CCCP Compliance Effectiveness Assessment 5 — Questions and Answers
Question 1: Which type of assessment involves compliance staff independently testing whether business unit controls are operating as designed?
- Control self-assessment (CSA)
- Second-line compliance monitoring and testing (Correct answer)
- Third-party audit
- Peer benchmarking review
Correct answer: Second-line compliance monitoring and testing
Second-line compliance monitoring involves the compliance function independently testing controls, separate from business unit self-assessment.
Question 2: A company wants to assess whether its anti-bribery controls are effective in its high-risk overseas operations. Which approach provides the strongest evidence?
- Reviewing the written anti-bribery policy
- Conducting transaction testing of expense reports and third-party payments in those operations (Correct answer)
- Asking local managers to self-certify compliance
- Comparing headcount of local compliance staff
Correct answer: Conducting transaction testing of expense reports and third-party payments in those operations
Transaction-level testing of actual payments provides direct evidence of whether anti-bribery controls are working in practice.
Question 3: According to the DOJ's Evaluation of Corporate Compliance Programs, what does it mean for a compliance program to be 'working in practice'?
- The company has not been investigated in the past three years
- Employees understand, follow, and report issues under the program in their day-to-day work (Correct answer)
- The compliance budget exceeds industry average
- The board approves the compliance program annually
Correct answer: Employees understand, follow, and report issues under the program in their day-to-day work
The DOJ focuses on whether the program functions in reality—employees' actual behavior and awareness—not just what policies say on paper.
Question 4: During a compliance effectiveness review, which finding would most suggest that the compliance function lacks organizational independence?
- The CCO reports directly to the CEO and the board
- Compliance investigations are reviewed and approved by the business unit being investigated (Correct answer)
- The compliance team participates in business development meetings
- Compliance staff rotate across different business units
Correct answer: Compliance investigations are reviewed and approved by the business unit being investigated
Allowing a business unit to control or approve its own investigations creates a structural conflict that compromises compliance independence.
Question 5: A company updates its compliance program annually but never changes training content or risk assessments. Under a compliance effectiveness framework, this reflects a failure of:
- Continuous improvement and adaptation to evolving risks (Correct answer)
- Initial program design
- Board engagement
- External audit readiness
Correct answer: Continuous improvement and adaptation to evolving risks
Effective compliance programs must continuously update to reflect new risks, regulatory changes, and lessons learned—not just formally schedule reviews without substantive changes.
Question 6: What is the primary limitation of using only quantitative metrics (e.g., training completion rates, hotline call volumes) to assess compliance effectiveness?
- Quantitative data is too expensive to collect
- They measure activity but may not capture whether employees actually behave ethically (Correct answer)
- Regulators do not accept quantitative evidence
- Quantitative metrics cannot be audited
Correct answer: They measure activity but may not capture whether employees actually behave ethically
Quantitative metrics show activity levels but not actual ethical behavior change, culture quality, or real-world application of compliance principles.
Question 7: When assessing the effectiveness of a compliance investigation process, which factor is most critical to evaluate?
- Speed of case closure and consistency of disciplinary outcomes (Correct answer)
- Number of investigators on staff
- Whether investigations are led by outside counsel
- The format used for documenting investigation findings
Correct answer: Speed of case closure and consistency of disciplinary outcomes
Timely resolution and consistent discipline based on findings are key to a credible investigation process that deters future misconduct.
CCCP Compliance Effectiveness Assessment 5
Which type of assessment involves compliance staff independently testing whether business unit controls are operating as designed?