Mixed Deck — All CCO Topics Flashcards

What does the Sarbanes-Oxley Act (SOX) require of public company CEOs and CFOs?

Answer: Personal certification of the accuracy of financial statements and the effectiveness of internal controls

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial reports and the effectiveness of internal controls, creating personal accountability.

What is 'vendor concentration risk' in a third-party compliance program?

Answer: The risk arising when too many critical functions depend on a single vendor, creating a single point of failure

Vendor concentration risk occurs when an organization relies too heavily on a single third party for critical functions, so any disruption to that vendor can cripple the organization's operations and compliance posture.

What is the significance of annual ethics certifications signed by employees?

Answer: They confirm employee awareness and acknowledgment of ethics obligations

Annual certifications confirm that employees have read, understood, and agreed to abide by the Code of Conduct, creating a documented record of acknowledgment.

What is an independent director in corporate governance?

Answer: A board member who has no material relationship with the company that could influence their judgment

Independent directors have no significant financial, familial, or other relationship with the company that could compromise their objectivity in board decisions.

What is the purpose of an exit conference in an internal audit?

Answer: To communicate audit findings and recommendations to management before the final report, allowing management to respond and correct factual errors

Exit conferences give management the opportunity to hear, discuss, and respond to findings before the final audit report is issued, improving accuracy and buy-in.

A company's vendor code of conduct should primarily do which of the following?

Answer: Communicate the organization's compliance expectations to all vendors and require written acknowledgment

A vendor code of conduct formally communicates the compliance, ethical, and legal standards the organization expects from its vendors and typically requires vendors to sign an acknowledgment of these requirements.

What is an internal audit charter?

Answer: A formal document that defines the internal audit function's purpose, authority, responsibility, and independence within the organization

The internal audit charter establishes the function's organizational authority, independence, scope, and accountability structure, typically approved by the Audit Committee.

What is the purpose of a compliance program effectiveness review?

Answer: To assess whether the compliance program is adequately designed, resourced, and operating effectively to prevent and detect violations

Effectiveness reviews assess whether the program's design and operation actually prevent and detect misconduct, using metrics, surveys, testing, and benchmarking.

What is dual-hatting in the context of compliance and legal functions?

Answer: When the CCO also serves as General Counsel, potentially creating conflicts between legal privilege and compliance transparency

Dual-hatting the CCO and GC roles can create tension between attorney-client privilege, which favors confidentiality, and compliance obligations, which favor transparency.

What does 'pseudonymization' mean in data privacy?

Answer: Replacing directly identifying information with artificial identifiers so data cannot be attributed to a specific person without additional information

Pseudonymization replaces identifying fields with artificial identifiers, reducing re-identification risk while still allowing data utility, though it differs from full anonymization.

What is the three-way match in procurement controls?

Answer: Comparing the purchase order, receiving report, and vendor invoice to verify all three agree before payment is approved

Three-way matching is a preventive control that ensures payment is only made when the ordered, received, and invoiced quantities and amounts all agree.

What information should a CCO regularly report to the Board or Audit Committee?

Answer: Program effectiveness metrics, investigation outcomes, regulatory developments, and emerging risks

Board reporting should cover the health of the compliance program, key metrics, investigation results, regulatory landscape, and significant risk areas.

In the context of anti-bribery compliance, what is a 'red flag' that should heighten scrutiny of a third-party intermediary?

Answer: The intermediary requests unusual payment structures such as cash payments or payments to a third country

Unusual payment requests—such as cash, payments to undisclosed parties, or payments routed through unrelated jurisdictions—are classic red flags for potential bribery or money laundering through third parties.

What is the 'compliance universe' in program management?

Answer: The full inventory of laws, regulations, standards, and internal policies that apply to the organization

The compliance universe maps every applicable legal and regulatory requirement, forming the foundation for the risk assessment and program design.

What is the 'business judgment rule' in corporate governance?

Answer: A legal presumption that directors acted on an informed basis, in good faith, and in the honest belief that decisions were in the company's best interest

The business judgment rule protects directors from liability for decisions made in good faith after reasonable deliberation, even if those decisions turn out poorly.

What is the best practice when an employee faces pressure from a supervisor to falsify records?

Answer: Refuse and report the incident through the compliance hotline or to the CCO

Employees must refuse to falsify records and report such pressure through established reporting channels to protect themselves and the organization.

What is 'fiduciary duty' for corporate directors?

Answer: Legal obligations requiring directors to act in the best interests of the corporation and its shareholders, including duties of care and loyalty

Directors owe the corporation duties of care (informed, deliberate decisions) and loyalty (putting corporate interests above personal interests).

Why is independence important for the CCO role?

Answer: An independent CCO can escalate concerns, challenge business decisions, and report to the Board without fear of retaliation or conflict of interest

CCO independence ensures the compliance function can objectively assess risk and report misconduct without being influenced by business pressures or conflicts of interest.

What is a compliance training needs analysis?

Answer: The process of identifying which employees need what training based on their roles, risk exposure, and past training gaps

A training needs analysis ensures compliance training is targeted, relevant, and proportionate to the actual risks faced by each employee group.

What is HIPAA and what type of data does it protect?

Answer: The Health Insurance Portability and Accountability Act, which protects protected health information (PHI) in the US

HIPAA establishes national standards for protecting sensitive patient health information from disclosure without the patient's consent or knowledge.