CCEP Ethics Program Management 4 — Questions and Answers
Question 1: Which of the following BEST explains the concept of 'residual risk' in compliance program design?
- The risk that remains after controls are applied (Correct answer)
- The total unmitigated risk facing the organization
- The risk transferred to third parties through contracts
- The risk identified but not yet assessed
Correct answer: The risk that remains after controls are applied
Residual risk is the level of risk that remains after the organization's controls and mitigating measures have been applied to the inherent risk.
Question 2: A pharmaceutical company's compliance program includes a 'No-Contact' policy for interactions with government payers. This policy is an example of which program element?
- Disciplinary action
- Preventive control (Correct answer)
- Detective control
- Corrective action
Correct answer: Preventive control
A No-Contact policy prevents prohibited interactions before they occur, making it a preventive control rather than a detective or corrective measure.
Question 3: When conducting third-party due diligence, which red flag should MOST concern a compliance officer evaluating a new distributor?
- The distributor operates in only one country
- The distributor requests a higher-than-market commission in a high-corruption jurisdiction (Correct answer)
- The distributor has fewer than 50 employees
- The distributor's contracts are written in a foreign language
Correct answer: The distributor requests a higher-than-market commission in a high-corruption jurisdiction
An above-market commission request in a high-corruption environment is a classic red flag suggesting the extra margin may fund improper payments to officials.
Question 4: Which of the following is an example of a 'detective control' in a compliance program?
- Requiring dual approvals for vendor payments
- Conducting periodic audits of expense reports (Correct answer)
- Training employees on the anti-bribery policy
- Including ethics clauses in supplier contracts
Correct answer: Conducting periodic audits of expense reports
Periodic audits of expense reports detect misconduct after the fact rather than preventing it, making them a detective control.
Question 5: A compliance program uses data analytics to flag unusual transaction patterns for review. This practice BEST supports which program function?
- Ethics training delivery
- Proactive risk monitoring and detection (Correct answer)
- Disciplinary action consistency
- Code of conduct drafting
Correct answer: Proactive risk monitoring and detection
Using data analytics to identify anomalous patterns is a proactive monitoring technique that strengthens the program's detection capabilities.
Question 6: An organization is developing a compliance risk assessment. Which step should come FIRST?
- Ranking risks by likelihood and impact
- Identifying the universe of applicable laws and regulations (Correct answer)
- Assigning risk owners to each identified risk
- Developing controls to mitigate the highest risks
Correct answer: Identifying the universe of applicable laws and regulations
Before risks can be ranked or controlled, the organization must first identify all applicable legal and regulatory requirements to define the scope of potential compliance risks.
Question 7: Which of the following MOST accurately describes 'micro-cultures' in the context of ethics program management?
- The organization's stated values as written in its code of conduct
- Sub-group norms within teams or business units that may diverge from enterprise values (Correct answer)
- Cultural differences between countries where the company operates
- The ethics officer's personal leadership style
Correct answer: Sub-group norms within teams or business units that may diverge from enterprise values
Micro-cultures are the informal norms and behaviors that develop within specific teams or units, which may support or undermine the broader organizational ethics culture.
CCEP Ethics Program Management 4
Which of the following BEST explains the concept of 'residual risk' in compliance program design?