RCC Cheat Sheet 2026

The 30 highest-yield RCC facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which regulation requires public companies to establish internal controls for financial reporting? → SOX
2. Which U.S. federal law prohibits American companies and their agents from bribing foreign government officials to obtain or retain business? → The Foreign Corrupt Practices Act (FCPA)
3. Under the U.S. Federal Sentencing Guidelines, which factor most significantly reduces an organization's culpability score after a compliance violation? → Self-reporting the offense before investigation
4. In a Suspicious Activity Report (SAR) filed under the Bank Secrecy Act, what is the 'safe harbor' provision? → Filers cannot be held civilly or criminally liable for filing a SAR in good faith
5. Which element is NOT one of the five components of the COSO Internal Control – Integrated Framework? → Risk Appetite
6. When a compliance officer uses a 'heat map' during monitoring activities, they are primarily: → Visually representing the likelihood and impact of compliance risks
7. An organization's 'acceptable use policy' for information systems PRIMARILY serves to: → Establish rules for appropriate use of company technology and data resources
8. When designing a conflicts-of-interest policy, which disclosure mechanism is considered best practice? → Annual written disclosure combined with event-triggered reporting
9. Residual risk is best defined as: → Risk remaining after management controls have been applied
10. What is the MAIN purpose of a compliance awareness campaign? → To reinforce compliance values and keep obligations top-of-mind across the organization
11. Which approach best ensures that compliance training is effective rather than merely completed? → Testing comprehension and tracking behavioral outcomes
12. Which element is MOST critical when communicating a new regulatory requirement to business units? → Explaining the practical business impact and required actions clearly and concisely
13. The concept of 'compliance fatigue' describes: → Employee disengagement caused by excessive or repetitive compliance communications
14. What is a 'compliance dashboard' MOST commonly used for? → Providing real-time or periodic visibility into key compliance metrics
15. Which activity is crucial for effective internal control evaluation? → Internal auditing
16. Which document typically outlines a company’s risk tolerance? → Risk management policy
17. Which element is NOT typically part of a root cause analysis conducted after a compliance violation is found? → Determining disciplinary outcomes for the responsible party
18. Why is documentation important during a compliance investigation? → To support findings and protect against liability
19. What is the primary purpose of an independent compliance monitor imposed by the DOJ following a corporate settlement? → To verify that agreed-upon compliance program improvements are implemented effectively
20. Why is it important to regularly monitor internal controls? → To confirm effectiveness and adapt to changes
21. Under the FCPA, which of the following is NOT considered a 'foreign official'? → A private sector executive with no government role
22. What does 'data minimization' mean in a privacy compliance context? → Collecting only the personal data necessary for the specified purpose
23. Which regulatory body has authority to debar a company from federal contracting as a consequence of compliance failures? → General Services Administration (GSA)
24. Under the California Consumer Privacy Act (CCPA), consumers have the right to: → Know what personal information is collected about them and request its deletion
25. Under U.S. enforcement trends, which whistleblower program specifically incentivizes individuals to report FCPA violations to the SEC? → The SEC Whistleblower Program established under Dodd-Frank Section 922
26. Which legal doctrine holds that courts should defer to a federal agency's reasonable interpretation of an ambiguous statute it administers? → Chevron deference
27. Which of the following is an example of 'middle management pressure' as a root cause of compliance failures? → A manager ignoring safety rules because meeting productivity targets earns bonuses
28. Which metric is most useful for measuring the effectiveness of a compliance hotline? → Ratio of substantiated to unsubstantiated reports and average resolution time
29. What is the main objective of risk management in a compliance program? → Prevent noncompliance and legal exposure
30. Which of the following is a key function of the Securities and Exchange Commission (SEC)? → Regulate financial disclosures by public companies