CCM Cheat Sheet 2026

The 30 highest-yield CCM facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What term describes the process by which shareholders elect directors and vote on major corporate decisions? → Shareholder franchise
2. A compliance manager needs to escalate an ethics concern to the audit committee. What information is most critical to include? → Nature of the issue, potential regulatory impact, and recommended remediation steps
3. How should a Certified Compliance Manager professional handle situations beyond their expertise? → Refer to a qualified specialist and communicate transparently with the client
4. A continuous monitoring program differs from periodic auditing primarily because it: → Provides near-real-time detection of compliance gaps
5. What is a key requirement under the Health Insurance Portability and Accountability Act (HIPAA)? → Secure and protect patient health data
6. Under HIPAA, covered entities must retain documentation of their privacy policies for how long after the policy is in effect? → 6 years
7. A compliance officer discovers that a key control is being bypassed by senior management. This situation is best described as: → Management override
8. Under COSO's Internal Control – Integrated Framework, which component specifically addresses ongoing evaluations and reporting of deficiencies? → Monitoring Activities
9. A compliance officer is reviewing an organization's risk register. Which element is LEAST likely to be included in a typical risk register entry? → Employee compensation details
10. What is meant by 'protected activity' in the context of whistleblower laws? → Lawful acts taken by an employee to report or oppose illegal conduct or violations
11. A 'corporate integrity agreement' (CIA) is most commonly associated with enforcement actions brought by which U.S. agency? → Office of Inspector General (OIG) of the Department of Health and Human Services
12. When performing a Business Impact Analysis (BIA), the primary goal is to: → Prioritize recovery of business functions by criticality
13. A company uses a 'compliance calendar' as part of its continuous improvement program. What is its PRIMARY purpose? → To track regulatory deadlines, review dates, and required updates proactively
14. Under the Dodd-Frank Act, what is the minimum percentage of monetary sanctions a whistleblower must qualify for to receive an award? → 10%
15. What is the most important principle in professional Certified Compliance Manager practice? → Maintaining competence through continuous learning and adherence to standards
16. What is the most important principle in professional Certified Compliance Manager practice? → Maintaining competence through continuous learning and adherence to standards
17. A company's code of conduct should be reviewed and updated at minimum how often according to best practices? → Annually
18. What is the primary purpose of compliance with anti-money laundering (AML) regulations? → Prevent misuse of financial systems
19. A financial services firm is implementing a new conflicts-of-interest policy. Which control mechanism BEST reinforces policy compliance? → Requiring annual written disclosures and review by a compliance committee
20. When communicating a new Code of Conduct to employees, which approach best ensures comprehension and acknowledgment? → Requiring signed acknowledgment after targeted training that explains key provisions
21. What should a practitioner do when regulations conflict with employer policies? → Follow the regulation, as legal requirements supersede employer policies
22. Why are compliance reports submitted to senior management? → To guide strategic and risk-related decisions
23. A compliance team uses data analytics to flag 100% of transactions for review. This approach is BEST described as: → Full population testing
24. An employee discovers the CFO is manipulating earnings reports. The MOST appropriate first action under an ethical framework is to: → Report through the internal escalation or hotline process
25. What role does documentation play in Certified Compliance Manager professional practice? → It creates accountability, supports decision-making, and provides legal protection
26. Which of the following is a key output of the 'Check' phase in a compliance-focused PDCA cycle? → Performance data compared against compliance objectives
27. A 'prompt corrective action' (PCA) framework under federal banking law primarily applies to: → Undercapitalized depository institutions
28. An organization implements a control requiring two separate individuals to authorize any wire transfer over $50,000. This is an example of: → Dual control
29. Under the False Claims Act, what financial incentive may a whistleblower (relator) receive? → A percentage of government funds recovered as a result of their report
30. Which of the following best describes an 'ethics ombudsperson' role in an organization? → A neutral, confidential resource employees can consult about ethical dilemmas and concerns