CCEP key terms

The signals senior leaders send through their words, decisions, and behavior about how seriously the organization takes ethics and compliance. It shapes whether employees believe rules apply equally to everyone.

A formal document approved by leadership that defines the compliance function's mission, scope, authority, reporting lines, and responsibilities. It establishes the function's mandate and helps preserve its independence.

A cross-functional body of senior managers that oversees the compliance program, reviews risk and investigation trends, and coordinates decisions across business units. It bridges the compliance function and operational leadership.

The senior executive accountable for designing, operating, and improving the compliance program. The role typically reports to the CEO or board and holds authority to escalate concerns independently.

The condition in which compliance professionals can raise concerns, set standards, and conduct investigations without being overruled or penalized by the business lines they oversee. Supported by reporting lines, authority, and budget.

The governing body's duty to monitor the compliance program, approve its framework, receive regular reporting, and ensure management addresses significant risks and failures.

A foundational document stating the organization's core values and the behavioral expectations that apply to all directors, employees, and often third parties. It translates ethical principles into practical, everyday guidance.

Specific, enforceable expectations describing required and prohibited behavior in defined situations. They are more detailed than a code and often underpin disciplinary decisions.

The end-to-end process for drafting, reviewing, approving, publishing, training on, and retiring policies. It ensures documents stay current, accessible, and consistent with legal and business changes.

The ranking of governing documents, from external law and the code of conduct down through policies, standards, and procedures. It resolves which document controls when requirements conflict.

Translating written requirements into workflows, controls, system prompts, and job aids so employees can follow them in daily work. It closes the gap between a document and actual behavior.

A structured process for identifying, analyzing, and prioritizing compliance risks based on likelihood and impact. Results guide where the program spends resources, training, and monitoring effort.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It provides a reference point for judging whether a given exposure needs treatment.

Inherent risk is the exposure before controls are applied; residual risk is what remains after controls operate. Comparing the two shows how much protection existing controls actually provide.

A living inventory that records identified compliance risks along with owners, ratings, existing controls, and planned treatments. It supports tracking and reporting over time.

A visual grid plotting risks by likelihood and impact so audiences can quickly see which exposures are most severe. Colors typically signal priority tiers.

A focused exercise that identifies ways employees, vendors, or others could misappropriate assets or manipulate records, and evaluates the controls meant to prevent it. Often addresses pressure, opportunity, and rationalization.

Ongoing, routine checks performed by management or compliance staff to confirm that controls and behaviors match expectations. It is closer to real-time than auditing and usually owned by the business.

Independent, periodic, and structured examination of controls and records against defined criteria. Audits provide objective assurance to leadership and often follow a formal plan and methodology.

Measurable signals that track changes in exposure or control performance, such as hotline volume trends or training completion rates. They flag emerging problems before they become incidents.

A holistic judgment, supported by data from monitoring, auditing, surveys, and incidents, about whether the compliance program is achieving its objectives. It goes beyond checking that activities occurred.

Selecting a subset of transactions, records, or locations for testing when reviewing the entire population is impractical. Sound sampling supports defensible conclusions about the whole.

A process for determining which employees need which training based on their role, risk exposure, and knowledge gaps. It prevents one-size-fits-all content.

Education tailored to the specific risks and decisions a job entails, such as sales, procurement, or finance staff. It is more relevant than generic awareness content.

Methods for judging whether training changed knowledge, attitudes, or behavior, using quizzes, observations, surveys, and downstream metrics rather than completion rates alone.

A formal acknowledgment by an employee that they have received, read, and agree to follow a policy or complete a training course. It creates a documented record of commitment.

A channel, such as a hotline, web portal, or email, through which employees and others can raise concerns or report suspected misconduct, including anonymously where permitted.

The protection that prevents adverse action against anyone who reports a concern in good faith or participates in an investigation. It is essential to keeping reporting channels credible.

An environment where employees feel safe and expected to voice concerns, question instructions, and report problems without fear of blame or payback.

A schedule that defines which compliance messages go to which audiences, through which channels, and how often. It keeps messaging consistent and measurable.

A structured, documented inquiry into alleged misconduct that gathers facts, applies relevant standards, and reaches a defensible conclusion. It should be prompt, impartial, and proportionate.

The first step of case handling: logging a report, assessing its credibility and severity, and deciding whether to investigate, refer, or close it. Triage sets priority and resources.

A legal protection for confidential communications between lawyers and clients made to obtain legal advice. In investigations it can shield certain work product if properly structured.

Applying comparable consequences to comparable misconduct regardless of rank, tenure, or business unit. Inconsistency undermines credibility and invites legal risk.

A method for moving past the immediate cause of a failure to find the underlying process, incentive, or cultural conditions that allowed it. Findings drive fixes that prevent recurrence.

A documented set of steps, owners, and deadlines designed to fix a specific deficiency identified through monitoring, audit, or an investigation. Progress is tracked to closure.

The broader work of restoring compliance after a problem, including fixing processes, disciplining or training people, compensating harm, and verifying the fix worked.

A review that extracts transferable insights from an incident or audit finding and shares them across the organization so similar failures are avoided elsewhere.

The ongoing cycle of planning, doing, checking, and adjusting program elements based on evidence. It treats compliance as a living system rather than a one-time project.