CCEP cheat sheet

Federal Sentencing Guidelines seven elements: standards and procedures; high-level oversight; due care in delegation; training and communication; monitoring, auditing, and reporting; discipline and incentives; and response and prevention.

DOJ ECCP evaluates three questions: whether the program is well designed, adequately resourced and empowered, and working in practice.

The board or a board committee holds ultimate program oversight; the compliance officer has day-to-day operational responsibility and direct access to the board.

Compliance officer authority is evidenced by stature, autonomy, adequate resources, and unrestricted access to information and personnel.

Program governance documents typically define charter, committee membership, meeting cadence, reporting lines, and decision authority.

Risk-based board reporting includes case volumes, training completion, audit findings, risk ratings, and remediation status.

A compliance committee coordinates across functions but does not replace the compliance officer's operational accountability.

Independence is compromised when business units with conflicting financial incentives can override compliance decisions.

A code of conduct states expected behaviors and core values and applies to employees, officers, directors, and often third parties.

Policies state mandatory requirements and decision rules; procedures describe the step-by-step process for meeting those requirements.

Policy lifecycle: identify need, draft, review, approve, publish, train, attest, monitor, and retire.

Version control records effective date, owner, approver, revision history, and superseded documents.

Policy exceptions require documented rationale, risk review, approval at a defined authority level, compensating controls, and an expiration date.

When local law conflicts with policy, follow the stricter requirement unless local law prohibits it, and escalate for resolution.

Acknowledgements document receipt and understanding but do not by themselves prove effective training or compliant behavior.

Policy review is risk-based and triggered by regulatory change, incident, merger, acquisition, or new business activity.

Risk is commonly calculated as likelihood multiplied by impact, using defined scales applied consistently.

Inherent risk is assessed before controls; residual risk is assessed after controls.

Risk assessment data sources include interviews, surveys, data analytics, audit findings, incidents, and external trends.

Risk ranking prioritizes high residual risk and high-velocity emerging risks for mitigation.

Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of objectives.

Third-party risk assessment covers integrity, sanctions, ownership, geography, and service criticality.

Refresh risk assessment at least annually and when laws, business model, or incidents materially change.

Mitigation plans assign an owner, action, due date, and residual risk target; the risk register records status and review date.

Monitoring is ongoing and often management-owned; auditing is independent, periodic, and systematic.

Control testing evaluates design and operating effectiveness against defined criteria using samples or data analysis.

Sampling risk is the risk that sample results differ from the population; larger samples reduce it.

KPIs measure program activity; KRIs signal emerging risk; KCIs measure control health.

Audit independence requires no operational responsibility for the area being audited.

Root cause analysis distinguishes immediate cause, contributing factors, and systemic cause.

Effectiveness evaluation links program activities to outcomes such as reduced incidents and timely remediation.

Issue management tracks finding, severity, owner, due date, evidence, and closure validation using consistent dashboard definitions.

Training is risk-based and role-based; higher-risk roles receive more frequent and deeper training.

Kirkpatrick evaluation levels are reaction, learning, behavior, and results.

Completion tracking records who, what, when, score, and attestation.

New hires complete code-of-conduct training during onboarding; existing staff complete periodic refresher training.

Training content includes realistic scenarios, policy requirements, reporting channels, and consequences.

Effectiveness evidence includes assessments, scenario exercises, observations, and outcome metrics, not completion alone.

Training records retention follows legal, regulatory, and organizational requirements.

Localization covers language, local law, culture, and job relevance.

Reporting channels include hotline, web portal, email, mail, supervisor, compliance, and ethics officer.

Anonymous reporting is available where legally permitted; anonymity may limit follow-up and investigation.

Non-retaliation protects good-faith reporters from adverse action, including threats, intimidation, isolation, and demotion.

Report triage assesses urgency, severity, legal exposure, conflicts of interest, and need for interim protective measures.

Confidentiality is need-to-know; investigations proceed promptly and rationale is documented.

A communication plan defines audience, message, channel, timing, and feedback loop.

Tone at the top is reinforced when leaders model and communicate standards consistently.

Report intake is centralized or tracked to prevent gaps and duplicate handling.

Investigation steps: intake, triage, conflict check, plan, evidence gathering, interviews, analysis, report, and closure.

Preserve evidence early, including emails, chats, logs, documents, and physical items.

Privilege depends on jurisdiction and facts; label and route legal advice appropriately.

Substantiation commonly uses a preponderance standard, meaning more likely than not.

Discipline is consistent, documented, proportionate, and applied regardless of seniority.

Enforcement includes discipline, remediation, required reporting to authorities, and monitoring.

Interview witnesses separately and document date, time, participants, questions, and responses.

Case closure memo records findings, rationale, actions, and follow-up; referral to authorities is a legal and management decision.

A corrective action plan includes root cause, action, owner, due date, evidence, and verification method.

SMART actions are specific, measurable, achievable, relevant, and time-bound.

Remediation addresses the conduct, the control gap, and the culture or incentive that enabled it.

Verification confirms implementation and effectiveness; closure requires documented evidence.

Lessons learned feed policy updates, training changes, risk assessment, and monitoring.

Program improvement uses PDCA: plan, do, check, act.

Repeat findings indicate remediation failure and require escalation.

Discipline addresses individual conduct; remediation fixes systems and controls.