CCCP Compliance Effectiveness Assessment 2 — Questions and Answers
Question 1: Which metric is most directly used to assess whether a compliance training program is effective?
- Number of employees trained
- Pre- and post-training knowledge assessment scores (Correct answer)
- Cost per training hour
- Frequency of training sessions held
Correct answer: Pre- and post-training knowledge assessment scores
Pre- and post-training knowledge scores measure actual learning gain, which directly reflects training effectiveness.
Question 2: A compliance officer notices that policy violations are down 40% year-over-year. What additional data is needed before concluding the compliance program is effective?
- The total number of employees
- Whether reporting mechanisms changed or fear of retaliation increased (Correct answer)
- The age of the compliance program
- Whether the CCO attended industry conferences
Correct answer: Whether reporting mechanisms changed or fear of retaliation increased
A drop in reported violations can reflect improved behavior or a chilling effect on reporting—distinguishing between these is critical.
Question 3: Under the DOJ's 2023 Evaluation of Corporate Compliance Programs guidance, which factor is used to assess whether a compliance program is 'adequately resourced'?
- The compliance budget as a percentage of revenue
- The number of compliance staff and their access to relevant data and expertise (Correct answer)
- Whether the company has cyber liability insurance
- The ratio of lawyers to compliance officers
Correct answer: The number of compliance staff and their access to relevant data and expertise
The DOJ evaluates staffing levels, expertise, and access to information to determine whether compliance has the resources needed to function effectively.
Question 4: A key performance indicator (KPI) in compliance effectiveness assessment is the 'hotline utilization rate.' What does a very low rate typically indicate?
- No compliance issues exist
- Employees may distrust the reporting system or fear retaliation (Correct answer)
- The hotline vendor is performing poorly
- Management has a strong ethical culture
Correct answer: Employees may distrust the reporting system or fear retaliation
Low hotline utilization often signals a speak-up culture problem rather than the absence of misconduct.
Question 5: Which of the following best describes a 'lagging indicator' in compliance effectiveness measurement?
- Number of employees who completed ethics training this quarter
- Frequency of compliance risk assessments conducted
- Number of enforcement actions or sanctions received (Correct answer)
- Percentage of third parties screened before onboarding
Correct answer: Number of enforcement actions or sanctions received
Lagging indicators reflect outcomes after the fact, such as enforcement actions, whereas leading indicators predict future compliance health.
Question 6: When benchmarking a compliance program's effectiveness against peers, which source provides the most authoritative industry standards?
- A single competitor's annual report
- DOJ/SEC guidance documents and industry association surveys (Correct answer)
- Social media posts from compliance professionals
- Internal audit reports from prior years
Correct answer: DOJ/SEC guidance documents and industry association surveys
DOJ/SEC guidance and industry surveys (e.g., SCCE, ECI) provide validated external benchmarks for measuring program maturity.
Question 7: A compliance effectiveness review finds that the company's code of conduct was last updated four years ago. Which risk does this primarily create?
- Increased cybersecurity vulnerabilities
- Gaps between current regulatory requirements and employee guidance (Correct answer)
- Reduced employee morale
- Higher insurance premiums
Correct answer: Gaps between current regulatory requirements and employee guidance
An outdated code of conduct may fail to address new laws, regulations, or business risks, leaving employees without current guidance.
CCCP Compliance Effectiveness Assessment 2
Which metric is most directly used to assess whether a compliance training program is effective?