RCMS Compliance Program Development & Implementation 3 — Questions and Answers
Question 1: The 'three lines of defense' model assigns primary ownership of compliance controls to which line?
- Internal audit
- The compliance function
- Business operations and management (Correct answer)
- The board of directors
Correct answer: Business operations and management
The first line of defense is business operations, which owns and operates the controls; compliance (second line) oversees them; internal audit (third line) provides independent assurance.
Question 2: A company is drafting its first Code of Conduct. Which principle should guide the document's tone and language?
- Legal precision using technical statutory citations throughout
- Clear, accessible language that reflects the organization's values and expected behaviors (Correct answer)
- Minimal length to avoid overwhelming employees
- Exclusive focus on prohibited behaviors with no positive guidance
Correct answer: Clear, accessible language that reflects the organization's values and expected behaviors
An effective Code of Conduct uses plain language aligned with company values so all employees can understand expectations, not just legal or compliance specialists.
Question 3: Which factor is MOST critical when selecting a third-party vendor for a compliance technology platform?
- Vendor's headquarters location
- Platform's ability to integrate with existing systems and scale with the organization (Correct answer)
- Lowest initial purchase price
- Number of years the vendor has been in business
Correct answer: Platform's ability to integrate with existing systems and scale with the organization
Integration capability and scalability ensure the platform will work within existing workflows and grow with the organization's needs without requiring costly replacements.
Question 4: Under the DOJ's updated Corporate Compliance Program Evaluation guidance, prosecutors assess whether a compliance program is 'adequately resourced.' What does this primarily examine?
- Whether the company publishes its compliance budget publicly
- Staffing levels, expertise, and funding relative to the company's risk profile (Correct answer)
- The number of compliance-related lawsuits filed against the company
- Whether the CCO holds a specific professional certification
Correct answer: Staffing levels, expertise, and funding relative to the company's risk profile
DOJ evaluates whether compliance functions have sufficient personnel, expertise, and budget to address the organization's specific risk profile and operational complexity.
Question 5: Which approach BEST supports a culture of compliance throughout an organization?
- Limiting compliance messaging to the annual all-hands meeting
- Consistent 'tone from the top' with visible leadership commitment and reinforced behaviors (Correct answer)
- Publishing compliance statistics on the intranet without management commentary
- Focusing compliance culture efforts exclusively on high-risk departments
Correct answer: Consistent 'tone from the top' with visible leadership commitment and reinforced behaviors
Visible, consistent leadership commitment ('tone at the top') is the most powerful driver of an ethical culture because employees model the behaviors they observe in leadership.
Question 6: A compliance program's hotline receives a report alleging financial fraud. Who should be notified FIRST according to standard escalation protocols?
- The SEC whistleblower portal
- The accused employee's direct supervisor
- The Compliance Officer and/or General Counsel for triage and legal privilege determination (Correct answer)
- All employees via a company-wide announcement
Correct answer: The Compliance Officer and/or General Counsel for triage and legal privilege determination
Reports of potential fraud should be immediately triaged by the CCO and/or General Counsel to assess credibility, preserve legal privilege, and determine next investigative steps.
Question 7: Which document formally authorizes the compliance function's authority, independence, and access to information across the organization?
- The annual compliance report
- The compliance program charter (Correct answer)
- The employee handbook
- The IT acceptable-use policy
Correct answer: The compliance program charter
A compliance program charter, approved by senior leadership or the board, formally defines the function's mandate, authority, independence, and access rights.
RCMS Compliance Program Development & Implementation 3
The 'three lines of defense' model assigns primary ownership of compliance controls to which line?