CCCP Board & Executive Communication 5 — Questions and Answers
Question 1: Under the Federal Sentencing Guidelines, which factor related to board oversight can MOST significantly reduce an organization's culpability score?
- Having a large legal department
- Demonstrated high-level personnel responsibility for and oversight of an effective compliance program (Correct answer)
- Publishing an annual CSR report
- Maintaining a compliance hotline that is never used
Correct answer: Demonstrated high-level personnel responsibility for and oversight of an effective compliance program
The Guidelines reward organizations where high-level personnel exercise genuine oversight of compliance, reducing culpability and potential fines.
Question 2: When the CCO briefs the board on a significant third-party vendor compliance risk, the presentation should INCLUDE:
- A list of every vendor invoice from the past year
- Risk exposure, due diligence findings, contractual protections, and proposed remediation steps (Correct answer)
- Only the vendor's self-certification letter
- The vendor's marketing materials and customer reviews
Correct answer: Risk exposure, due diligence findings, contractual protections, and proposed remediation steps
Third-party risk briefings require context on exposure, what due diligence revealed, existing protections, and how gaps will be addressed.
Question 3: An executive proposes that compliance updates be embedded in the CFO's financial presentation to save board meeting time. The compliance officer should:
- Agree fully, since financial and compliance matters are equivalent
- Advocate for a separate compliance agenda item to ensure independent oversight visibility (Correct answer)
- Reduce all compliance reporting to a single footnote in financial statements
- Eliminate board-level compliance reporting entirely
Correct answer: Advocate for a separate compliance agenda item to ensure independent oversight visibility
Embedding compliance in financial presentations undermines independent compliance oversight and can obscure material risks from directors.
Question 4: The board is evaluating whether to enter a new high-risk market. What compliance input should the CCO provide BEFORE the decision?
- Only confirm whether the market is legal in principle
- A pre-entry compliance risk assessment covering regulatory environment, enforcement trends, and program readiness gaps (Correct answer)
- Wait until after entry to identify compliance requirements
- Delegate the entire analysis to the business development team
Correct answer: A pre-entry compliance risk assessment covering regulatory environment, enforcement trends, and program readiness gaps
Pre-entry compliance risk assessments enable the board to make fully informed strategic decisions with knowledge of regulatory exposure and resource requirements.
Question 5: A board member shares a confidential compliance report with a personal friend who is a major shareholder. This MOST likely violates:
- The company's travel and expense policy
- Fiduciary duties, confidentiality obligations, and potentially securities laws on selective disclosure (Correct answer)
- The company's social media policy only
- No rule, since shareholders have a right to all company information
Correct answer: Fiduciary duties, confidentiality obligations, and potentially securities laws on selective disclosure
Directors have fiduciary duties of confidentiality, and selective disclosure of material non-public information can trigger Reg FD and insider trading violations.
Question 6: Which of the following BEST demonstrates that a board is exercising effective compliance oversight rather than rubber-stamping management reports?
- Approving all compliance reports unanimously without discussion
- Asking probing questions, requesting independent verification, and commissioning occasional third-party audits (Correct answer)
- Delegating all compliance judgment to the CCO with no follow-up
- Meeting only when a crisis arises
Correct answer: Asking probing questions, requesting independent verification, and commissioning occasional third-party audits
Effective oversight is demonstrated through active questioning, independent verification, and periodic external audits rather than passive approval.
Question 7: A compliance officer is asked to present a 'lessons learned' summary after a major compliance incident to the board. The presentation should PRIMARILY focus on:
- Assigning personal blame to identified employees
- Root cause analysis, systemic control gaps, corrective actions taken, and preventive measures implemented (Correct answer)
- Describing only the external regulatory response and fines
- Minimizing the incident's significance to maintain board confidence
Correct answer: Root cause analysis, systemic control gaps, corrective actions taken, and preventive measures implemented
Post-incident board presentations should drive systemic improvement through root cause analysis and documented corrective actions, not blame or minimization.
CCCP Board & Executive Communication 5
Under the Federal Sentencing Guidelines, which factor related to board oversight can MOST significantly reduce an organization's culpability score?