CCEP flashcards
CCEP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Seven elements
- The Federal Sentencing Guidelines compliance program elements: standards, oversight, training, monitoring and auditing, reporting, discipline, and response and remediation.
- Compliance officer authority
- The compliance officer needs stature, autonomy, adequate resources, and direct access to the board to operate the program independently of business pressures.
- Board oversight
- The board or a board committee holds ultimate responsibility for program oversight, receives regular risk-based reporting, and ensures program resources.
- Compliance committee role
- A cross-functional committee coordinates program activities, reviews risks and incidents, and supports the compliance officer without replacing operational accountability.
- Code of conduct
- A code states expected behaviors and core values and applies to employees, officers, directors, and often third parties acting for the organization.
- Policy versus procedure
- A policy states mandatory requirements and decision rules; a procedure describes the step-by-step process used to meet those requirements.
- Policy lifecycle
- The sequence from need identification through drafting, review, approval, publication, training, attestation, monitoring, and retirement of a policy.
- Policy exception
- A documented deviation approved at a defined authority level with rationale, risk review, compensating controls, and an expiration date.
- Inherent versus residual risk
- Inherent risk is assessed before controls; residual risk is the remaining risk after existing controls are considered and rated.
- Risk scoring formula
- Risk is commonly calculated as likelihood multiplied by impact, using defined scales applied consistently across the risk register.
- Risk appetite
- Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives.
- Third-party risk
- Assessment of vendors and partners for integrity, ownership, sanctions, geography, and service criticality before and during the relationship.
- Monitoring versus auditing
- Monitoring is ongoing and often management-owned; auditing is independent, periodic, and systematic evaluation against defined criteria.
- Control testing
- Control testing evaluates whether a control is designed properly and operates effectively over a period using samples or data analysis.
- Root cause analysis
- A method that identifies the immediate cause, contributing factors, and systemic cause of an issue so remediation addresses recurrence.
- KPI KRI KCI
- KPIs measure program activity, KRIs signal emerging risk, and KCIs measure control health; each requires clear definitions and data sources.
- Kirkpatrick levels
- Training evaluation levels are reaction, learning, behavior, and results, moving from satisfaction to on-the-job change and outcomes.
- Risk-based training
- Training frequency and depth are assigned according to role risk, regulatory exposure, geography, and prior incidents or findings.
- Training completion tracking
- Records capture who completed which training, when, the score, and any attestation, supporting accountability and audit evidence.
- Training effectiveness evidence
- Assessments, scenario exercises, observations, and outcome metrics provide stronger evidence than completion rates alone for training effectiveness.
- Non-retaliation
- Protection from adverse action for good-faith reporting, including threats, intimidation, isolation, demotion, or exclusion from opportunities.
- Speak-up channels
- Reporting routes include hotline, web portal, email, mail, supervisor, compliance, and ethics officer, and should be widely communicated.
- Report triage
- Triage assesses urgency, severity, legal exposure, conflicts of interest, and need for interim protective measures before investigation.
- Tone at the top
- Leaders reinforce standards when their communications and decisions consistently model expected conduct and support speaking up.
- Investigation plan
- A plan defines scope, allegations, witnesses, documents, timeline, roles, confidentiality, and potential conflicts before evidence gathering.
- Evidence preservation
- Promptly collect and preserve emails, chats, logs, documents, and physical items to prevent loss or alteration during an investigation.
- Substantiation standard
- Workplace investigations commonly apply a preponderance standard, meaning it is more likely than not that the conduct occurred.
- Consistent discipline
- Discipline is documented and proportionate, considers prior practice and aggravating factors, and applies regardless of seniority.
- Corrective action plan
- A plan records root cause, corrective action, owner, due date, evidence, and verification method for closing a control gap.
- SMART remediation
- Actions are specific, measurable, achievable, relevant, and time-bound so progress and completion can be objectively verified.
- Remediation verification
- Verification confirms that corrective actions were implemented and effective; closure requires documented evidence and validation.
- Lessons learned
- Post-incident review identifies policy, training, monitoring, and culture changes that reduce recurrence and improve the program.