BCCP study guide
BCCP · Work through your exam, one topic at a time.
The Board Certified Compliance Professional (BCCP) is a professional credential for compliance practitioners who build, run, and defend ethics and compliance programs. Candidates typically work in healthcare, financial services, life sciences, government contracting, or other regulated industries, and hold roles such as compliance officer, compliance analyst, internal auditor, privacy specialist, or risk manager. The BCCP study guide has 8 sections and about 2,420 words.
01Governance, Risk, and Compliance Program Structure
A compliance program is not a policy binder; it is a governance system with defined authority, independence, and reporting lines. Candidates must understand the three-lines model: the business owns risk (first line), compliance and risk functions set frameworks and challenge (second line), and internal audit provides independent assurance (third line).
351 words, about 2 min02Regulatory Environment and Legal Foundations
This domain covers how laws become obligations and how those obligations reach the compliance function. Candidates should understand the hierarchy of sources: statutes, regulations and rules, guidance, supervisory expectations, and enforcement actions.
310 words, about 2 min03Risk Assessment and Compliance Risk Management
Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational harm from failure to comply. Candidates must know how to build a risk assessment: identify inherent risk, evaluate control effectiveness, and derive residual risk.
340 words, about 2 min04Policies, Procedures, and Internal Controls
Policies state principles and requirements; procedures describe how work is done; controls are the mechanisms that prevent, detect, or correct failures. Candidates must understand the control environment, control types (preventive, detective, corrective; manual and automated; entity-level and transaction-level), and the control lifecycle from design through operating effectiveness testing.
309 words, about 2 min05Compliance Monitoring, Auditing, and Testing
Monitoring is ongoing, management-owned surveillance; testing is periodic, structured evaluation; auditing is independent assurance. Candidates must distinguish these and know who owns each.
278 words, about 1 min06Training and Communication
A compliance program fails if staff do not know what is expected. Candidates must understand risk-based training needs analysis, audience segmentation, content design, delivery methods, completion tracking, and effectiveness measurement.
266 words, about 1 min07Investigations, Enforcement, and Corrective Action
Candidates must know how allegations enter the program, how they are triaged, investigated, documented, and resolved, and how corrective action is designed and validated. Understand intake channels including hotlines and whistleblower reports, confidentiality, conflicts of interest, privilege, documentation standards, interview practice, substantiation findings, and discipline consistency.
276 words, about 1 min08Ethics and Professional Conduct
This domain addresses the standards expected of compliance professionals themselves: integrity, objectivity, confidentiality, competence, and avoidance of conflicts of interest. Candidates should understand codes of ethics, conflicts declarations, gifts and entertainment limits, outside activities, and the duty to escalate concerns even when inconvenient.
290 words, about 1 min