Compliance Program Development and Implementation Flashcards

What is the primary purpose of conducting a compliance program gap analysis?

Answer: To identify discrepancies between current practices and regulatory requirements

A gap analysis systematically compares existing practices against applicable requirements to identify deficiencies that must be remediated.

In a multi-jurisdictional organization, how should compliance policies address conflicts between U.S. federal law and local international law?

Answer: Document the conflict and apply whichever law governs with a clear rationale

When laws conflict, organizations must document the conflict, determine which law applies with proper legal analysis, and apply that law consistently with a clear rationale.

Which metric is most useful for measuring the effectiveness of a compliance hotline?

Answer: Ratio of substantiated to unsubstantiated reports and average resolution time

Substantiation rates and resolution times reveal whether the hotline is capturing genuine issues and resolving them promptly, making them the most meaningful effectiveness metrics.

A compliance officer wants to implement a third-party risk management program. What is the correct first step?

Answer: Inventory and categorize all third-party relationships by risk level

Inventorying and categorizing third parties by risk level is the essential first step because it allows proportionate due diligence resources to be allocated appropriately.

Under the FCPA, which condition would NOT constitute a defense to a bribery charge?

Answer: The payment was below a materiality threshold

There is no materiality threshold under the FCPA; even small payments made with corrupt intent can constitute violations, making amount an invalid defense.

What distinguishes a compliance program that is 'on paper' from one that is 'effective' per the DOJ's 2023 guidance?

Answer: Whether the program is adequately resourced and actually implemented in practice

DOJ guidance emphasizes that effectiveness depends on whether the program has sufficient resources, authority, and is genuinely applied — not merely whether documents exist.

Which type of internal audit sampling provides the strongest evidence when testing controls in a high-risk compliance area?

Answer: Statistical random sampling with a defined confidence level

Statistical random sampling with a defined confidence level provides defensible, mathematically valid results and allows meaningful conclusions about the entire population.