CCM Compliance Investigations & Internal Reporting

Question 1

When initiating an internal compliance investigation, which action is most critical to take first to preserve attorney-client privilege?

Accepted Answer

Retain outside legal counsel to direct the investigation

Answer

To preserve attorney-client privilege, investigations should be directed by or conducted at the direction of legal counsel. This shields communications and findings from disclosure. Broad notifications or premature interviews without counsel can waive privilege or compromise the investigation.

Question 2

An employee reports a potential FCPA violation through the anonymous hotline. The compliance manager's FIRST step should be to:

Accepted Answer

Conduct a preliminary assessment to determine whether a full investigation is warranted

Answer

A preliminary assessment (sometimes called a 'triage') is the appropriate first step. It determines the credibility and scope of the allegation before resource-intensive investigation or premature external disclosure. Immediate termination without investigation is legally risky, and self-reporting before internal review is premature.

Question 3

Which of the following best describes the 'Upjohn warning' in the context of a compliance investigation?

Accepted Answer

A Miranda-style notice informing employees that company counsel represents the company, not the individual employee

Answer

An Upjohn warning (from Upjohn Co. v. United States) notifies employees being interviewed by company counsel that the attorney represents the company's interests, not theirs, and that the company may choose to waive privilege and disclose the conversation. This is a standard practice in internal investigations.

Question 4

During an internal investigation, a compliance manager discovers that a key witness has deleted relevant emails. The most appropriate immediate response is to:

Accepted Answer

Issue a litigation hold notice and involve IT to attempt forensic recovery

Answer

A litigation hold (legal hold) should be issued immediately to prevent further destruction of evidence, and IT forensics should be engaged to attempt recovery of deleted data. Closing the investigation or immediately going to law enforcement are premature. Board notification may follow but is not the immediate first step.

Question 5

A compliance investigation concludes that a mid-level manager engaged in expense fraud totaling $8,000. Which factor most strongly determines whether to self-disclose to regulators?

Accepted Answer

Whether the conduct was isolated or indicative of a systemic control failure

Answer

Regulators are most concerned with systemic issues, not isolated incidents. A single instance of fraud by one employee may not require disclosure, but if the investigation reveals that controls broadly failed or that management condoned the behavior, voluntary disclosure becomes far more relevant. Dollar amount alone is not the primary trigger.

(CCM) Certified Compliance Manager Practice Test

(CCM) Certified Compliance Manager Practice Test

CCM Compliance Investigations & Internal Reporting