CCEP study guide
CCEP · Work through your exam, one topic at a time.
The Certified Compliance and Ethics Professional (CCEP) is a credential for practitioners who run or support an organizational ethics and compliance function - compliance officers, program managers, auditors, HR and legal professionals moving into compliance roles, and staff in health care, life sciences, financial services, and other heavily regulated sectors. It signals that the holder can design, operate, and improve a program built on the familiar elements of governance and program administration, standards and policies, risk assessment, monitoring and auditing, training and communication, reporting and non-retaliation, investigations and discipline, and corrective action. The CCEP study guide has 8 sections and about 2,524 words.
01Compliance Program Governance and Administration
Governance is about authority, independence, and accountability at the top of the program. Know the board's and senior management's oversight role, the compliance officer's stature and resources, the compliance committee's charter and cross-functional make-up, and how responsibilities map to the three lines of defense: the business owns and manages risk, compliance advises and monitors, and internal audit provides independent assurance.
377 words, about 2 min02Standards of Conduct, Policies, and Procedures
The code of conduct is the program's foundational statement of values and expectations; policies translate it into rules, and procedures into steps. Know the hierarchy: code, then policy, then procedure, then work instruction.
309 words, about 2 min03Risk Assessment
Risk assessment identifies, prioritizes, and sizes the compliance risks the program must address. Know the formula risk equals likelihood times impact; inherent versus residual risk; risk appetite and tolerance; the risk register; and the difference between enterprise, compliance, and fraud risk assessments.
315 words, about 2 min04Monitoring, Auditing, and Program Effectiveness Evaluation
Know the line between monitoring and auditing. Monitoring is ongoing and performed by management or compliance (first and second lines): transaction testing, reviews, ride-alongs, spot checks, control self-assessments.
286 words, about 1 min05Training and Education
Training transfers standards into behavior. Know risk-based and role-based curricula, onboarding versus periodic refreshers, formats (e-learning, live, scenario, manager-led), adult-learning principles, documented completion, and above all effectiveness measurement.
294 words, about 1 min06Communication, Reporting Mechanisms, and Non-Retaliation
Reporting mechanisms and non-retaliation are the program's early-warning system. Know the channel mix (hotline, web, email, ombudsman, manager, ethics line, outside vendor), 24/7 availability, anonymity versus confidentiality, translation and accessibility, and extension to contractors and suppliers.
302 words, about 2 min07Investigations, Enforcement, and Discipline
Investigations convert allegations into facts; enforcement and discipline convert findings into consequences. Know intake and triage, conflict screening, investigation planning, evidence preservation, interviews, documentation, escalation thresholds, independence, confidentiality, and consistent discipline.
316 words, about 2 min08Remediation, Corrective Action, and Program Improvement
Remediation closes the loop: fix the cause, verify the fix, and change the program so the issue does not recur. Know root cause analysis (5 Whys, fishbone), corrective and preventive action plans with named owners and dates, tracking to closure, validation testing, and feedback into the risk assessment, policies, training, and monitoring plan.
325 words, about 2 min