include in an evacuation plan for employees assigned to shut down critical equipment?

answer: The plan should designate which employees remain after an alarm for critical shutdown duties, define those duties, and ensure they evacuate after completing them when safe.

source_type: SOP

domain: Ops

confidence: High


question: Why should a records retention decision not rely only on a manager's memory of old practice?

answer: Retention and disposition decisions should follow records schedules because schedules authorize destruction or transfer decisions based on approved retention rules.

source_type: policy

domain: Ops

confidence: High


question: Can HR count nonconsecutive employment toward the 12-month FMLA service requirement?

answer: Generally yes. The 12 months of employment do not have to be consecutive, although special limits apply to older breaks in service unless exceptions such as military service or written agreements apply.

source_type: policy

domain: HR

confidence: High


question: What should HR verify before denying an FMLA request for lack of hours?

answer: HR should verify actual hours worked in the 12 months before leave starts and should exclude paid leave, unpaid leave, and FMLA leave from the hours calculation.

source_type: SOP

domain: HR

confidence: High


question: Negative example: Does a manager's belief that a harassment complaint is exaggerated allow the manager to discipline the complainant for reporting?

answer: No. Retaliation is prohibited against employees who complain of harassment or participate in an investigation, even when the facts still need to be investigated.

source_type: policy

domain: HR

confidence: High


question: If payroll makes a single payment containing both wages and expense reimbursement, what should it do?

answer: Payroll should specify which portion is reimbursement and which portion is wages, because reimbursement tax treatment depends on whether accountable plan rules are met.

source_type: SOP

domain: Finance

confidence: High


question: Are working-condition fringe benefits always taxable to the employee?

answer: No. Working-condition fringes can be nontaxable when the property or service would be allowable as a business expense or depreciation deduction if the employee paid for it.

source_type: manual

domain: Finance

confidence: High


question: Negative example: Can finance ignore excess travel advances if the original trip was approved?

answer: No. Excess advances must be returned within a reasonable period for accountable plan treatment; otherwise the excess is taxable wages.

source_type: policy

domain: Finance

confidence: High


question: What access-control principle does FTC security guidance emphasize for business data?

answer: Businesses should control access to data sensibly, limiting access based on need and pairing access with secure passwords and authentication.

source_type: manual

domain: IT

confidence: High


question: If a backup is stored on the same primary system as production data, what resilience concern should IT flag?

answer: A backup should be a secure copy stored separately from primary systems; otherwise the same incident could damage both production data and the backup.

source_type: SOP

domain: IT

confidence: High


question: Negative example: Should IT publish exact exploited system details in a consumer breach FAQ if doing so would increase risk?

answer: No. Breach communications should be useful and truthful, but should not publicly share information that puts consumers or systems at further risk.

source_type: SOP

domain: IT

confidence: High


question: What should legal counsel check when reviewing severance agreements for SEC-regulated companies?

answer: Counsel should ensure the agreement does not waive, chill, or require approval for direct communications with the SEC about possible securities law violations.

source_type: SOP

domain: Legal

confidence: High


question: Can a person lose SEC award eligibility merely because they first told another agency or the media?

answer: Not necessarily, but they still must timely submit the information directly to the SEC to be eligible under the SEC whistleblower program.

source_type: manual

domain: Legal

confidence: Medium


question: What should an emergency action plan say about who can order evacuation or shutdown?

answer: It should define a clear chain of command and designate the person authorized to order evacuation or shutdown during covered emergency conditions.

source_type: SOP

domain: Ops

confidence: High


question: Negative example: Is a drafted emergency action plan sufficient if employees never learn their roles?

answer: No. OSHA guidance emphasizes that a plan is useful only when it is current and employees are trained on their responsibilities before an emergency.

source_type: SOP

domain: Ops

confidence: High