First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1Compliance Program Governance and Administration
Who holds ultimate responsibility for oversight of an organization's compliance program?
- The board of directors Correct answer.
- The general counsel
- The internal audit function
- The chief compliance officer
Explanation
The governing board retains ultimate oversight responsibility for the compliance program, while management runs the program day to day. Regulators and sentencing frameworks expect directors to be informed about and engaged with compliance risk. The compliance officer reports upward but does not hold ultimate oversight authority.
Question 2Compliance Program Governance and Administration
Which reporting arrangement best supports an independent compliance function?
- The head of internal audit, to preserve organizational independence
- The chief financial officer, to align with budgeting cycles
- The chief executive officer, with a direct reporting line to the board Correct answer.
- The general counsel, to consolidate all legal and compliance advice
Explanation
Best practice places the compliance officer at a senior level reporting to the chief executive, with direct and unfettered access to the board or a board committee. This structure keeps compliance from being subordinated to business lines whose incentives may conflict with it.
Question 3Compliance Program Governance and Administration
In compliance program terms, what does 'tone at the top' describe?
- The number of policies published each year by the compliance team
- The tagline used in the organization's external advertising campaigns
- The size of the compliance budget relative to total company revenue
- Leaders visibly demonstrating commitment to compliance Correct answer.
Explanation
Tone at the top refers to the conduct and messaging of directors and senior executives, which employees treat as the real standard of conduct. Visible leadership commitment makes a program credible in a way that documents alone cannot.
Question 4Compliance Program Governance and Administration
What is the primary purpose of an organization's code of conduct?
- Stating the standards of conduct expected of personnel Correct answer.
- Replacing the need for compliance training and monitoring
- Listing every sanction available for misconduct
- Guaranteeing that no employee ever breaks the law
Explanation
A code of conduct communicates the organization's values and the standards expected of directors, employees, and often third parties. It is a foundational document, but it cannot by itself ensure lawful conduct.
Question 5Compliance Program Governance and Administration
Why is a written compliance program charter or framework important?
- It assigns duties, authority, and accountability Correct answer.
- It reduces the cost of compliance training each year
- It satisfies external marketing and branding requirements
- It guarantees employees will read and follow the rules
Explanation
A charter or program framework documents roles, authority, and reporting relationships, which supports accountability and is expected by regulators and prosecutors. Without documented responsibilities, oversight gaps and duplicated effort tend to appear.
Question 6Compliance Program Governance and Administration
What is the essential design feature of a compliance reporting hotline?
- Used mainly to obtain legal advice from outside counsel
- Operated by the sales team to speed up resolution
- Restricted to senior managers so reports stay confidential
- Available to all personnel, with anonymity where permitted by law Correct answer.
Explanation
A speak-up mechanism should be open to all personnel and, where local law allows, permit anonymous reporting, backed by anti-retaliation protections. Broad availability improves early detection of misconduct.
Question 7Compliance Program Governance and Administration
Which feature most improves the effectiveness of compliance training?
- Delivered once at hire and never repeated
- Tailored to the audience's role and risk, and documented Correct answer.
- Maximized in length to cover every policy in detail
- Delivered exclusively by outside law firms
Explanation
Training should be risk-based and tailored to what each audience actually does, with attendance and completion documented so the program can be verified and updated. Generic, one-time sessions rarely change behavior.
Question 8Compliance Program Governance and Administration
Before engaging a sales agent in a higher-risk market, what should the company do?
- Complete the review after the contract has been signed
- Screen the third party for sanctions and integrity risk Correct answer.
- Skip checks for relationships that have lasted several years
- Rely on the third party's own written certification of integrity
Explanation
Risk-based integrity due diligence, including sanctions and watchlist screening for higher-risk parties, is a core third-party control and must occur before engagement. Reputational and legal exposure is greatest where intermediaries interact with government officials.
Question 9Compliance Program Governance and Administration
How should a compliance risk assessment be conducted?
- Limited to quantitative financial modeling by internal audit
- Delegated entirely to outside counsel every year
- A one-time exercise completed when the program is first launched
- Periodic, documented, and refreshed when risks change Correct answer.
Explanation
A risk assessment should be repeated periodically and updated when the business, markets, or regulatory environment change so that resources follow the highest risks. It should be documented so the rationale and conclusions can be reviewed.
Question 10Compliance Program Governance and Administration
How does compliance monitoring differ from compliance auditing?
- Required only after a significant compliance failure
- Limited to the review of financial reporting controls
- Performed only by external auditors on an annual basis
- Ongoing, management-led checking that processes work as designed Correct answer.
Explanation
Monitoring is the ongoing, management-owned checking of whether processes are followed, while auditing is periodic and typically performed independently. Both feed the continuous improvement of the program.
Question 11Compliance Program Governance and Administration
How often should the compliance function report to the board?
- Only when a regulator makes a specific request
- On a regular schedule, and promptly for significant issues Correct answer.
- Only with the prior approval of the chief executive officer
- Only at the annual shareholder meeting
Explanation
Regular scheduled reporting keeps the board informed of risk and program performance, and significant issues should be escalated promptly rather than held for the next meeting. Gating board access through management weakens oversight.
Question 12Compliance Program Governance and Administration
Which condition best indicates that the compliance function is adequately resourced?
- A budget controlled by the sales organization to ensure alignment
- Complete outsourcing of all compliance activities to a law firm
- Staffing drawn mainly from part-time volunteers across the business
- Adequate resources and independent stature to raise concerns Correct answer.
Explanation
Effective programs give compliance sufficient funding, qualified staff, and organizational standing so that concerns can be raised without fear of reprisal. Prosecutors and regulators examine whether the function is empowered to act on the risks it identifies.
Question 13Compliance Program Governance and Administration
How should compliance training records and investigation files be retained?
- Only until the next internal audit has been completed
- Per a documented retention schedule set by legal requirements Correct answer.
- Indefinitely, without exception, in every jurisdiction
- Destroyed within thirty days of the matter being closed
Explanation
Records should be kept according to a documented retention schedule that reflects legal, regulatory, and litigation-hold obligations. Retention decisions made ad hoc create both spoliation and over-retention risk.
Question 14Compliance Program Governance and Administration
How can an organization best reinforce compliant behavior through its people processes?
- Include compliance conduct in performance and pay decisions Correct answer.
- Reward only sales results so that incentives stay simple for staff
- Avoid discussing compliance during appraisal conversations
- Tie bonuses solely to revenue growth targets for the sales force
Explanation
Including compliance conduct in performance evaluations and compensation decisions signals that results must be achieved lawfully. Incentives that reward only revenue undercut the program's credibility.
Question 15Compliance Program Governance and Administration
What is the appropriate role of compliance due diligence in a merger or acquisition?
- Rely entirely on the target's audited financial statements
- Begin only after the deal has closed and integration is complete
- Limited to tax and accounting review of the target
- Assess the target's risk and misconduct history before closing Correct answer.
Explanation
Pre-closing compliance due diligence identifies successor liability and misconduct risk while the buyer can still price, negotiate, or walk away. Integration planning should then extend the program to the acquired operations promptly.
Question 16Compliance Program Governance and Administration
When an allegation of misconduct is first received, what should happen?
- Confront the accused in a group meeting to gather facts quickly
- Wait for the next scheduled internal audit to begin work
- Announce the allegation to all staff to encourage witnesses
- Assess the allegation, preserve evidence, and scope the review Correct answer.
Explanation
The initial phase should assess credibility and severity, preserve documents and data, define the scope, and keep the matter confidential. Premature disclosure risks evidence destruction and unfair harm to individuals.
Question 17Compliance Program Governance and Administration
Why does consistent discipline matter to a compliance program?
- It removes the need for ongoing monitoring and auditing
- It shows that misconduct has consequences, reinforcing credibility Correct answer.
- It reduces legal fees by preventing all regulatory inquiries
- It replaces the need for training and communications
Explanation
Consistent, documented discipline demonstrates that standards are enforced regardless of seniority or performance, which is central to program credibility. Inconsistent enforcement signals that rules are optional.
Question 18Compliance Program Governance and Administration
How should a company extend its compliance program to business partners?
- A single reference check completed at first engagement
- Risk-based due diligence, contract terms, and ongoing oversight Correct answer.
- Verbal commitments obtained by the sales organization
- Informal assurances and handshakes between business owners
Explanation
Third-party risk is managed through risk-based due diligence, compliance representations, audit and termination rights in contracts, and ongoing oversight such as training and monitoring. One-time or informal measures do not sustain control.
Question 19Compliance Program Governance and Administration
Which approach best gauges whether a compliance culture is healthy?
- Survey employees and analyze training, hotline, and exit data Correct answer.
- Rely mainly on the chief executive's personal impressions
- Track only revenue growth as a reliable proxy for culture
- Count the number of pages published in the code of conduct
Explanation
Culture is best assessed through multiple indicators, such as employee surveys, hotline and case metrics, training completion, exit interviews, and investigation trends. Triangulating data reveals gaps that a single measure would hide.
Question 20Compliance Program Governance and Administration
How does a board committee best preserve the independence of its compliance oversight?
- Holding periodic executive sessions without management present Correct answer.
- Delegating all oversight duties permanently to line management
- Reviewing only the reports that management chooses to provide
- Meeting only after a crisis has already occurred
Explanation
Executive sessions without management allow directors to probe concerns candidly and to hear directly from compliance and audit leaders. Regular private discussion is a recognized governance safeguard.
Question 21Compliance Program Governance and Administration
What three questions frame the U.S. Department of Justice Criminal Division's evaluation of corporate compliance programs?
- Whether the program is designed, resourced, and works in practice Correct answer.
- Whether every employee signs an annual certification form
- Whether the company has published a lengthy code of conduct
- Whether compliance staff hold formal legal qualifications
Explanation
The guidance frames evaluation around whether a program is well designed, whether it is adequately resourced and empowered to function, and whether it works in practice. Document existence alone does not establish effectiveness.
Question 22Compliance Program Governance and Administration
Which item is one of the six guiding principles for adequate procedures under the UK Bribery Act framework?
- Mandatory arbitration of all bribery disputes
- Penalties calculated as a share of global revenue
- Proportionate procedures, one of six guiding principles Correct answer.
- Annual certification by every employee worldwide
Explanation
The adequate procedures guidance sets out six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication including training, and monitoring and review. The principles are outcome-focused rather than a prescriptive checklist.
Question 23Compliance Program Governance and Administration
Which set of elements reflects the compliance program hallmarks in the U.S. Federal Sentencing Guidelines for Organizations?
- High-level oversight, training, monitoring, and discipline Correct answer.
- A written guarantee that no violation will occur
- Registration of the program with the Justice Department
- Annual external audits of every business unit
Explanation
The guidelines' hallmarks include high-level oversight, standards and procedures, training, monitoring and auditing, incentives and discipline, and remediation after detected misconduct. Together these define what is generally expected of an effective program.
Question 24Compliance Program Governance and Administration
What governance risk arises when one person serves as both general counsel and chief compliance officer?
- Greater independence, because legal privilege protects the role
- No meaningful conflict, because legal and compliance align fully
- A statutory bar in most jurisdictions on combined roles
- A tension between legal advocacy and independent oversight Correct answer.
Explanation
The general counsel advocates for the organization's legal position, while the compliance officer must independently challenge business conduct when necessary. Combining the roles can compromise that challenge function, so safeguards such as board access and clear mandate are used to mitigate the tension.
Question 25Compliance Program Governance and Administration
How should an organization test whether its compliance program is working in practice?
- Assuming effectiveness because no enforcement action has occurred
- Relying on the existence of a published code of conduct
- Counting policies and assuming compliance if none fail
- Testing controls and sampling transactions to see what works Correct answer.
Explanation
Effectiveness is judged by testing whether controls operate as designed, for example by sampling transactions, reviewing training and approval records, and analyzing hotline and investigation data. The absence of detected problems may reflect weak detection rather than good conduct.
Question 26Compliance Program Governance and Administration
What is the primary purpose of a compliance program charter?
- To list every law and regulation the company follows
- To establish the program's mandate and authority Correct answer.
- To summarize product features and target markets
- To record investigation outcomes and discipline
Explanation
A compliance program charter is a governance document that establishes the program's mandate, authority, independence, responsibilities, and reporting lines. It does not serve as a legal inventory, an investigation log, or a marketing description.
Question 27Compliance Program Governance and Administration
A company has a cross-functional compliance committee. Which responsibility belongs to that committee rather than to the CCO alone?
- Maintaining the daily investigation case log
- Resolving issues that need cross-functional action Correct answer.
- Making final decisions on every sales transaction
- Preparing the company's financial statements for audit
Explanation
A cross-functional compliance committee provides coordinated oversight and resolves program issues that require input or action from multiple functions. The CCO administers the program, while transaction approvals and financial reporting remain with operating and finance roles.
Question 28Compliance Program Governance and Administration
What is the board's core compliance oversight responsibility?
- Approving each customer due diligence file
- Overseeing the program through regular reporting Correct answer.
- Conducting individual misconduct investigations
- Drafting operational compliance procedures
Explanation
The board oversees the compliance program by setting expectations, reviewing program effectiveness, and receiving regular reporting from management. It does not conduct investigations, approve individual due diligence files, or draft procedures.
Question 29Compliance Program Governance and Administration
A CCO is routinely excluded from board meetings unless the CEO approves. What governance improvement is most appropriate?
- Have the CCO report only through the sales director
- Assign compliance oversight to the finance department
- Give the CCO direct access to the board committee Correct answer.
- Limit board compliance updates to the annual meeting
Explanation
Effective compliance governance gives the CCO direct, unfiltered access to the board or a board committee, including the ability to raise concerns without management filtering. This access supports independence and timely escalation.
Question 30Compliance Program Governance and Administration
A business unit wants to depart from a compliance policy for a commercial opportunity. What should the governance process require?
- Automatic approval if revenue exceeds a threshold
- A verbal approval from the requesting manager
- Documented approval by the designated authority Correct answer.
- No record if the departure lasts less than one year
Explanation
Policy exceptions should be limited, approved at the appropriate level, documented, and tracked so that the organization knows where deviations exist and can monitor them. Verbal, automatic, or unrecorded exceptions undermine accountability.
Question 31Compliance Program Governance and Administration
How should a compliance risk appetite statement guide program administration?
- It applies only to the internal audit function
- It guarantees that no compliance failures will occur
- It sets risk boundaries and informs program priorities Correct answer.
- It replaces the need for a compliance risk assessment
Explanation
A risk appetite statement defines the level and types of compliance risk the organization is willing to accept and helps prioritize program resources and controls. It does not replace risk assessment or eliminate the possibility of failures.
Question 32Compliance Program Governance and Administration
Under the three lines model, what is the compliance function's typical role?
- Setting the company's strategic business objectives
- Advising and monitoring first-line risk activity Correct answer.
- Owning and managing risk in daily business operations
- Providing independent assurance to the board
Explanation
In the three lines model, the first line owns and manages risk, the second line advises and monitors, and the third line provides independent assurance. Compliance typically sits in the second line.
Question 33Compliance Program Governance and Administration
What is the most effective way to administer regulatory change management?
- Identify, assess, assign, implement, and verify changes Correct answer.
- Wait for regulators to request updated procedures
- Assign changes only to the legal department without tracking
- Update policies only when a violation is found
Explanation
Regulatory change management should use a structured process to identify new requirements, assess their impact, assign responsibility, implement changes, and verify completion. Waiting for enforcement or requests creates avoidable compliance risk.
Question 34Compliance Program Governance and Administration
What should a risk-based annual compliance plan include?
- Only activities required by the sales department
- Every possible regulation without prioritization
- A list of all employees' personal investments
- Prioritized actions, owners, and progress metrics Correct answer.
Explanation
An annual compliance plan translates the risk assessment into prioritized activities, assigned owners, timelines, and measures of progress. It should be risk-based rather than driven solely by one function or an undifferentiated list of regulations.
Question 35Compliance Program Governance and Administration
In a decentralized company, how should local compliance officers' reporting lines be structured?
- Report to the sales manager whose targets they monitor
- Report only to internal audit for daily decisions
- Report only to the local business head with no functional oversight
- Functional line to the CCO plus local administrative line Correct answer.
Explanation
Local compliance officers typically have a functional reporting line to the CCO to preserve independence and consistency, plus a local administrative line for day-to-day coordination. Reporting solely to the business they monitor creates a conflict of interest.
Question 36Compliance Program Governance and Administration
Which governance arrangement best protects the compliance function's ability to challenge business decisions?
- Compliance leaders selected by the sales leadership
- Compliance staff evaluated mainly on sales growth
- Defined authority and independent escalation channels Correct answer.
- Compliance budget controlled by the business units it monitors
Explanation
Independence is protected when compliance has clearly defined authority, access to information, and escalation channels that do not depend on the business units it oversees. Commercial performance measures and business-controlled budgets can undermine objectivity.
Question 37Standards of Conduct, Policies, and Procedures
Which group should an organization's code of conduct apply to?
- Only senior executives and members of the board of directors
- All personnel, including directors, officers, and employees Correct answer.
- Only employees who work in the compliance and legal functions
- Only employees who have direct contact with customers or regulators
Explanation
A code of conduct expresses expectations that apply across the entire organization, from the board and senior executives to the newest employee, regardless of function. Limiting its reach to particular groups would leave significant risk areas uncovered. Many organizations also extend equivalent expectations to agents and other third parties acting on their behalf.
Question 38Standards of Conduct, Policies, and Procedures
Which statement best distinguishes a policy from a procedure?
- A policy applies to managers, while a procedure applies only to frontline staff
- A policy sets a required rule or principle; a procedure explains how to apply it Correct answer.
- A policy is always approved by the board, while a procedure is approved by regulators
- A policy describes step-by-step tasks, while a procedure sets the overall principles
Explanation
A policy states a requirement, standard, or principle that must be followed. A procedure translates that requirement into specific steps, responsibilities, and controls so that it can be carried out consistently. The two documents serve different but complementary functions.
Question 39Standards of Conduct, Policies, and Procedures
Why do organizations require employees to sign an annual acknowledgement of the code of conduct?
- To document that expectations were received and to reinforce individual commitment Correct answer.
- To replace the need for ongoing training on ethical standards
- To satisfy a requirement that every employee be certified as an ethics expert
- To transfer legal liability for misconduct from the organization to the individual employee
Explanation
An acknowledgement creates a record that the individual received and agreed to follow the standards, and it prompts the employee to read them again. It reinforces personal accountability rather than shifting legal liability. It complements, but never replaces, training and other program elements.
Question 40Standards of Conduct, Policies, and Procedures
An employee is unsure whether a planned action is consistent with the organization's standards. What does a well-designed compliance program expect the employee to do?
- Proceed if the action benefits the organization financially
- Pause and seek guidance before acting Correct answer.
- Rely on the practice of peers in similar situations
- Act first and disclose the action only if a problem later arises
Explanation
Standards of conduct are supported by channels for asking questions and raising concerns before a decision is made. Employees are expected to stop and seek guidance when the answer is unclear, which prevents problems rather than reacting to them. Financial benefit and common practice are never justifications for departing from the standards.
Question 41Standards of Conduct, Policies, and Procedures
When a local law conflicts with an organization's internal policy, what is the generally accepted standard?
- The internal policy controls because it is written by the organization
- The stricter of the two requirements generally applies Correct answer.
- Whichever requirement is more convenient for the business unit applies
- The employee chooses which requirement to follow and documents the choice
Explanation
Organizations typically require personnel to comply with both applicable law and internal policy, and where they diverge the more restrictive requirement governs. This avoids a gap in which conduct permitted internally would violate the law. Ambiguity should be escalated rather than resolved by individual preference.
Question 42Standards of Conduct, Policies, and Procedures
What writing style best supports effective standards of conduct?
- Brief slogans without explanation of expectations
- Technical terminology that demonstrates regulatory expertise
- Plain language that the intended audience can understand and apply Correct answer.
- Dense legal drafting that mirrors the underlying statutes
Explanation
Standards only shape behavior if the people expected to follow them can understand them. Plain language, concrete examples, and clear expectations improve comprehension and application. Overly technical or purely slogan-based drafting reduces practical usefulness.
Question 43Standards of Conduct, Policies, and Procedures
Which approach best describes sound policy lifecycle management?
- Policies are reissued whenever a new executive joins the organization
- Policies are written once at launch and revised only after a violation occurs
- Policies are reviewed annually by the communications team for tone
- Policies carry an owner and a review schedule and are updated when risks or rules change Correct answer.
Explanation
Effective policy management assigns accountability to a named owner and sets a periodic review cycle, supplemented by event-driven updates when laws, risks, or business processes change. This keeps documents accurate and defensible. Reactive or purely cosmetic review does not achieve that.
Question 44Standards of Conduct, Policies, and Procedures
A senior executive requests an exception to a provision of the code of conduct. What is the generally recommended practice?
- The executive's direct manager may approve the exception without any documentation or review
- The compliance function grants the exception if the business case is strong
- Exceptions for executives are unnecessary because the code is advisory for leaders
- Approval is escalated to the board or its committee, with disclosure as required Correct answer.
Explanation
Waivers of code provisions for executive officers and directors are typically elevated to the board or a designated board committee rather than handled within management. The decision is documented, time-bound, and disclosed where law or listing rules require. This protects the credibility of the standards and avoids conflicts of interest.
Question 45Standards of Conduct, Policies, and Procedures
A multinational company adapts its global anti-bribery policy for a local subsidiary. What constraint applies?
- The local version may omit the policy if local law does not address bribery
- The local version must be drafted by external counsel to be valid
- The local version may add requirements but may not be less strict than the global standard Correct answer.
- The local version may be relaxed where local business customs differ
Explanation
Localization allows a policy to reflect local law, language, and operating realities, but it cannot dilute the global baseline. The local version may be stricter or more specific, never weaker. Many laws also apply extraterritorially, so the absence of local anti-bribery law does not remove the requirement.
Question 46Standards of Conduct, Policies, and Procedures
What is a primary responsibility of a designated policy owner?
- Personally investigating every alleged violation of the policy
- Transferring the policy to the compliance function once it is published
- Auditing the organization's financial statements for accuracy
- Keeping the policy current and confirming it reflects actual practice Correct answer.
Explanation
A policy owner is accountable for the content and ongoing relevance of the document, including periodic review and confirmation that practice matches the written requirement. Investigations and financial auditing are separate functions. Ownership does not end at publication.
Question 47Standards of Conduct, Policies, and Procedures
Why is version control important for compliance policies?
- It ensures only current, approved documents are in use and supports audit trails Correct answer.
- It reduces the amount of training that employees must complete
- It permits draft policies to circulate before management approval
- It allows employees to select the version that best fits their business needs
Explanation
Version control ensures that the operative, approved version is identifiable and that superseded drafts are withdrawn. It also creates a record of what was in force at a given time, which is valuable during audits and investigations. Employees do not choose whichever version suits them.
Question 48Standards of Conduct, Policies, and Procedures
How should training on standards of conduct be designed?
- It should use one identical module for every employee worldwide
- It should focus on legal theory rather than practical scenarios
- It should be tailored to the risks and decisions of each audience Correct answer.
- It should be delivered only when an employee is promoted
Explanation
Risk-based training concentrates effort where decisions create the greatest exposure, so content is adapted for different roles, functions, and geographies. Scenario-based material helps learners apply principles to realistic choices. A single uniform module or purely theoretical content is less effective.
Question 49Standards of Conduct, Policies, and Procedures
A workforce spread across several countries speaks many languages. What is the recommended approach for communicating standards?
- Require employees to learn the headquarters language before receiving the code
- Provide materials only in the language used at headquarters
- Rely on managers to verbally translate policies as questions arise
- Make standards available in the languages the workforce understands Correct answer.
Explanation
Standards are only enforceable and effective when the people bound by them can read and understand them. Translating codes, policies, and training into the languages of the workforce is a common expectation. Relying on ad hoc verbal translation creates inconsistency and weakens the record of communication.
Question 50Standards of Conduct, Policies, and Procedures
What does 'tone at the top' most directly refer to?
- The seniority level of the compliance officer
- The visual design of the organization's code of conduct
- The volume of policies issued by the executive team
- Leaders visibly modeling and enforcing the standards they set Correct answer.
Explanation
Tone at the top describes the signals leaders send through their own conduct and through the decisions they reward, tolerate, or punish. Employees calibrate their behavior to what leadership actually does, not to what documents say. Visible modeling and consistent enforcement are the substance of that tone.