CCCP Compliance Program Development & Oversight 3 — Questions and Answers
Question 1: Which document typically establishes the compliance officer's authority, independence, and reporting lines within an organization?
- The employee handbook
- The compliance program charter or mandate (Correct answer)
- The annual compliance training materials
- The board of directors' meeting minutes
Correct answer: The compliance program charter or mandate
The compliance program charter formally defines the CCO's authority, independence, access to information, and reporting relationships within the organization.
Question 2: A company implements a new third-party due diligence process. Which risk is this control MOST directly designed to mitigate?
- Insider trading by employees
- Bribery or misconduct by vendors, agents, or partners acting on behalf of the company (Correct answer)
- Harassment complaints within the workplace
- Inaccurate financial reporting
Correct answer: Bribery or misconduct by vendors, agents, or partners acting on behalf of the company
Third-party due diligence is specifically designed to assess and mitigate the risk that vendors, agents, or partners may expose the company to corruption or other compliance violations.
Question 3: What is the key distinction between a compliance 'policy' and a compliance 'procedure'?
- Policies are optional while procedures are mandatory
- Policies state what must be done; procedures describe how to do it (Correct answer)
- Procedures are approved by the board; policies by management
- Policies apply to executives only; procedures apply to all staff
Correct answer: Policies state what must be done; procedures describe how to do it
A policy establishes the rule or standard (the 'what'), while a procedure provides the step-by-step instructions for implementing that rule (the 'how').
Question 4: The DOJ's 'Evaluation of Corporate Compliance Programs' guidance (2020 updated) asks prosecutors to consider three 'fundamental questions.' Which is NOT one of them?
- Is the compliance program well designed?
- Is the program being applied earnestly and in good faith?
- Does the program work in practice?
- Does the program maximize shareholder returns? (Correct answer)
Correct answer: Does the program maximize shareholder returns?
The DOJ's three fundamental questions focus on program design, good-faith implementation, and practical effectiveness—not financial returns.
Question 5: An organization's compliance hotline receives a report of potential financial fraud. Who should typically NOT be informed of the allegation during initial triage?
- The Chief Compliance Officer
- Legal counsel
- The subject of the allegation (Correct answer)
- The board's audit committee
Correct answer: The subject of the allegation
The subject of the allegation should not be informed during initial triage to preserve the integrity of the investigation and prevent retaliation or evidence tampering.
Question 6: Which principle underlies the concept of 'proportionality' in compliance program design?
- All companies in an industry must have identical compliance programs
- The size and complexity of a compliance program should match the organization's specific risk profile (Correct answer)
- Compliance resources should be equally distributed across all business units
- Compliance programs must always exceed minimum regulatory requirements
Correct answer: The size and complexity of a compliance program should match the organization's specific risk profile
Proportionality means tailoring the compliance program's scope and resources to the organization's actual size, industry, geographic footprint, and specific risk exposures.
Question 7: What is the primary compliance risk associated with 'tone at the middle' (managers and supervisors)?
- Middle managers may set compensation structures that violate overtime laws
- If managers do not reinforce compliance values, employees may believe leadership messaging is hollow (Correct answer)
- Middle managers often lack authority to discipline policy violators
- Supervisors may inadvertently disclose confidential hotline reports
Correct answer: If managers do not reinforce compliance values, employees may believe leadership messaging is hollow
Middle managers translate organizational culture into daily behavior; if they undermine or ignore compliance messaging, employees learn that compliance is not truly valued.
CCCP Compliance Program Development & Oversight 3
Which document typically establishes the compliance officer's authority, independence, and reporting lines within an organization?