Certified Compliance & Ethics Professional (CCEP) — Corporate Compliance Professional — Questions and Answers

Question 1: What is the primary compliance risk associated with 'tone at the middle' (managers and supervisors)?

Middle managers often lack authority to discipline policy violators
Middle managers may set compensation structures that violate overtime laws
Supervisors may inadvertently disclose confidential hotline reports
If managers do not reinforce compliance values, employees may believe leadership messaging is hollow (Correct answer)

Correct answer: If managers do not reinforce compliance values, employees may believe leadership messaging is hollow

Middle managers translate organizational culture into daily behavior; if they undermine or ignore compliance messaging, employees learn that compliance is not truly valued.

Question 2: Under the FCA, what standard of proof must the government meet to establish that a defendant 'knowingly' submitted a false claim?

Strict liability regardless of intent
Beyond a reasonable doubt
Clear and convincing evidence
Preponderance of the evidence under the civil scienter standard (Correct answer)

Correct answer: Preponderance of the evidence under the civil scienter standard

The FCA is a civil statute requiring proof by a preponderance of the evidence that the defendant acted with actual knowledge, deliberate ignorance, or reckless disregard.

Question 3: Which body is responsible for administering the CCCP certification in the United States?

The U.S. Department of Justice (DOJ)
The Securities and Exchange Commission (SEC)
The Society of Corporate Compliance and Ethics (SCCE) (Correct answer)
The American Bar Association (ABA)

Correct answer: The Society of Corporate Compliance and Ethics (SCCE)

The Society of Corporate Compliance and Ethics (SCCE) administers the CCCP certification for corporate compliance professionals.

Question 4: Attorney-client privilege over compliance communications to the board is BEST preserved when:

Compliance reports are shared with investors upon request
The CCO sends emails to all executives copied to outside counsel
Board minutes document all compliance details in full
Legal counsel directs the investigation and communications are marked as attorney-client privileged (Correct answer)

Correct answer: Legal counsel directs the investigation and communications are marked as attorney-client privileged

Privilege requires that legal counsel direct the work and communications be properly labeled and limited in distribution.

Question 5: The FCA's 'materiality' standard after Escobar requires plaintiffs to show that the false statement:

Actually caused the government to make the payment
Had a natural tendency to influence or was capable of influencing the government's payment decision (Correct answer)
Appeared in the face of the submitted claim form
Was the sole reason for the government's payment

Correct answer: Had a natural tendency to influence or was capable of influencing the government's payment decision

Escobar adopted an objective materiality test: the misrepresentation must have a natural tendency to influence or be capable of influencing the payment decision, not necessarily be the direct cause.

Question 6: The '60-day rule' in healthcare compliance, established by the Affordable Care Act, requires providers to:

Report and return identified Medicare/Medicaid overpayments within 60 days of identification (Correct answer)
Investigate all compliance hotline tips within 60 days
Complete annual compliance training within 60 days of the program year start
Respond to OIG audit requests within 60 days of receipt

Correct answer: Report and return identified Medicare/Medicaid overpayments within 60 days of identification

The ACA requires providers to report and return identified Medicare/Medicaid overpayments within 60 days of identification to avoid False Claims Act liability.

Question 7: What is the recommended approach when a compliance officer discovers that a senior executive violated the Code of Conduct?

Defer to the executive's supervisor to handle informally
Immediately terminate the executive without investigation
Apply the same investigation and disciplinary standards used for any other employee to demonstrate consistency (Correct answer)
Report only to external regulators and bypass internal processes

Correct answer: Apply the same investigation and disciplinary standards used for any other employee to demonstrate consistency

Consistent application of standards regardless of seniority is a hallmark of an effective ethics program and critical to maintaining credibility.

Question 8: How should a compliance program handle an employee's report made in good faith that turns out to be unsubstantiated?

Require the employee to retract the report in writing
Discipline the employee for wasting investigative resources
Document the closure and thank the employee for raising the concern (Correct answer)
Treat the reporter as a whistleblower and take no adverse action

Correct answer: Document the closure and thank the employee for raising the concern

Good-faith reporters should be thanked and protected from retaliation even when investigations find no wrongdoing, reinforcing the speak-up culture.

Question 9: What is the primary compliance risk associated with having a Code of Conduct that employees must 'acknowledge' but not meaningfully understand?

A false sense of compliance without actual behavioral change or risk mitigation (Correct answer)
Mandatory external audit requirements under SEC rules
Higher legal costs for document preparation
Increased regulatory filing requirements

Correct answer: A false sense of compliance without actual behavioral change or risk mitigation

Checkbox acknowledgment without genuine understanding creates a paper compliance program that fails to reduce actual misconduct risk.

Question 10: How often should a compliance officer present a comprehensive program update to the full board, at minimum?

Annually, with interim audit committee updates as needed (Correct answer)
Only when regulators request it
Every five years at strategic planning sessions
Monthly, with full metrics every time

Correct answer: Annually, with interim audit committee updates as needed

Best practice calls for at least annual full-board compliance updates, supplemented by more frequent audit committee engagement.

Question 11: What is the most effective way to measure success in compliance effectiveness assessment within CCCP professional practice?

Rely solely on supervisor opinion
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)
Count only the number of activities completed
Compare only with industry averages without considering context

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 12: How does the DOJ's 2023 guidance on corporate compliance programs address the evaluation of ethics culture?

It focuses exclusively on financial controls rather than cultural factors
It instructs prosecutors to assess whether compliance programs are adequately resourced, empowered, and actually working (Correct answer)
It mandates that all employees pass an ethics certification exam
It requires companies to publicly disclose all ethics violations annually

Correct answer: It instructs prosecutors to assess whether compliance programs are adequately resourced, empowered, and actually working

The DOJ's 2023 guidance emphasizes evaluating whether compliance programs are well-resourced, empowered, and producing genuine behavioral outcomes — not just paper policies.

Question 13: What is a 'risk-tiered' approach to third-party due diligence?

Calibrating the depth of due diligence based on each third party's risk profile, including geography, industry, and contract scope (Correct answer)
Delegating due diligence entirely to the procurement department
Requiring all third parties to obtain independent compliance certifications
Applying the same level of scrutiny to all vendors regardless of risk

Correct answer: Calibrating the depth of due diligence based on each third party's risk profile, including geography, industry, and contract scope

A risk-tiered approach allocates compliance resources proportionately, applying enhanced due diligence to high-risk third parties while streamlining reviews for low-risk ones.

Question 14: Which international sanctions regime is administered by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC)?

U.S. import tariff schedules for international trade
U.S. economic and trade sanctions programs targeting specific countries, entities, and individuals (Correct answer)
U.S. export control regulations for dual-use technology
U.S. anti-money laundering regulations for financial institutions

Correct answer: U.S. economic and trade sanctions programs targeting specific countries, entities, and individuals

OFAC administers U.S. economic and trade sanctions programs based on foreign policy and national security goals, targeting countries, regimes, terrorists, drug traffickers, and proliferators.

Question 15: What is the compliance officer's role in an ethics hotline program?

To personally investigate every hotline report without delegation
To ensure the hotline is accessible, confidential, and that reports are properly triaged and investigated (Correct answer)
To discourage use of the hotline to reduce workload
To share all hotline reports directly with regulators quarterly

Correct answer: To ensure the hotline is accessible, confidential, and that reports are properly triaged and investigated

The compliance officer ensures the hotline is operational, confidential, non-retaliatory, and that all reports receive appropriate follow-up and investigation.

Question 16: When a company employee invokes their Fifth Amendment right during a government investigation, what risk does the company face?

The employee must be immediately terminated to avoid obstruction liability
The company loses all attorney-client privilege over related documents
The government may draw adverse inferences against the company in civil proceedings (Correct answer)
The company is automatically deemed an uncooperating party by the DOJ

Correct answer: The government may draw adverse inferences against the company in civil proceedings

While individuals have Fifth Amendment rights, in civil proceedings the government and courts may draw adverse inferences from employee invocations in ways that can harm the company.

Question 17: What is the standard maximum fine for a GDPR violation categorized as a Tier 2 infringement (most serious)?

€10 million or 2% of global annual turnover
€50 million or 5% of global annual turnover
€20 million or 4% of global annual turnover (Correct answer)
€100 million or 10% of global annual turnover

Correct answer: €20 million or 4% of global annual turnover

GDPR Tier 2 violations, such as breaching core principles or data subject rights, carry fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher.

Question 18: What role does continuous improvement play in government investigation response for CCCP certified professionals?

It applies only to new professionals in their first year
It is optional and only necessary during certification renewal
It focuses exclusively on cost reduction
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in government investigation response, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 19: A compliance team implements a control requiring supervisory approval for all wire transfers above $50,000. This is an example of which control type?

Corrective control
Detective control
Compensating control
Preventive control (Correct answer)

Correct answer: Preventive control

A preventive control is designed to stop an undesirable event from occurring before it happens, such as requiring approval before a transaction is executed.

Question 20: Which assessment technique involves anonymously surveying employees about their perceptions of the ethical culture and compliance program?

Control self-assessment
Tone-at-the-top audit
Gap analysis
Culture survey or ethics climate survey (Correct answer)

Correct answer: Culture survey or ethics climate survey

Culture or ethics climate surveys gather employee perceptions of organizational values, leadership behavior, and willingness to report concerns.

Question 21: Under the Federal Sentencing Guidelines, which factor related to board oversight can MOST significantly reduce an organization's culpability score?

Maintaining a compliance hotline that is never used
Publishing an annual CSR report
Demonstrated high-level personnel responsibility for and oversight of an effective compliance program (Correct answer)
Having a large legal department

Correct answer: Demonstrated high-level personnel responsibility for and oversight of an effective compliance program

The Guidelines reward organizations where high-level personnel exercise genuine oversight of compliance, reducing culpability and potential fines.

Question 22: When a CCCP professional encounters an unfamiliar challenge in board & executive communication, what is the recommended first course of action?

Postpone addressing the issue indefinitely
Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Apply the solution used for the most recent similar problem without adaptation
Proceed based on personal intuition alone

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 23: Which factor most significantly elevates the compliance risk associated with a foreign third-party agent?

The agent charges above-market commission rates
The agent uses a non-U.S. bank account for payment
The agent operates in a high-corruption-index country and interacts with foreign government officials (Correct answer)
The agent's contract is governed by foreign law

Correct answer: The agent operates in a high-corruption-index country and interacts with foreign government officials

A foreign agent who interacts with government officials in a high-corruption environment is a classic FCPA risk scenario requiring enhanced due diligence.

Question 24: Which of the following best describes 'tone at the top' in the context of ethics and compliance?

The number of compliance policies issued each quarter
The ratio of ethics training hours to total work hours
The volume of compliance communications sent to employees
Senior leadership's visible commitment to ethical behavior and compliance values (Correct answer)

Correct answer: Senior leadership's visible commitment to ethical behavior and compliance values

'Tone at the top' refers to the demonstrated commitment of senior leadership to ethical conduct, which shapes the entire organization's compliance culture.

Question 25: When presenting a sensitive government subpoena to the board, the CCO should coordinate PRIMARILY with:

The marketing department to manage public messaging
Outside counsel and the audit committee chair before any broader disclosure (Correct answer)
All department heads simultaneously
The company's largest investor before board notification

Correct answer: Outside counsel and the audit committee chair before any broader disclosure

Government subpoenas require immediate coordination with outside counsel and audit committee leadership to manage legal risk and privilege.

Question 26: Why is third-party due diligence considered a critical component of a CCCP-level compliance program?

Because third parties are immune from U.S. law enforcement
Because organizations can be held liable for the misconduct of their third parties under laws like the FCPA (Correct answer)
Because third-party contracts always require external legal counsel
Because vendor invoices must be approved by the compliance officer

Correct answer: Because organizations can be held liable for the misconduct of their third parties under laws like the FCPA

The FCPA and other U.S. laws impose liability on companies for third-party misconduct conducted on their behalf, making due diligence essential.

Question 27: Under HIPAA, a covered entity's Notice of Privacy Practices (NPP) must be provided to patients:

Only when the entity changes its privacy policies
At every subsequent healthcare encounter
No later than the date of first service delivery (Correct answer)
Only upon patient request

Correct answer: No later than the date of first service delivery

Covered entities must provide the NPP no later than the date of first service delivery to a new patient, with good-faith efforts to obtain written acknowledgment.

Question 28: What is a 'compliance program maturity model' used for?

Calculating the cost savings from compliance investments
Determining whether the compliance officer has sufficient professional experience
Benchmarking a program against defined developmental stages to identify areas for improvement (Correct answer)
Measuring how long employees have been participating in compliance training

Correct answer: Benchmarking a program against defined developmental stages to identify areas for improvement

A maturity model provides a structured framework to assess a compliance program's current developmental stage and guide it toward higher levels of effectiveness.

Question 29: Under the Foreign Corrupt Practices Act (FCPA), what constitutes a 'government official' for purposes of the anti-bribery provisions?

Any officer or employee of a foreign government or public international organization, or any person acting in an official capacity (Correct answer)
Officials of governments with which the U.S. has bilateral anti-corruption treaties
Foreign government officials at the federal level only, excluding state and local officials
Only elected officials and cabinet-level appointees of foreign national governments

Correct answer: Any officer or employee of a foreign government or public international organization, or any person acting in an official capacity

The FCPA's definition of 'foreign official' is broad, encompassing any officer or employee of a foreign government at any level, state-owned enterprises, or public international organizations.

Question 30: A compliance officer wants to ensure the board understands the company's ethics hotline trend data. Which approach is MOST effective?

Show year-over-year trends, category breakdowns, and benchmarks against industry peers (Correct answer)
Summarize all cases in a single aggregate number to protect privacy
Present raw call volume numbers without context or comparison
Only report cases that resulted in terminations

Correct answer: Show year-over-year trends, category breakdowns, and benchmarks against industry peers

Trend data with industry benchmarks gives the board meaningful context to evaluate hotline effectiveness and culture health.

Question 31: Under the Export Administration Regulations (EAR), what is the 'de minimis rule' used to determine?

Whether a violation is subject to criminal versus civil penalties
Whether a foreign-produced item containing US-origin content requires a US export license (Correct answer)
The minimum dollar threshold for filing Electronic Export Information (EEI)
The amount of controlled technology a traveler may carry abroad without authorization

Correct answer: Whether a foreign-produced item containing US-origin content requires a US export license

The EAR's de minimis rule determines whether foreign-produced items incorporating controlled US-origin content exceed certain percentage thresholds (10% or 25%) that would subject the foreign item to EAR jurisdiction.

Question 32: A multinational company transfers EU personal data to its U.S. parent company. Following the invalidation of Privacy Shield, which mechanism is most commonly used to legitimize this transfer?

Standard Contractual Clauses (SCCs) (Correct answer)
A written consent form from each data subject
An adequacy decision from the EU Commission
Binding Corporate Rules (BCRs) only

Correct answer: Standard Contractual Clauses (SCCs)

Standard Contractual Clauses (SCCs) are the most widely used mechanism for lawful data transfers from the EU to non-adequate third countries, providing contractual safeguards approved by the European Commission.

Question 33: A new board director with no compliance background asks the CCO to explain why a regulatory fine was classified as 'low risk' in the annual report. The CCO's BEST response is:

Dismiss the question as outside the director's expertise
Provide only the fine dollar amount and move on
Redirect the director to read the SEC filing without further explanation
Explain the risk classification criteria, the fine's magnitude relative to thresholds, and remediation status (Correct answer)

Correct answer: Explain the risk classification criteria, the fine's magnitude relative to thresholds, and remediation status

New directors deserve clear explanations of risk classification methodology to perform their oversight function effectively.

Question 34: Under the Dodd-Frank whistleblower program, an employee who first reports internally before going to the SEC is treated as if they reported to the SEC on which date?

The date the SEC receives the complaint
The date of the internal report, provided they report to the SEC within 120 days (Correct answer)
The date the employer completes its internal investigation
The date the employee retains legal counsel

Correct answer: The date of the internal report, provided they report to the SEC within 120 days

SEC rules allow whistleblowers who first report internally to receive credit as of their internal report date if they subsequently report to the SEC within 120 days.

Question 35: What is the purpose of a 'privilege log' in responding to a government subpoena?

A chronological record of all communications with the government regarding the investigation
A log identifying documents withheld from production and the specific privilege claimed for each (Correct answer)
A list of all outside counsel retained during the investigation for disclosure to regulators
A record of all documents shared with the government to track production completeness

Correct answer: A log identifying documents withheld from production and the specific privilege claimed for each

A privilege log must identify each withheld document by description, date, author, and recipient, and state the privilege claimed, allowing the government to challenge specific assertions.

Question 36: Which of the following is an example of a 'detective' rather than a 'preventive' internal control?

Encrypting sensitive data at rest
Conducting monthly bank reconciliations (Correct answer)
Requiring dual signatures on checks above $10,000
Blocking unauthorized websites through a firewall

Correct answer: Conducting monthly bank reconciliations

Monthly bank reconciliations detect discrepancies that have already occurred, making them a detective control, whereas the other options prevent problems before they happen.

Question 37: Which of the following is a recognized 'red flag' indicating a weak ethics culture within an organization?

High volume of hotline reports relative to employee count
Low near-miss reporting combined with high actual incident rates (Correct answer)
Frequent ethics training completion rates above 95%
Compliance officer reporting directly to the board audit committee

Correct answer: Low near-miss reporting combined with high actual incident rates

Low near-miss reporting with high actual incidents suggests employees are not surfacing concerns early, a key indicator of a weak speak-up culture.

Question 38: A board director contacts the CCO directly to request a personal briefing on a regulatory matter before the full board meeting. The CCO should:

Forward all compliance records to the director without review
Provide a full briefing immediately without informing other directors
Refuse all pre-meeting contact with individual directors
Consult with the board chair and general counsel before conducting an individual briefing (Correct answer)

Correct answer: Consult with the board chair and general counsel before conducting an individual briefing

Pre-meeting briefings with individual directors can create information asymmetry; coordination with leadership ensures appropriate governance.

Question 39: Which internal audit standard requires internal auditors to be independent of the activities they audit?

COSO Internal Control — Integrated Framework
ISO 31000 Risk Management Guidelines
PCAOB Auditing Standards
IIA International Standards for the Professional Practice of Internal Auditing (Correct answer)

Correct answer: IIA International Standards for the Professional Practice of Internal Auditing

The IIA International Standards specifically mandate organizational independence for internal audit functions to ensure objective and unbiased assessments.

Question 40: An organization stores credit card numbers and wants to reduce PCI DSS scope. Which method replaces card data with a randomly generated surrogate value that retains no exploitable value?

Masking
Hashing
Tokenization (Correct answer)
Truncation

Correct answer: Tokenization

Tokenization substitutes sensitive card data with a non-sensitive token that has no exploitable value, effectively reducing the systems that fall within PCI DSS scope.

Question 41: Under the Upjohn warnings, what must company counsel tell an employee before conducting an internal investigation interview?

The employee must answer all questions or face termination
The interview is confidential and cannot be shared with government investigators
The employee has a right to receive a copy of the interview transcript
The attorney represents the company, not the employee, and may share information with management (Correct answer)

Correct answer: The attorney represents the company, not the employee, and may share information with management

Upjohn warnings inform employees that company counsel represents the company's interests, not theirs, and that the company controls the privilege and may disclose the interview contents.

Question 42: A healthcare compliance risk assessment should be conducted:

Only when required by an active OIG Corporate Integrity Agreement
Once at program inception and never again unless a breach occurs
Periodically and whenever significant operational or regulatory changes occur (Correct answer)
Exclusively by external auditors to ensure independence

Correct answer: Periodically and whenever significant operational or regulatory changes occur

Effective compliance programs require periodic risk assessments that are also triggered by material changes in operations, laws, or enforcement priorities.

Question 43: Which federal agency administers the CFTC Whistleblower Program, which parallels the SEC program for commodity market fraud?

The Financial Industry Regulatory Authority
The Department of Justice
The Commodity Futures Trading Commission (Correct answer)
The Federal Reserve

Correct answer: The Commodity Futures Trading Commission

The CFTC operates its own whistleblower program under the Commodity Exchange Act, awarding 10-30% of sanctions exceeding $1 million for original information about commodity fraud.

Question 44: Which antitrust remedy allows a merger to proceed after regulators identify competitive concerns in a specific market segment?

Payment of a civil monetary penalty to the DOJ
Consent decree with divestiture of overlapping business units (Correct answer)
Voluntary withdrawal of the merger filing
Submission of an amended LOI to the FTC

Correct answer: Consent decree with divestiture of overlapping business units

Regulators frequently permit mergers to close after the parties agree to divest overlapping assets to preserve market competition via a consent decree.

Question 45: When evaluating compliance program effectiveness after a significant violation, the DOJ will consider whether the company 'detected the misconduct.' Which program element primarily enables detection?

A written code of conduct
Monitoring, auditing, and reporting mechanisms (Correct answer)
Anti-retaliation training for managers
Executive compensation clawback policies

Correct answer: Monitoring, auditing, and reporting mechanisms

Monitoring, auditing, and internal reporting channels are the primary mechanisms that enable companies to detect compliance violations.

Question 46: In designing ethics training for U.S. employees, which approach is most effective according to compliance best practices?

Annual all-hands lecture covering the entire Code of Conduct in one session
Role-based, scenario-driven training delivered in regular, manageable intervals (Correct answer)
Training that focuses exclusively on legal penalties for violations
One-time onboarding training with no refresher requirements

Correct answer: Role-based, scenario-driven training delivered in regular, manageable intervals

Role-based, scenario-driven training delivered regularly is more effective because it is relevant to employees' actual work situations and improves retention.

Question 47: What is 'ongoing monitoring' in a third-party compliance program, and why is it required?

Continuous or periodic reassessment of third-party risk throughout the relationship to detect emerging issues (Correct answer)
Monitoring the vendor's social media accounts for negative press
An annual certification from the third party that they have no compliance violations
A one-time review conducted at contract signing

Correct answer: Continuous or periodic reassessment of third-party risk throughout the relationship to detect emerging issues

Ongoing monitoring recognizes that third-party risk changes over time and that initial due diligence alone is insufficient to manage a dynamic risk relationship.

Question 48: Why is documentation important in compliance programs?

To limit transparency.
To bypass legal review.
To create confusion.
To support audits and demonstrate efforts (Correct answer)

Correct answer: To support audits and demonstrate efforts

Documentation is crucial in compliance programs because it provides tangible evidence of an organization's efforts to meet legal and ethical obligations. Well-maintained records support internal and external audits, demonstrating due diligence and accountability. This documentation is essential for proving compliance to regulatory bodies and defending against potential legal challenges.

Question 49: The 'original source' exception to the FCA's public disclosure bar requires the relator to have:

Obtained the information through a government FOIA request
Filed a prior complaint with a federal agency
Worked for the defendant for at least one year
Direct and independent knowledge of the information on which the allegations are based (Correct answer)

Correct answer: Direct and independent knowledge of the information on which the allegations are based

To qualify as an original source, the relator must have direct and independent knowledge of the underlying facts and must have voluntarily provided that information to the government before filing.

Question 50: A company's code of conduct is MOST effective when it:

Is updated only when a regulatory violation occurs
Is written solely by the legal department without business input
Is communicated, trained, and enforced consistently at all levels (Correct answer)
Contains absolute prohibitions only, with no guidance on gray areas

Correct answer: Is communicated, trained, and enforced consistently at all levels

A code of conduct must be consistently communicated, trained, and enforced to drive actual behavioral change.

Question 51: What is the key distinction between a 'subject' and a 'target' in a grand jury investigation?

Targets have substantial evidence of guilt against them while subjects are under investigation but guilt is less certain (Correct answer)
Subjects have been formally charged while targets have not yet appeared before the grand jury
Subjects receive immunity while targets are eligible for deferred prosecution agreements
There is no legal distinction; the terms are used interchangeably by the DOJ

Correct answer: Targets have substantial evidence of guilt against them while subjects are under investigation but guilt is less certain

A 'target' is someone for whom the grand jury has substantial evidence of guilt, while a 'subject' is someone whose conduct is within the investigation's scope but against whom there is less evidence.

Question 52: When a CCCP professional encounters an unfamiliar challenge in healthcare compliance & hipaa, what is the recommended first course of action?

Proceed based on personal intuition alone
Postpone addressing the issue indefinitely
Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Apply the solution used for the most recent similar problem without adaptation

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 53: What is the primary purpose of a corporate Code of Conduct in a CCCP-certified compliance program?

To serve as the sole disciplinary policy for misconduct
To articulate the organization's values, principles, and behavioral expectations (Correct answer)
To establish legally binding contracts with employees
To replace the need for a formal compliance training program

Correct answer: To articulate the organization's values, principles, and behavioral expectations

A Code of Conduct articulates the organization's core values and sets clear behavioral expectations for all employees and stakeholders.

Question 54: A compliance officer is reviewing vendor contracts for data processing agreements. Under GDPR Article 28, which element is NOT required in a data processing agreement?

The processor's right to subcontract without controller notice (Correct answer)
Subject matter and duration of processing
Security measures the processor must implement
Instructions for returning or deleting data after processing ends

Correct answer: The processor's right to subcontract without controller notice

GDPR Article 28 requires processors to obtain prior written authorization from the controller before engaging sub-processors, not a unilateral right to subcontract.

Question 55: Who is typically responsible for overseeing compliance programs?

Compliance officers (Correct answer)
Legal assistants.
Marketing directors.
Product engineers.

Correct answer: Compliance officers

Compliance officers are specifically designated professionals responsible for designing, implementing, and overseeing an organization's compliance program. They monitor adherence to laws, regulations, and internal policies, investigate potential violations, and provide guidance to ensure the company operates ethically and legally. Their role is central to maintaining a strong compliance culture.

Question 56: What are internal controls?

Controls for holiday scheduling.
Software update protocols.
Procedures for external marketing.
Mechanisms to support compliance and accuracy (Correct answer)

Correct answer: Mechanisms to support compliance and accuracy

Internal controls are processes, policies, and procedures implemented by an organization to ensure the integrity of financial and accounting information, promote operational efficiency, and encourage adherence to laws and regulations. They act as safeguards to prevent errors, fraud, and non-compliance, thereby supporting the achievement of organizational objectives. Examples include segregation of duties and authorization procedures.

Question 57: What is the significance of 'right to audit' clauses in vendor contracts from a compliance perspective?

They transfer financial liability to the vendor for any regulatory fines
They give the company the contractual right to examine the vendor's books and practices to verify compliance (Correct answer)
They require the vendor to conduct self-audits and submit results quarterly
They allow the company to unilaterally modify contract pricing

Correct answer: They give the company the contractual right to examine the vendor's books and practices to verify compliance

Right-to-audit clauses enable the company to independently verify that third parties are actually complying with their contractual compliance obligations.

Question 58: A compliance officer is reviewing employment contracts of key target employees post-LOI. Which clause is most relevant to M&A compliance continuity?

Vacation accrual policy
Health insurance benefit elections
Office location preferences
Non-compete and change-of-control provisions (Correct answer)

Correct answer: Non-compete and change-of-control provisions

Change-of-control clauses may trigger severance or allow employees to exit, while non-competes affect talent retention and competitive risk post-close.

Question 59: Which of the following best describes a key competency required for false claims act & whistleblower laws in CCCP practice?

Strong analytical skills combined with effective communication and ethical judgment (Correct answer)
Reliance on a single methodology for all situations
The ability to work independently without any oversight
Memorization of all relevant regulations without understanding context

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

CCCP professionals working in false claims act & whistleblower laws need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 60: Which of the following BEST describes a 'compliance program gap analysis'?

A legal review of all contracts signed in the past year
A training needs assessment for new hires
A review comparing current compliance controls against required or best-practice standards (Correct answer)
An audit of employee expense reports for potential fraud

Correct answer: A review comparing current compliance controls against required or best-practice standards

A gap analysis compares the organization's existing compliance program elements against regulatory requirements or industry best practices to identify deficiencies.

Question 61: Which of the following best describes a key competency required for board & executive communication in CCCP practice?

Reliance on a single methodology for all situations
The ability to work independently without any oversight
Memorization of all relevant regulations without understanding context
Strong analytical skills combined with effective communication and ethical judgment (Correct answer)

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

CCCP professionals working in board & executive communication need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 62: Under the COSO ERM framework, which component involves identifying events that may affect the organization's ability to achieve its objectives?

Control activities
Risk response
Event identification (Correct answer)
Risk assessment

Correct answer: Event identification

Event identification is the COSO ERM component focused on recognizing potential internal and external events that could impact organizational objectives.

Question 63: A compliance officer notices that a key control has not been tested in 18 months due to staff turnover. This situation BEST represents which type of risk?

Reputational risk
Operational risk — people and process failure (Correct answer)
Strategic risk
Systemic risk

Correct answer: Operational risk — people and process failure

The failure to execute a control due to staff turnover is an operational risk arising from inadequate people and process management within the compliance function itself.

Question 64: The board is evaluating whether to enter a new high-risk market. What compliance input should the CCO provide BEFORE the decision?

Only confirm whether the market is legal in principle
Delegate the entire analysis to the business development team
A pre-entry compliance risk assessment covering regulatory environment, enforcement trends, and program readiness gaps (Correct answer)
Wait until after entry to identify compliance requirements

Correct answer: A pre-entry compliance risk assessment covering regulatory environment, enforcement trends, and program readiness gaps

Pre-entry compliance risk assessments enable the board to make fully informed strategic decisions with knowledge of regulatory exposure and resource requirements.

Question 65: What role does 'values-based compliance' play alongside 'rules-based compliance' in a CCCP framework?

Values-based compliance motivates ethical behavior from internal principles, complementing rule-based deterrence (Correct answer)
Values-based compliance replaces the need for written policies
Values-based compliance applies only to senior leadership
Values-based compliance is relevant only in non-profit organizations

Correct answer: Values-based compliance motivates ethical behavior from internal principles, complementing rule-based deterrence

Values-based compliance builds intrinsic motivation for ethical behavior, while rules-based compliance provides clear boundaries — together they create a more resilient program.

Question 66: During a board meeting, a director asks the CCO a question about a specific employee investigation. The CCO should:

Answer fully in open session to demonstrate transparency
Provide all investigation documents to the full board immediately
Defer to counsel and offer to discuss in executive session to protect confidentiality (Correct answer)
Decline to answer and leave the meeting

Correct answer: Defer to counsel and offer to discuss in executive session to protect confidentiality

Active investigations require confidentiality protections; executive session with counsel preserves privilege and prevents prejudice.

Question 67: A company discovers that its subsidiary in another country has been making undocumented cash payments to local officials. Under the FCPA's books-and-records provision, what is the primary obligation?

Ensure the payments are accurately recorded in the company's books and records (Correct answer)
Seek a voluntary disclosure agreement with the DOJ before recording any transactions
Report the subsidiary's conduct to local law enforcement immediately
Terminate the subsidiary's management without investigation

Correct answer: Ensure the payments are accurately recorded in the company's books and records

The FCPA's accounting provisions require issuers to maintain books and records that accurately and fairly reflect all transactions, including improper payments by subsidiaries.

Question 68: What is the primary role of a compliance monitor appointed as part of a DPA or NPA settlement?

To approve all major business transactions during the monitoring period
To conduct ongoing criminal investigations into company employees on the government's behalf
To independently assess and report on the company's compliance program and remediation efforts (Correct answer)
To manage day-to-day business operations on behalf of the government during the agreement period

Correct answer: To independently assess and report on the company's compliance program and remediation efforts

A compliance monitor independently evaluates whether the company is meeting its obligations under the agreement, reporting findings to the government without managing company operations.

Question 69: What is a 'civil investigative demand' (CID) and which agency commonly uses it?

A subpoena issued by the FBI requiring testimony before a federal grand jury
A pre-litigation discovery tool used by agencies like the DOJ and FTC to compel document production (Correct answer)
A court order requiring companies to produce trade secrets in antitrust proceedings
An administrative summons issued by the IRS to compel financial record production

Correct answer: A pre-litigation discovery tool used by agencies like the DOJ and FTC to compel document production

A CID is a compulsory pre-suit discovery tool used by agencies such as the DOJ and FTC that requires recipients to produce documents, answer interrogatories, or provide testimony without filing a lawsuit.

Question 70: How should a compliance officer respond when a business unit resists implementing third-party due diligence requirements, citing deal speed?

Explain the legal and reputational risks, offer streamlined processes for lower-risk situations, and escalate irreconcilable conflicts (Correct answer)
Defer entirely to the business unit's commercial judgment
Require all future vendor contracts to go through a six-month review process
Waive due diligence requirements for time-sensitive deals

Correct answer: Explain the legal and reputational risks, offer streamlined processes for lower-risk situations, and escalate irreconcilable conflicts

The compliance officer must educate on risk, offer practical efficiency solutions, and escalate when business pressure threatens to override necessary controls.

Question 71: When a compliance officer discovers a material regulatory violation, what is the MOST appropriate initial escalation path to the board?

Wait until the next scheduled board meeting to avoid alarm
Report directly to external regulators before informing the board
Notify the audit committee chair first, then determine if full board disclosure is needed (Correct answer)
Email all board members simultaneously without prior notice

Correct answer: Notify the audit committee chair first, then determine if full board disclosure is needed

The audit committee chair is the designated first contact for material compliance issues, enabling structured escalation and privilege protection.

Question 72: Which of the following best represents a 'leading indicator' of compliance program effectiveness?

Employee turnover rate in the compliance department
Number of lawsuits settled in the past 18 months
Number of regulatory fines paid last year
Percentage of high-risk employees completing annual training (Correct answer)

Correct answer: Percentage of high-risk employees completing annual training

Leading indicators, like training completion rates among high-risk roles, predict future compliance outcomes rather than measuring past failures.

Question 73: What is the result of failing to comply with regulations?

Government awards.
Fewer audits.
Legal penalties and reputation loss (Correct answer)
Market monopoly.

Correct answer: Legal penalties and reputation loss

Failing to comply with regulations can lead to severe consequences for an organization. These often include significant legal penalties such as fines, sanctions, and even imprisonment for individuals, alongside potential operational restrictions. Furthermore, non-compliance severely damages a company's reputation, eroding public trust and potentially leading to loss of customers and market share.

Question 74: What is 'middle management squeeze' in the context of corporate ethics programs?

A regulatory requirement for mid-level manager certification in ethics
Pressure on middle managers caught between upper management demands and frontline ethical concerns (Correct answer)
Budget constraints that limit compliance training for managers
The challenge of delivering ethics content to employees across multiple time zones

Correct answer: Pressure on middle managers caught between upper management demands and frontline ethical concerns

Middle managers often face pressure from above to meet targets while also fielding ethical concerns from below, making them a critical and vulnerable compliance layer.

Question 75: When a company undergoes a major reorganization, what is the compliance officer's immediate responsibility regarding the Code of Conduct?

Reissue the existing Code of Conduct without changes to save time
Assess whether the reorganization creates new risk areas requiring updates to policies, training, and reporting lines (Correct answer)
Transfer all Code of Conduct oversight to Human Resources permanently
Suspend the Code of Conduct until the reorganization is complete

Correct answer: Assess whether the reorganization creates new risk areas requiring updates to policies, training, and reporting lines

Reorganizations often create new reporting structures, risk exposures, and accountability gaps that require prompt compliance program reassessment.

Question 76: Under the concept of 'compliance program effectiveness,' what does 'operationalization' mean?

Hiring a dedicated compliance operations manager
Publishing compliance policies on the company website
Embedding compliance requirements into day-to-day business processes and decision-making (Correct answer)
Establishing a compliance operations center in a low-risk jurisdiction

Correct answer: Embedding compliance requirements into day-to-day business processes and decision-making

Operationalization means integrating compliance controls and expectations directly into business workflows so that compliance occurs naturally as part of normal operations.

Question 77: Under the U.S. Federal Sentencing Guidelines, which factor related to a Code of Conduct can reduce an organization's culpability score?

Distributing the Code of Conduct only to managerial employees
Implementing and communicating standards of conduct effectively to all personnel (Correct answer)
Publishing the Code of Conduct on the company's public website only
Having a Code of Conduct written exclusively by outside counsel

Correct answer: Implementing and communicating standards of conduct effectively to all personnel

The Federal Sentencing Guidelines reward organizations that implement effective compliance programs, including communicating standards to all personnel.

Question 78: Who is responsible for ethical oversight in a corporation?

Sales team.
Board of directors (Correct answer)
Shareholders only.
Customers.

Correct answer: Board of directors

The board of directors holds ultimate responsibility for ethical oversight within a corporation. They are tasked with setting the ethical tone at the top, approving the code of conduct, establishing mechanisms for ethical reporting, and ensuring that management implements and maintains an effective ethics and compliance program. The board's role is crucial in guiding the company's moral compass and ensuring adherence to ethical standards.

Question 79: In measuring compliance program effectiveness, what does a high 'substantiation rate' on hotline reports typically indicate?

The company has an unusually large number of compliance problems
The investigative team is biased toward finding violations
Reported concerns are generally credible and the reporting culture is healthy (Correct answer)
Employees are filing too many frivolous complaints

Correct answer: Reported concerns are generally credible and the reporting culture is healthy

A reasonable substantiation rate indicates that reporters are raising genuine concerns rather than making bad-faith or trivial complaints.

Question 80: Under the SEC's cybersecurity disclosure rules effective December 2023, public companies must report material cybersecurity incidents within how many business days on Form 8-K?

72 hours
30 calendar days
10 business days
4 business days (Correct answer)

Correct answer: 4 business days

The SEC's 2023 cybersecurity rules require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining the incident is material.

Question 81: Which term describes the process of ranking risks by their significance to prioritize compliance resources?

Risk scoring
Risk prioritization (Correct answer)
Risk mapping
Risk stratification

Correct answer: Risk prioritization

Risk prioritization is the process of ranking identified risks by their relative significance (likelihood × impact) to focus limited compliance resources on the most critical areas.

Question 82: During a compliance effectiveness review, which finding would most suggest that the compliance function lacks organizational independence?

Compliance investigations are reviewed and approved by the business unit being investigated (Correct answer)
The CCO reports directly to the CEO and the board
Compliance staff rotate across different business units
The compliance team participates in business development meetings

Correct answer: Compliance investigations are reviewed and approved by the business unit being investigated

Allowing a business unit to control or approve its own investigations creates a structural conflict that compromises compliance independence.

Question 83: Which metric is most useful for measuring the effectiveness of an ethics and Code of Conduct program?

Number of pages in the Code of Conduct
Combination of hotline utilization rates, substantiation rates, repeat violations, and employee survey data (Correct answer)
Training completion rates alone
Number of disciplinary actions taken per quarter

Correct answer: Combination of hotline utilization rates, substantiation rates, repeat violations, and employee survey data

Effective measurement combines multiple data points — hotline usage, substantiation rates, recidivism, and survey sentiment — to assess true program health.

Question 84: Which governance mechanism MOST directly aligns executive compensation with long-term shareholder value?

Equity vesting schedules with multi-year cliff periods (Correct answer)
Annual cash bonuses tied to revenue targets
Salary benchmarking against industry peers
Per-meeting director fees

Correct answer: Equity vesting schedules with multi-year cliff periods

Multi-year equity vesting ties executive wealth to sustained stock performance, aligning incentives with long-term shareholder value.

Question 85: Under Sarbanes-Oxley Section 302, the CEO and CFO must certify that:

They have reviewed the report and it does not contain materially false statements (Correct answer)
The company has zero material weaknesses in internal controls
All board members have read and approved the financial statements
External auditors have confirmed accuracy of all disclosures

Correct answer: They have reviewed the report and it does not contain materially false statements

SOX 302 requires the CEO and CFO to personally certify that the quarterly or annual report does not contain material misstatements.

Question 86: The OIG's seven elements of an effective compliance program include all of the following EXCEPT:

Establishing a guaranteed whistleblower immunity program (Correct answer)
Implementing written policies and procedures
Conducting internal monitoring and auditing
Conducting effective training and education

Correct answer: Establishing a guaranteed whistleblower immunity program

The OIG's seven elements do not include a guaranteed whistleblower immunity program; they focus on policies, training, communication, monitoring, enforcement, response, and standards.

Question 87: A company implements job rotation for employees in sensitive financial roles. The PRIMARY compliance benefit of this practice is:

Reducing operational costs through cross-training
Satisfying mandatory regulatory staffing requirements
Detecting or deterring fraud by limiting prolonged control of one area (Correct answer)
Improving employee skill development

Correct answer: Detecting or deterring fraud by limiting prolonged control of one area

Mandatory job rotation reduces the opportunity for fraud by preventing any single employee from maintaining long-term, unchecked control over a sensitive function.

Question 88: A company implements a new third-party due diligence process. Which risk is this control MOST directly designed to mitigate?

Insider trading by employees
Bribery or misconduct by vendors, agents, or partners acting on behalf of the company (Correct answer)
Harassment complaints within the workplace
Inaccurate financial reporting

Correct answer: Bribery or misconduct by vendors, agents, or partners acting on behalf of the company

Third-party due diligence is specifically designed to assess and mitigate the risk that vendors, agents, or partners may expose the company to corruption or other compliance violations.

Question 89: How often should a corporate Code of Conduct be reviewed and updated according to best compliance practices?

Only upon CEO or board turnover
Periodically, typically annually or when significant regulatory or business changes occur (Correct answer)
Only when a regulatory violation occurs
Every 10 years or upon merger

Correct answer: Periodically, typically annually or when significant regulatory or business changes occur

Best practice requires periodic review — often annually — and updates whenever material regulatory, legal, or business changes occur.

Question 90: What is the significance of the 'McNulty Memo' in the context of corporate privilege during investigations?

It defined the criteria for designating a company as a 'repeat offender' under federal guidelines
It limited DOJ prosecutors from routinely requesting privilege waivers as a condition of cooperation credit (Correct answer)
It created the framework for corporate monitors in deferred prosecution agreements
It established that companies must waive privilege to receive cooperation credit from the DOJ

Correct answer: It limited DOJ prosecutors from routinely requesting privilege waivers as a condition of cooperation credit

The McNulty Memo (2006) and subsequent Filip Memo (2008) restricted prosecutors from routinely demanding privilege waivers, recognizing that such demands threatened the integrity of the attorney-client relationship.

Question 91: A board member shares a confidential compliance report with a personal friend who is a major shareholder. This MOST likely violates:

Fiduciary duties, confidentiality obligations, and potentially securities laws on selective disclosure (Correct answer)
No rule, since shareholders have a right to all company information
The company's social media policy only
The company's travel and expense policy

Correct answer: Fiduciary duties, confidentiality obligations, and potentially securities laws on selective disclosure

Directors have fiduciary duties of confidentiality, and selective disclosure of material non-public information can trigger Reg FD and insider trading violations.

Question 92: A compliance officer presenting to the board should ideally conclude with:

A disclaimer that no assurances can be given about any compliance matter
A clear summary of key risks, decisions needed, and proposed next steps (Correct answer)
A request that the board delegate all compliance decisions back to management
A lengthy Q&A session covering every possible follow-up topic

Correct answer: A clear summary of key risks, decisions needed, and proposed next steps

Ending with clear decisions needed and next steps focuses board attention and drives actionable outcomes from compliance presentations.

Question 93: When preparing board materials on a new regulatory requirement, the compliance officer should PRIMARILY focus on:

Legal definitions and statutory language verbatim
Detailed legislative history and committee debates
Competitor responses to the regulation only
Business impact, gap assessment, required resources, and implementation timeline (Correct answer)

Correct answer: Business impact, gap assessment, required resources, and implementation timeline

Board members need to understand operational impact and resource requirements to fulfill their oversight and decision-making roles.

Question 94: When a CCCP professional encounters an unfamiliar challenge in compliance effectiveness assessment, what is the recommended first course of action?

Postpone addressing the issue indefinitely
Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Apply the solution used for the most recent similar problem without adaptation
Proceed based on personal intuition alone

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 95: An e-commerce company wants to track website visitors across multiple sites using persistent identifiers. Under GDPR's ePrivacy rules and many state laws, this typically requires:

Only a privacy policy disclosure
Explicit consent before placing non-essential tracking cookies (Correct answer)
Opt-out mechanism within 30 days of first visit
Annual renewal of terms of service agreement

Correct answer: Explicit consent before placing non-essential tracking cookies

Non-essential cookies and tracking technologies used for advertising or analytics require prior, informed, and freely given consent under GDPR and similar privacy regulations.

Question 96: A compliance officer discovers that a business unit is pressuring employees to meet targets in ways that may violate policy. What is the MOST appropriate first step?

Immediately suspend the business unit's operations
Issue a company-wide memo warning against policy violations
Report the issue directly to regulators without internal escalation
Escalate the concern to senior leadership or the board audit committee (Correct answer)

Correct answer: Escalate the concern to senior leadership or the board audit committee

The compliance officer should escalate to senior leadership or the board's audit committee to ensure proper investigation before taking external action.

Question 97: Who is responsible for managing organizational risk?

Middle managers only.
Receptionists.
External auditors.
Senior management (Correct answer)

Correct answer: Senior management

While risk management is a responsibility shared across an organization, senior management, including the board of directors and executive leadership, holds ultimate accountability. They are responsible for establishing the organization's risk appetite, setting the overall risk management strategy, and ensuring adequate resources are allocated to identify, assess, and mitigate risks effectively. Their leadership is crucial for embedding a risk-aware culture.

Question 98: Which element is considered most essential when drafting an effective Code of Conduct under U.S. compliance standards?

Clear, plain-language guidance applicable to real workplace scenarios (Correct answer)
Detailed descriptions of criminal penalties for each violation
Signatures from all board members on every page
Extensive legal citations and statutory references

Correct answer: Clear, plain-language guidance applicable to real workplace scenarios

An effective Code of Conduct uses plain language and practical examples so employees at all levels can understand and apply the standards.

Question 99: A compliance officer discovers that a third-party sales agent in a high-risk market has failed to maintain records of government interactions as required by contract. What is the most appropriate immediate response?

Report the agent to local authorities without conducting an internal review
Terminate the agent immediately without further investigation
Waive the contractual requirement given local business norms
Issue a written notice of breach, suspend new business referrals, and conduct an audit of the agent's activities (Correct answer)

Correct answer: Issue a written notice of breach, suspend new business referrals, and conduct an audit of the agent's activities

A measured response of formal notice, suspension of new activities, and audit preserves legal rights while gathering facts needed to determine whether termination or remediation is warranted.

Question 100: In the context of CCCP certification, what is the most important consideration when implementing mergers & acquisitions compliance?

Minimizing documentation to save time
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)
Completing implementation as quickly as possible regardless of quality
Delegating all responsibilities to junior staff

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing mergers & acquisitions compliance, CCCP professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 101: Which metric is MOST useful for communicating the health of a compliance culture to the board?

Dollar amount spent on compliance technology
Percentage of employees completing ethics training combined with hotline utilization trends (Correct answer)
Total number of compliance policies in existence
Number of legal entities under compliance oversight

Correct answer: Percentage of employees completing ethics training combined with hotline utilization trends

Training completion rates combined with reporting channel utilization are behavioral indicators that reflect culture health, not just structural compliance.

Question 102: What distinguishes a 'speak-up culture' from a mere hotline program in corporate compliance?

A speak-up culture eliminates the need for a formal whistleblower policy
A speak-up culture actively encourages employees to raise concerns through any channel without fear of retaliation (Correct answer)
A speak-up culture relies exclusively on anonymous reporting
A speak-up culture requires all concerns to be escalated to the board

Correct answer: A speak-up culture actively encourages employees to raise concerns through any channel without fear of retaliation

A speak-up culture goes beyond a hotline by embedding psychological safety so employees feel comfortable raising concerns through any appropriate channel.

Question 103: What is a key element of a strong internal control system?

Allowing unreviewed transactions.
Assigning all tasks to one person.
Segregation of duties (Correct answer)
Cutting oversight roles.

Correct answer: Segregation of duties

Segregation of duties is a fundamental internal control principle designed to prevent fraud and errors by ensuring that no single individual has complete control over all aspects of a financial transaction or process. By dividing responsibilities such as authorization, record-keeping, and asset custody among different people, it creates a system of checks and balances. This reduces the opportunity for an individual to commit and conceal dishonest acts.

Question 104: A CEO instructs the CCO to omit a pending DOJ investigation from the board's quarterly compliance report. The CCO should:

Refuse and escalate directly to the board's audit committee (Correct answer)
Resign immediately to avoid liability
Comply with the CEO's instruction to maintain executive unity
Omit the item but document the CEO's instruction in personal files

Correct answer: Refuse and escalate directly to the board's audit committee

The CCO has an independent duty to the board and cannot withhold material legal matters at an executive's direction.

Question 105: What role does continuous improvement play in board & executive communication for CCCP certified professionals?

It applies only to new professionals in their first year
It focuses exclusively on cost reduction
It is optional and only necessary during certification renewal
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in board & executive communication, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 106: Which U.S. law specifically governs the privacy of children's online data and requires verifiable parental consent for users under 13?

TCPA
CIPA
COPPA (Correct answer)
FERPA

Correct answer: COPPA

The Children's Online Privacy Protection Act (COPPA) requires operators of websites directed at children under 13 to obtain verifiable parental consent before collecting personal information.

Question 107: Which risk appetite framework component defines the maximum level of risk an organization is willing to accept before action is required?

Risk capacity
Risk tolerance
Risk threshold (Correct answer)
Risk appetite statement

Correct answer: Risk threshold

Risk threshold is the specific level at which a risk triggers mandatory escalation or corrective action.

Question 108: An executive team proposes reframing a compliance failure as a 'process improvement opportunity' in the board report. The CCO should:

Accept the framing to support executive morale
Insist on accurate characterization of the failure while noting corrective actions (Correct answer)
Let the CEO decide the framing without CCO input
Remove the item from the board report entirely

Correct answer: Insist on accurate characterization of the failure while noting corrective actions

Accurate reporting of compliance failures is required for board oversight; sanitizing failures undermines directors' ability to fulfill their governance role.

Question 109: Which scenario represents a 'risk transfer' strategy in corporate compliance?

Adding a supervisory approval step to a process
Strengthening employee training programs
Stopping a high-risk business line entirely
Purchasing cyber liability insurance (Correct answer)

Correct answer: Purchasing cyber liability insurance

Purchasing insurance transfers the financial consequences of a risk event to a third party (the insurer), which is the defining characteristic of a risk transfer strategy.

Question 110: A state employee reports Medicaid fraud to state authorities. Which law provides the primary whistleblower protection in this scenario?

Only the federal FCA
The applicable state False Claims Act if the state has one meeting federal standards (Correct answer)
The State Government Ethics Act
The Sarbanes-Oxley Act

Correct answer: The applicable state False Claims Act if the state has one meeting federal standards

Many states have enacted their own False Claims Acts with whistleblower protection provisions; states with qualifying laws receive a larger share of federal Medicaid recoveries.

Question 111: Under the UK Bribery Act 2010, which defense is available to a commercial organization charged with failing to prevent bribery?

The organization had 'adequate procedures' in place to prevent bribery (Correct answer)
The organization had no prior knowledge of the bribe
The organization self-reported the violation within 30 days
The bribe was paid by a third-party agent, not a direct employee

Correct answer: The organization had 'adequate procedures' in place to prevent bribery

The UK Bribery Act's 'adequate procedures' defense requires that an organization implement proportionate anti-bribery procedures, including third-party controls.

Question 112: What is control testing?

Testing employees' patience.
Building new procedures.
Conducting product launches.
Evaluating control effectiveness (Correct answer)

Correct answer: Evaluating control effectiveness

Control testing is a critical component of internal control systems, involving the systematic evaluation of whether established controls are operating as intended and effectively mitigating identified risks. This process helps determine if controls are designed appropriately and functioning efficiently to prevent or detect errors and fraud. Regular control testing ensures the ongoing reliability and integrity of an organization's processes.

Question 113: When benchmarking a compliance program's effectiveness against peers, which source provides the most authoritative industry standards?

DOJ/SEC guidance documents and industry association surveys (Correct answer)
A single competitor's annual report
Social media posts from compliance professionals
Internal audit reports from prior years

Correct answer: DOJ/SEC guidance documents and industry association surveys

DOJ/SEC guidance and industry surveys (e.g., SCCE, ECI) provide validated external benchmarks for measuring program maturity.

Question 114: A compliance program conducts periodic testing of controls to verify they are operating as designed. This activity is best described as:

Gap analysis
Control design assessment
Risk identification
Control operating effectiveness testing (Correct answer)

Correct answer: Control operating effectiveness testing

Control operating effectiveness testing evaluates whether controls are actually functioning as intended in practice, not just whether they are well-designed on paper.

Question 115: A board member asks why the compliance budget increased 30% year over year. The BEST response from the CCO includes:

Specific drivers such as new regulations, headcount additions, technology investments, and cost-benefit outcomes (Correct answer)
A vague statement about increased regulatory complexity
A comparison to the marketing budget to justify the increase
A request to defer the question to the CFO only

Correct answer: Specific drivers such as new regulations, headcount additions, technology investments, and cost-benefit outcomes

Boards expect compliance spending to be justified with specific drivers and demonstrated value, not general references to complexity.

Certified Compliance & Ethics Professional (CCEP) — Corporate Compliance Professional

The CCEP credential from the Society of Corporate Compliance and Ethics (SCCE) validates expertise in designing, implementing, and managing corporate compliance and ethics programs, covering governance, risk assessment, training, investigations, and third-party compliance.

115

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds