CCEP Standards and Procedures 5 — Questions and Answers
Question 1: A compliance team is conducting a periodic review of its conflict-of-interest policy. Which data source provides the MOST direct evidence of whether the policy is being applied?
- Industry benchmark reports comparing policy length across peer companies
- Disclosure forms submitted by employees and the disposition records of reported conflicts (Correct answer)
- Annual employee satisfaction surveys that include questions about the policy
- The number of times the policy document was downloaded from the intranet
Correct answer: Disclosure forms submitted by employees and the disposition records of reported conflicts
Disclosure forms and disposition records reveal actual employee behavior under the policy and whether identified conflicts are being managed appropriately.
Question 2: Which scenario BEST illustrates a 'compensating control' when a primary procedural control cannot be implemented?
- A company audits expense reports quarterly because it cannot afford real-time transaction monitoring (Correct answer)
- A company implements the required dual-approval system for all wire transfers
- A company trains employees on a policy that has already been in effect for two years
- A company hires a third-party auditor to replace an ineffective internal audit function
Correct answer: A company audits expense reports quarterly because it cannot afford real-time transaction monitoring
A compensating control substitutes for a primary control that is unavailable or impractical, providing alternative assurance that the risk is mitigated.
Question 3: When a compliance officer identifies that a business unit is routinely circumventing a control by classifying expenditures as 'miscellaneous,' what is the MOST appropriate next step?
- Issue a memo reminding all employees of the correct expense classification categories
- Conduct a root cause analysis to determine why the circumvention is occurring before redesigning the control (Correct answer)
- Immediately terminate the employees involved in the misclassification
- Remove the control because it is clearly not working
Correct answer: Conduct a root cause analysis to determine why the circumvention is occurring before redesigning the control
Root cause analysis identifies whether the control design, training, or culture is the underlying problem, enabling a solution that actually addresses the cause.
Question 4: Which element of the OIG's seven elements of an effective compliance program specifically addresses the need for written standards?
- Effective lines of communication
- Written policies, procedures, and standards of conduct (Correct answer)
- Monitoring and auditing
- Responding promptly to detected offenses
Correct answer: Written policies, procedures, and standards of conduct
The OIG identifies written policies, procedures, and standards of conduct as the foundational element that codifies the compliance program's requirements.
Question 5: A company adds a 'speak up' obligation to its code of conduct requiring employees to report suspected violations. What potential downside must the compliance team proactively address?
- Employees may report too few violations, making the hotline underutilized
- Fear of retaliation may prevent employees from fulfilling the obligation unless robust anti-retaliation protections are in place (Correct answer)
- The obligation may conflict with employees' right to remain silent under the Fifth Amendment
- Customers may discover the obligation and view it negatively, damaging brand reputation
Correct answer: Fear of retaliation may prevent employees from fulfilling the obligation unless robust anti-retaliation protections are in place
A speak-up obligation is ineffective without credible anti-retaliation protections, because fear of reprisal is the primary barrier to employee reporting.
Question 6: Which of the following BEST describes the concept of 'policy ownership' in a mature compliance program?
- The legal department holds ownership of all compliance policies to ensure legal accuracy
- A designated individual or function is accountable for keeping a specific policy current, accurate, and implemented (Correct answer)
- Policy ownership rotates among employees annually to build organizational knowledge
- Senior leadership collectively owns all policies, making accountability shared across the C-suite
Correct answer: A designated individual or function is accountable for keeping a specific policy current, accurate, and implemented
Assigning a specific owner to each policy creates clear accountability for maintenance, updates, and ensuring the policy is understood and followed.
Question 7: An organization's records retention policy specifies a 7-year retention period for financial records. During active litigation, what legal doctrine supersedes this policy and requires longer retention?
- The business judgment rule
- Litigation hold (legal hold) (Correct answer)
- The work product doctrine
- The attorney-client privilege
Correct answer: Litigation hold (legal hold)
A litigation hold suspends normal records retention schedules and requires preservation of potentially relevant documents for the duration of litigation or a reasonably foreseeable legal action.
CCEP Standards and Procedures 5
A compliance team is conducting a periodic review of its conflict-of-interest policy.
Which data source provides the MOST direct evidence of whether the policy is being applied?