CCB Policy Development & Implementation 3 — Questions and Answers
Question 1: What does a policy 'owner' typically bear responsibility for in an organization?
- Writing the policy's legal disclaimers
- Maintaining, updating, and ensuring adherence to the policy over time (Correct answer)
- Distributing printed copies to all employees
- Approving every individual exception request
Correct answer: Maintaining, updating, and ensuring adherence to the policy over time
The policy owner is accountable for keeping the policy current, relevant, and aligned with regulatory requirements throughout its lifecycle.
Question 2: Which of the following BEST describes a policy hierarchy in a compliance program?
- The order in which policies are enforced during an audit
- A tiered structure of policies, standards, procedures, and guidelines (Correct answer)
- A ranking of which departments must comply first
- The chronological order in which policies were created
Correct answer: A tiered structure of policies, standards, procedures, and guidelines
A policy hierarchy organizes governance documents from high-level policies down to specific procedures and guidelines, ensuring consistency.
Question 3: During implementation, employees report that a new travel expense policy is unclear. The compliance team should FIRST:
- Immediately rescind the policy and start over
- Issue an FAQ or supplemental guidance document to clarify intent (Correct answer)
- Discipline employees who ask questions
- Transfer the policy to the legal department for rewriting
Correct answer: Issue an FAQ or supplemental guidance document to clarify intent
Supplemental guidance or FAQs are a quick, practical way to resolve ambiguity without the formal process of revising the entire policy.
Question 4: A 'mandatory' policy differs from a 'recommended' guideline primarily in that:
- Guidelines are always longer than mandatory policies
- Mandatory policies require compliance; guidelines suggest best practices (Correct answer)
- Recommended guidelines carry stricter legal penalties
- Mandatory policies apply only to management levels
Correct answer: Mandatory policies require compliance; guidelines suggest best practices
Mandatory policies are binding requirements enforced with sanctions, while guidelines represent optional best practices without punitive consequences.
Question 5: What is the role of a policy management system (PMS) in a compliance program?
- To automatically enforce policy violations through system lockouts
- To centralize document storage, version control, and acknowledgment tracking (Correct answer)
- To replace the need for a compliance officer
- To generate regulatory filings on behalf of the organization
Correct answer: To centralize document storage, version control, and acknowledgment tracking
A PMS provides a single repository for all policies, tracks version history, and records employee acknowledgments for audit purposes.
Question 6: An organization is implementing a new vendor management policy. Which control BEST ensures third parties are aware of and adhere to the policy?
- Posting the policy on the company's internal intranet
- Including policy requirements in vendor contracts and conducting periodic audits (Correct answer)
- Sending a one-time email to vendors upon policy creation
- Requiring vendors to attend in-person training annually at headquarters
Correct answer: Including policy requirements in vendor contracts and conducting periodic audits
Embedding policy requirements in contracts creates legal obligation, and audits verify ongoing adherence by third parties.
Question 7: Which metric is MOST useful for measuring policy implementation effectiveness?
- The number of pages in the policy document
- Employee policy acknowledgment rates combined with audit finding trends (Correct answer)
- The speed at which the policy was approved by leadership
- The cost of printing and distributing the policy
Correct answer: Employee policy acknowledgment rates combined with audit finding trends
Acknowledgment rates confirm awareness, while audit finding trends reveal whether the policy is actually changing behavior and reducing violations.
CCB Policy Development & Implementation 3
What does a policy 'owner' typically bear responsibility for in an organization?