CCCP Cheat Sheet 2026

The 30 highest-yield CCCP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Why are legal frameworks important in compliance? → To establish enforceable legal obligations
2. What is the primary goal of risk management? → To reduce uncertainty and potential losses
3. Which body is responsible for administering the CCCP certification in the United States? → The Society of Corporate Compliance and Ethics (SCCE)
4. When a company receives a grand jury subpoena for documents, what is the immediate first step compliance should take? → Issue a litigation hold to preserve all potentially relevant records
5. What is the role of the compliance officer? → Ensures compliance with legal standards
6. When a compliance officer discovers a material regulatory violation, what is the MOST appropriate initial escalation path to the board? → Notify the audit committee chair first, then determine if full board disclosure is needed
7. Board materials prepared by the compliance function should generally be distributed how far in advance of a board meeting? → Five to seven days before the meeting to allow meaningful review
8. The HITECH Act strengthened HIPAA enforcement by: → Extending HIPAA obligations directly to business associates and increasing penalty tiers
9. Which of the following best describes a key competency required for government investigation response in CCCP practice? → Strong analytical skills combined with effective communication and ethical judgment
10. The Consumer Financial Protection Bureau (CFPB) has enforcement authority over which type of conduct under the Dodd-Frank Act? → Unfair, deceptive, or abusive acts or practices (UDAAP) by financial service providers
11. An organization's compliance function identifies a new regulatory requirement with a 90-day implementation deadline. Which risk response is MOST appropriate? → Risk reduction
12. In the context of CCCP certification, what is the most important consideration when implementing government investigation response? → Ensuring alignment with established standards, stakeholder needs, and best practices
13. Which of the following BEST describes a 'say-on-pay' vote under the Dodd-Frank Act? → A non-binding advisory vote by shareholders on executive compensation
14. In a cross-border acquisition, which international framework most directly governs anti-bribery compliance obligations for US-listed acquirers? → The Foreign Corrupt Practices Act (FCPA)
15. When preparing board materials on a new regulatory requirement, the compliance officer should PRIMARILY focus on: → Business impact, gap assessment, required resources, and implementation timeline
16. A compliance officer wants to ensure the board understands the company's ethics hotline trend data. Which approach is MOST effective? → Show year-over-year trends, category breakdowns, and benchmarks against industry peers
17. A qui tam relator's complaint is filed under seal. During the seal period, what is the government required to do? → Investigate the allegations and decide whether to intervene
18. A Chief Compliance Officer wants to quantify the financial impact of a data breach scenario. Which risk assessment technique is MOST appropriate? → Monte Carlo simulation
19. Which scenario represents a 'risk transfer' strategy in corporate compliance? → Purchasing cyber liability insurance
20. Which of the following best describes 'tone at the top' in the context of ethics and compliance? → Senior leadership's visible commitment to ethical behavior and compliance values
21. A compliance team uses a 'maturity model' to assess its program. At Level 3 (Defined), what is the primary characteristic? → Processes are documented, standardized, and consistently applied
22. Which U.S. law most directly governs corporate liability for bribes paid by agents or intermediaries to foreign government officials? → Foreign Corrupt Practices Act (FCPA)
23. Under the IRS whistleblower program, what minimum amount of disputed tax must be involved for a whistleblower to be eligible for a mandatory award? → $2 million
24. Under the False Claims Act (FCA), the 'reverse false claim' theory imposes liability when a defendant: → Knowingly retains an overpayment from a government health program
25. Which framework provides a risk-based approach to managing cybersecurity risk and was developed by NIST? → NIST Cybersecurity Framework (CSF)
26. What is the purpose of regulatory frameworks? → To provide a structure for lawful business conduct
27. The 'duty of loyalty' requires corporate directors to: → Prioritize the corporation's interests over their personal interests
28. Which regulatory body has primary enforcement authority over the books-and-records provisions of the FCPA? → Securities and Exchange Commission (SEC)
29. What is the primary compliance risk associated with having a Code of Conduct that employees must 'acknowledge' but not meaningfully understand? → A false sense of compliance without actual behavioral change or risk mitigation
30. Which scenario would most likely trigger mandatory reporting to HHS under the HIPAA Breach Notification Rule for a large breach (500+ individuals)? → An unencrypted laptop containing ePHI is stolen from an employee's car