BCCP common mistakes
BCCP · Understand the traps and how to avoid them.
Treating the compliance program as a checklist of separate elements (board, policy, training, hotline) rather than describing how they interlock into a single operating system with feedback loops.
Candidates study each domain in isolation and memorize element lists, so when a question asks how monitoring findings feed back into risk assessment and policy updates, they cannot connect the pieces.
What to do instead
Before the exam, draw a one-page diagram linking risk assessment, policy, controls, monitoring, training, investigation, and corrective action, and practice explaining in two sentences how a single finding travels through the loop. Answer integration questions by naming at least two connected elements.
Confusing governance roles: assigning day-to-day program ownership to the board, or treating the compliance officer as the final decision-maker on risk appetite.
Job titles sound similar and candidates blur oversight, management, and execution responsibilities, especially under time pressure.
What to do instead
Memorize a three-column table: governing body (oversight, risk appetite, resource approval), senior management (tone at the top, resourcing, accountability), compliance function (design, advise, monitor, report). For any scenario, first ask who owns the decision, then who executes and who verifies.
Answering legal-foundation questions from general intuition about fairness rather than from the specific statute, regulation, or regulator guidance named in the stem.
Candidates rely on workplace common sense and never build a mental map of which regulator governs which activity or what each law actually requires.
What to do instead
Build a jurisdiction-agnostic reference table of regulator types (prudential, conduct, privacy, anti-corruption, sanctions) with their typical mandates and enforcement tools. When a stem names a regime, answer within that regime's stated purpose even if another answer feels more 'fair'.
Treating extraterritorial reach, third-party liability, and individual accountability as edge cases rather than default assumptions.
Candidates learn domestic rules first and assume conduct outside the home country or by a vendor falls outside scope.
What to do instead
Adopt a standing test for legal-scope questions: who is the actor, where did the conduct occur, what is the nexus to the regulated entity, and can individuals be personally liable? Apply all four before choosing an answer.
Performing a qualitative 'vibes' risk rating instead of combining inherent risk, control effectiveness, and residual risk with a documented methodology.
Candidates skip the inherent-versus-residual distinction and jump straight to a single risk score, so they misjudge whether a control gap is actually material.
What to do instead
Practice the sequence explicitly: identify risk, rate inherent likelihood and impact, map existing controls, assess control design and operating effectiveness, then derive residual risk. If an answer option collapses these steps into one, it is usually wrong.
Designing controls that are preventive only, or detective only, without matching control type to the risk and without defining owner, frequency, evidence, and escalation.
Candidates memorize control categories as vocabulary but never specify the operational attributes that make a control testable.
What to do instead
For every control you describe, state five things: type (preventive/detective), owner, frequency, evidence produced, and escalation path. Practice converting a vague control ('management reviews transactions') into a testable one with a sample size and evidence trail.
Confusing monitoring, testing, and auditing, and concluding that a clean audit opinion means the control is effective.
The three activities overlap in practice and candidates use the words interchangeably, missing that each has a different scope, independence level, and sampling logic.
What to do instead
Anchor the distinctions: monitoring is ongoing or periodic by the business or compliance function; testing validates design and operating effectiveness against defined attributes; audit provides independent assurance. Answer scope questions by naming who performs the activity and what evidence standard applies.
Treating training as a completion-rate metric rather than a risk-based program with audience targeting, content relevance, delivery method, and effectiveness measurement.
Candidates default to 'annual training for everyone' because it is the most familiar pattern, ignoring role-based risk and measured comprehension.
What to do instead
When a stem describes a training gap, diagnose the layer: wrong audience, stale content, wrong delivery channel, or no effectiveness measurement. Prescribe the specific layer rather than adding another annual module.
Jumping to discipline or termination in an investigation scenario without addressing scope, documentation, privilege, conflicts of interest, or remediation of the underlying control failure.
Candidates focus on the dramatic outcome and forget that the exam tests process integrity and root-cause remediation.
What to do instead
Use a fixed investigation sequence: intake and triage, scope and independence, evidence preservation and documentation, findings, root-cause analysis, corrective action, and closure reporting. In any scenario, check whether the answer addresses the control that allowed the conduct, not just the person who committed it.
Choosing the answer that produces the best outcome for the company or the client when a conflict of interest, confidentiality, or professional-duty issue is present.
Candidates optimize for organizational loyalty or client service and underweight independence, disclosure obligations, and the duty to escalate.
What to do instead
Apply a fixed ethics screen to every scenario: identify the duty owed, identify who benefits, check disclosure and independence, then choose the option that preserves the professional's ability to act objectively. When two answers seem defensible, prefer the one that documents and escalates over the one that resolves quietly.