Policy Development & Implementation Flashcards
7 cards from real CCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Policy Development & Implementation flashcards as text
A compliance manager is tasked with creating a records retention policy. Which regulatory body's rules would MOST directly influence the retention schedule for a publicly traded U.S. company?
Answer: Securities and Exchange Commission (SEC) and Sarbanes-Oxley Act requirements
Publicly traded U.S. companies are subject to SEC rules and SOX provisions that specify minimum retention periods for financial and audit-related records.
Which of the following is the BEST example of 'policy cascade' in a large organization?
Answer: Translating a board-level policy into department-specific procedures and individual work instructions
Policy cascade systematically translates high-level board or executive policies into progressively more specific departmental procedures and individual job-level instructions.
An employee reports that a newly implemented vendor due diligence policy creates barriers to completing urgent procurement needs. The MOST appropriate compliance response is to:
Answer: Investigate whether the policy requirement is proportionate and consider a formal exception or expedited review pathway
Compliance programs must be effective and operational; investigating the concern and creating appropriate escalation pathways maintains compliance while addressing legitimate business needs.
What is the key distinction between a compliance 'policy' and a compliance 'standard'?
Answer: Policies state what must be achieved; standards specify the minimum acceptable level of performance or behavior required to meet the policy
Policies articulate the 'what' and 'why,' while standards set measurable thresholds or minimum requirements that define how the policy objective is met.
During a regulatory examination, an examiner asks for evidence that employees were trained on the updated AML policy issued eight months ago. Which documentation BEST satisfies this request?
Answer: Training completion records showing employee name, training date, and pass/fail status
Regulators require documented evidence of training completion; records showing each employee's name, date, and outcome provide the necessary audit trail.
A compliance manager notices that the written policy on gifts and entertainment sets a $50 limit, but informal company culture tolerates much higher amounts. This disconnect represents which type of compliance risk?
Answer: Culture-policy gap risk, where informal norms undermine written policy effectiveness
When informal culture contradicts written policy, the written policy loses its deterrent effect, creating significant ethical and regulatory exposure.
A multinational company applies a single global anti-corruption policy uniformly across all jurisdictions. What is the PRIMARY risk of this approach?
Answer: Local legal requirements in some jurisdictions may be stricter than the global policy, leaving the company non-compliant locally
A uniform global policy may not account for stricter local anti-corruption laws, creating legal compliance gaps in specific jurisdictions that require local supplements.