I85PREP
⌘ K
CHC study materials
CHC study resources

CHC (CCB) practice questions

One question at a time. Build your CHC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Standards, Policies, and Procedures

Which document type establishes mandatory requirements that an organization must follow to remain compliant with a certification program?

  1. Standard Correct answer.
  2. Guideline
  3. Policy
  4. Procedure

Explanation

A standard sets mandatory, specific requirements or specifications that must be met. Policies express management intent at a high level, while procedures describe how tasks are performed.

Question 2Standards, Policies, and Procedures

In a typical compliance documentation hierarchy, which document sits directly below the policy level and translates intent into specific requirements?

  1. Standard Correct answer.
  2. Charter
  3. Runbook
  4. Memo

Explanation

Standards operationalize policy by defining specific, measurable requirements. They occupy the tier between high-level policy and detailed procedures.

Question 3Standards, Policies, and Procedures

A compliance officer must ensure a newly written policy is formally adopted. What action best demonstrates that the policy has been approved and is in force?

  1. Obtaining documented sign-off from the designated approver Correct answer.
  2. Scheduling a training session on the topic
  3. Posting a draft on the intranet for comments
  4. Adding the policy to the document repository index

Explanation

Formal approval requires documented authorization from the individual or body with authority over the policy. Draft circulation, training, and indexing are supporting activities that do not confer approval.

Question 4Standards, Policies, and Procedures

Why do compliance frameworks require periodic review of policies and procedures?

  1. To reduce the need for employee training
  2. To increase the number of documents in the library
  3. To ensure documents remain accurate and relevant as risks and operations change Correct answer.
  4. To satisfy auditors' preference for longer documents

Explanation

Periodic review keeps documentation aligned with the current environment, legal obligations, and risk profile. Reviews also confirm that controls remain effective over time.

Question 5Standards, Policies, and Procedures

Which element is most essential for a policy document to be enforceable within an organization?

  1. A glossary of technical terms
  2. A list of software tools used
  3. A summary of past incidents
  4. Defined scope and applicability Correct answer.

Explanation

A policy must state whom it applies to and what it covers so that obligations can be assigned and enforced. Scope and applicability define the boundaries of the requirement.

Question 6Standards, Policies, and Procedures

A company stores its approved policies in a repository that records who changed each document and when. Which control does this primarily support?

  1. Version control and auditability Correct answer.
  2. Network segmentation
  3. Encryption at rest
  4. Data minimization

Explanation

Tracking authors and timestamps provides version history and an audit trail for policy changes. This supports demonstrating that documents are controlled and current.

Question 7Standards, Policies, and Procedures

What is the primary purpose of a procedure document?

  1. To rank risks by severity
  2. To declare management's overall security philosophy
  3. To list legal and regulatory obligations
  4. To describe the step-by-step actions for performing a task consistently Correct answer.

Explanation

Procedures provide detailed, repeatable instructions for carrying out activities. They translate standards and policies into consistent operational steps.

Question 8Standards, Policies, and Procedures

Which statement best distinguishes a guideline from a standard?

  1. A guideline recommends a course of action, while a standard imposes a requirement. Correct answer.
  2. A guideline is mandatory, while a standard is optional.
  3. A guideline is approved by executives, while a standard is approved by staff.
  4. A guideline applies to systems, while a standard applies to people.

Explanation

Guidelines are advisory recommendations, whereas standards contain mandatory requirements. The distinction lies in obligation, not in who approves them or what they apply to.

Question 9Standards, Policies, and Procedures

An organization adopts a framework that requires segregation of duties. Which action best implements this requirement operationally?

  1. Requiring a second authorized person to review and approve high-risk changes Correct answer.
  2. Documenting the requirement in the policy manual only
  3. Publishing the framework reference number in the intranet
  4. Assigning the same administrator to approve and execute all changes

Explanation

Segregation of duties is implemented by splitting approval and execution among different individuals. A second reviewer for high-risk changes enforces that separation in practice.

Question 10Standards, Policies, and Procedures

A compliance analyst finds that a required procedure exists but staff routinely skip a step. What is the most appropriate first response?

  1. Investigate the root cause of the deviation before deciding on corrective action Correct answer.
  2. Escalate immediately to terminate the involved staff
  3. Rewrite the policy to remove the requirement
  4. Delete the procedure as unworkable

Explanation

Deviations should be investigated to determine whether the cause is unclear instructions, impractical steps, or lack of enforcement. Corrective action follows from the identified root cause.

Question 11Standards, Policies, and Procedures

Which practice best ensures that employees understand a newly issued acceptable use policy?

  1. Relying on employees to find the policy on their own
  2. Requiring acknowledged reading and periodic awareness training Correct answer.
  3. Mentioning the policy in the annual financial report
  4. Filing the policy in the legal department only

Explanation

Awareness requires active communication and acknowledgment so that obligations are understood. Periodic training reinforces the requirements and provides evidence of compliance.

Question 12Standards, Policies, and Procedures

A policy requires that exceptions be time-bound. What is the primary reason for this requirement?

  1. To limit the duration of accepted risk and force periodic reassessment Correct answer.
  2. To eliminate the need for compensating controls
  3. To increase the number of documented exceptions
  4. To avoid the need for management approval

Explanation

Time-bound exceptions ensure that accepted risk is revisited and either remediated or formally renewed. This prevents temporary exceptions from becoming permanent unmanaged risk.

Question 13Standards, Policies, and Procedures

Which document would most appropriately specify the exact retention period and storage location for compliance records?

  1. A press release
  2. A meeting agenda
  3. A procedure or standard Correct answer.
  4. A project charter

Explanation

Specific retention periods and storage requirements belong in a standard or procedure. These documents translate record-keeping policy into actionable requirements.

Question 14Standards, Policies, and Procedures

An auditor asks how an organization ensures that only current versions of procedures are used. Which response is most appropriate?

  1. A controlled repository with version numbers and superseded documents archived Correct answer.
  2. Staff are told verbally to check for updates
  3. Procedures are printed and stored in desk drawers
  4. Each team keeps its own private copy

Explanation

Document control requires identifying the current version and preventing inadvertent use of superseded copies. A controlled repository with versioning and archiving achieves this.

Question 15Standards, Policies, and Procedures

A regulation requires annual review of a specific control, but the organization's policy mandates quarterly review. How should the organization proceed?

  1. Apply the annual schedule to systems and quarterly to people
  2. Follow the annual requirement because it is legally mandated
  3. Follow the stricter quarterly review to satisfy both obligations Correct answer.
  4. Alternate between the two schedules each year

Explanation

When an internal policy is stricter than an external requirement, meeting the stricter standard satisfies both. The organization should adopt the more demanding frequency.

Question 16Standards, Policies, and Procedures

Which characteristic most indicates that a control is preventive rather than detective?

  1. It stops an action before it occurs Correct answer.
  2. It logs activity for later review
  3. It reports exceptions after the fact
  4. It summarizes trends over time

Explanation

Preventive controls act before or during an event to stop undesired activity. Detective controls identify and report events after they occur.

Question 17Standards, Policies, and Procedures

A team wants to bypass a security standard to meet a project deadline. What is the most appropriate governance action?

  1. Require a documented risk acceptance with appropriate approval and a remediation plan Correct answer.
  2. Allow the bypass silently to preserve the schedule
  3. Permanently waive the standard for the whole organization
  4. Ignore the request until after the deadline

Explanation

Deviations from standards should be formally risk-accepted by an authorized party with a plan to remediate. This preserves accountability and tracks the residual risk.

Question 18Standards, Policies, and Procedures

Which statement best describes the relationship between a policy and a procedure?

  1. Both documents are identical in purpose and content
  2. A procedure states what must be achieved, while a policy describes how it is achieved
  3. A procedure overrides a policy whenever they conflict
  4. A policy states what must be achieved, while a procedure describes how it is achieved Correct answer.

Explanation

Policies set direction and required outcomes, and procedures define the steps to achieve them. Procedures must align with and support the governing policy.

Question 19Standards, Policies, and Procedures

An organization must demonstrate compliance with a regulatory obligation. Which artifact best provides evidence that a required control operated throughout the year?

  1. A slide deck describing the control concept
  2. A vendor brochure about the control
  3. A dated log of control executions and review sign-offs Correct answer.
  4. A statement of intent in the policy

Explanation

Evidence of operation requires records showing the control ran and was reviewed over the period. Dated logs and sign-offs demonstrate actual execution rather than intent.

Question 20Standards, Policies, and Procedures

Which approach best supports maintaining a complete inventory of an organization's policies and standards?

  1. Relying on individual departments to remember their documents
  2. Maintaining a centralized register with owners, versions, and review dates Correct answer.
  3. Storing documents only in email attachments
  4. Allowing each team to choose its own naming convention

Explanation

A centralized register provides a single authoritative view of documents, ownership, and review cycles. It supports accountability and timely review.

Question 21Standards, Policies, and Procedures

A new regulation takes effect in six months and conflicts with an existing internal standard. What is the most appropriate sequence of actions?

  1. Ignore the regulation until an auditor raises it
  2. Revise the standard without documenting the change
  3. Wait until the effective date, then revise the standard
  4. Assess the impact, update the standard, obtain approval, and communicate the change before the effective date Correct answer.

Explanation

Proactive alignment requires impact assessment, revision, formal approval, and communication ahead of the effective date. This ensures compliance at the time the regulation takes effect.

Question 22Standards, Policies, and Procedures

An organization applies a framework's baseline controls but tailors some to its environment. Which principle does this reflect?

  1. Complete rejection of the framework
  2. Framework adoption with justified tailoring Correct answer.
  3. Duplication of all controls across every system
  4. Unauthorized deviation without documentation

Explanation

Frameworks are commonly adopted with tailoring to fit organizational context, provided deviations are justified and documented. This balances standardization with practicality.

Question 23Standards, Policies, and Procedures

A compliance manager must decide whether a proposed exception creates unacceptable residual risk. Which factor is most relevant to that judgment?

  1. The seniority of the person who wrote the procedure
  2. The severity of the risk and the strength of compensating controls Correct answer.
  3. The date the underlying policy was first published
  4. The number of pages in the exception request

Explanation

Residual risk depends on the inherent risk severity and the effectiveness of any compensating controls. These determine whether the remaining risk is acceptable.

Question 24Standards, Policies, and Procedures

An auditor finds that a procedure was followed but no evidence was retained. How should this be characterized in a compliance assessment?

  1. An irrelevant finding because evidence is optional
  2. Fully compliant because the action occurred
  3. A documentation deficiency that may be reported as a control gap Correct answer.
  4. A reason to eliminate the procedure

Explanation

Without retained evidence, compliance cannot be demonstrated even if the action occurred. This is typically reported as a documentation or evidence gap.

Question 25Standards, Policies, and Procedures

An organization wants to reduce policy sprawl while preserving coverage. Which strategy is most effective?

  1. Consolidating related requirements under clear ownership with cross-references Correct answer.
  2. Letting each department publish independent overlapping policies
  3. Removing all policies to simplify operations
  4. Creating a new policy for every incident

Explanation

Consolidation with clear ownership and cross-references reduces duplication while maintaining coverage. It improves usability and reduces conflicting requirements.

Question 26Standards, Policies, and Procedures

Which element of a well-written policy statement specifies who the policy applies to?

  1. The approval signature block
  2. The scope section Correct answer.
  3. The revision history
  4. The glossary of terms

Explanation

A policy's scope section defines the people, systems, processes, and locations the policy covers, which establishes applicability. Revision history, approvals, and glossaries support the document but do not define coverage.

Question 27Standards, Policies, and Procedures

A policy states that access must be reviewed periodically but does not define how often. Which action best resolves this gap?

  1. Remove the review requirement until a frequency is agreed
  2. Issue a standard that sets a defined review interval Correct answer.
  3. Add the phrase 'as needed' to the policy text
  4. Leave the frequency to each manager's judgment

Explanation

Policies set intent and direction, while standards translate that intent into specific, measurable requirements such as a defined review interval. Leaving frequency undefined makes the requirement untestable and inconsistently applied.

Question 28Standards, Policies, and Procedures

A control owner wants to add a new mandatory step to a procedure that other teams also follow. What is the most appropriate first step?

  1. Notify the other teams after the change is published
  2. Draft a separate procedure for the owner's team only
  3. Submit the change through the document change control process Correct answer.
  4. Implement the step locally and monitor results

Explanation

Procedures that affect multiple teams should be changed through the organization's document change control process so impacts, approvals, and versioning are managed consistently. Unilateral changes create divergent versions and undermine control consistency.

Question 29Standards, Policies, and Procedures

An organization wants assurance that its documented controls remain aligned with a newly updated external framework. Which activity best provides this assurance?

  1. Increasing the frequency of internal staff meetings
  2. Performing a periodic gap assessment against the framework Correct answer.
  3. Relying on the annual employee attestation cycle
  4. Archiving the prior version of the framework

Explanation

A gap assessment compares current documented controls with the framework's requirements and identifies where alignment has drifted. Attestations confirm awareness, not control design alignment, and archiving preserves history without evaluating fit.

Question 30Standards, Policies, and Procedures

A policy requires dual approval for high-value payments, but the procedure lists only a single approver. How should a compliance analyst treat this discrepancy?

  1. Treat it as a documentation defect requiring reconciliation Correct answer.
  2. Treat it as acceptable because the procedure is more recent
  3. Treat it as out of scope because payments are a finance matter
  4. Treat it as a policy exception since the procedure is operational

Explanation

When a procedure is less stringent than the governing policy, the procedure fails to implement the required control, which is a documentation defect to be reconciled. The policy sets the minimum requirement, so a conflicting procedure cannot weaken it.

Question 31Compliance Program Administration

Which document establishes the compliance program's authority, scope, and reporting structure within an organization?

  1. The annual audit plan
  2. The marketing disclosure log
  3. The vendor onboarding checklist
  4. The compliance program charter Correct answer.

Explanation

A compliance program charter formally defines the program's mandate, scope, governance, and reporting lines, granting it authority. Operational tools like audit plans or checklists support the program but do not establish its authority.

Question 32Compliance Program Administration

A compliance officer reports to the general counsel, who also oversees the business units being monitored. What governance concern does this raise?

  1. The program has too many policies
  2. The program lacks an annual budget
  3. The audit committee meets too often
  4. Independence may be compromised Correct answer.

Explanation

Effective compliance programs require independence so that compliance can raise and escalate issues without conflicting loyalties. Reporting into a function that also owns the monitored activity can compromise objectivity and escalation.

Question 33Compliance Program Administration

Which committee typically provides independent oversight of the compliance program for a publicly traded company?

  1. The employee social club
  2. The facilities management team
  3. The sales steering committee
  4. The audit committee of the board Correct answer.

Explanation

The board's audit committee commonly oversees compliance risk and receives program reporting, providing independent governance. Operational or social committees do not carry board-level oversight responsibility.

Question 34Compliance Program Administration

A compliance risk assessment should primarily be used to do which of the following?

  1. Eliminate the need for employee training
  2. Guarantee that no violations will occur
  3. Prioritize resources toward the highest-risk areas Correct answer.
  4. Replace the internal audit function

Explanation

Risk assessments identify and rank exposures so that limited compliance resources are directed where risk is greatest. They inform but do not replace audits, training, or other controls, and they cannot guarantee zero violations.

Question 35Compliance Program Administration

A company operates in a new country and has never assessed bribery exposure there. Which action best reflects a risk-based approach?

  1. Conduct a targeted risk assessment before launching operations Correct answer.
  2. Delegate all compliance decisions to local sales staff
  3. Apply the same controls used everywhere with no review
  4. Wait for a violation before designing controls

Explanation

A risk-based approach requires assessing new or changed exposures before designing controls, so a targeted assessment should precede market entry. Uniform controls without review or waiting for a violation ignores the changed risk profile.

Question 36Compliance Program Administration

Which element is most essential for a code of conduct to be effective?

  1. It is distributed once at hire and never revisited
  2. It is kept confidential from employees
  3. It is reinforced through training and leadership example Correct answer.
  4. It is written only for senior executives

Explanation

A code of conduct is effective when it is actively communicated, reinforced by training, and modeled by leadership. One-time distribution or restricting access undermines awareness and culture.

Question 37Compliance Program Administration

An employee hotline is most effective when it offers which combination of features?

  1. Mandatory named reporting only
  2. Reporting limited to managers
  3. Reporting restricted to written memos
  4. Anonymous reporting and non-retaliation protection Correct answer.

Explanation

Hotlines work best when reporters can remain anonymous where permitted and are protected from retaliation, which encourages reporting of concerns. Restricting channels or requiring identification discourages use.

Question 38Compliance Program Administration

A compliance program's training should be designed primarily based on which factor?

  1. The number of office locations
  2. The roles and risks of the audience Correct answer.
  3. The length of the employee handbook
  4. The age of the company

Explanation

Effective training is tailored to the specific roles, responsibilities, and risks of the audience so it is relevant and actionable. Generic factors like handbook length or location count do not drive content design.

Question 39Compliance Program Administration

Which metric best indicates whether a compliance training program is achieving its purpose?

  1. The color scheme of the training materials
  2. The number of conference rooms used
  3. Completion rates combined with assessment results Correct answer.
  4. The total number of slides in the course

Explanation

Completion rates show reach, while assessment results show whether learners understood the content, together providing a meaningful effectiveness signal. Cosmetic or logistical measures do not reflect learning outcomes.

Question 40Compliance Program Administration

What is the primary purpose of a third-party due diligence process?

  1. To increase the number of vendors
  2. To evaluate risks posed by business partners before and during engagement Correct answer.
  3. To replace the company's legal department
  4. To reduce the need for internal controls

Explanation

Third-party due diligence assesses integrity, ownership, and compliance risks of partners so the company can decide whether and how to engage. It supports rather than replaces legal review or internal controls.

Question 41Compliance Program Administration

A high-risk intermediary refuses to disclose its beneficial owners. What is the most appropriate compliance response?

  1. Proceed because the contract is already signed
  2. Escalate and consider declining or conditioning the engagement Correct answer.
  3. Ask the sales team to decide
  4. Ignore the issue if the intermediary is profitable

Explanation

Refusal to disclose ownership is a red flag that should be escalated and weighed in the engagement decision, potentially leading to declining or imposing conditions. Proceeding solely for commercial reasons ignores the risk.

Question 42Compliance Program Administration

Which activity best describes continuous monitoring within a compliance program?

  1. A one-time baseline review at program launch
  2. Ongoing surveillance of transactions and controls against thresholds Correct answer.
  3. A periodic update of the employee directory
  4. An annual employee satisfaction survey

Explanation

Continuous monitoring uses ongoing, often automated surveillance of transactions and control indicators against defined thresholds to detect issues early. A one-time review or unrelated surveys do not provide continuous assurance.

Question 43Compliance Program Administration

What distinguishes an audit from monitoring in a compliance program?

  1. Monitoring requires no documentation
  2. Audits are always performed by the business unit itself
  3. Audits provide independent, structured examination of controls Correct answer.
  4. Audits occur only after a violation

Explanation

Audits are independent, structured examinations of controls and records, typically performed by internal audit or an independent function. Monitoring is ongoing and often performed by the business or compliance, and neither is limited to post-violation review.

Question 44Compliance Program Administration

Which record should a compliance program retain to demonstrate that an employee received training?

  1. A copy of the office floor plan
  2. The cafeteria menu
  3. A signed attendance or completion record with date Correct answer.
  4. The parking permit list

Explanation

Training records with dates and confirmation of completion provide evidence that required training occurred. Unrelated administrative records do not demonstrate training completion.

Question 45Compliance Program Administration

A compliance program discovers a potential violation. What is the most appropriate first step in a well-designed response process?

  1. Conduct a documented investigation to establish the facts Correct answer.
  2. Publicly announce the finding before review
  3. Discipline employees before gathering evidence
  4. Destroy related records to limit exposure

Explanation

A response process should begin with a documented, objective investigation to establish facts before conclusions or discipline. Premature disclosure, record destruction, or discipline without evidence undermines the process and may be unlawful.

Question 46Compliance Program Administration

Which practice best protects the integrity of a compliance investigation?

  1. Allowing the subject to edit interview notes
  2. Documenting evidence and maintaining confidentiality on a need-to-know basis Correct answer.
  3. Assigning the subject's close friend as investigator
  4. Sharing all details with the whole company

Explanation

Investigations should be documented and kept confidential to protect participants and preserve integrity. Using conflicted investigators or allowing subjects to alter records compromises objectivity.

Question 47Compliance Program Administration

What is the purpose of a compliance program's disciplinary framework?

  1. To reward employees for hiding issues
  2. To guarantee termination for every issue
  3. To replace the need for training
  4. To apply consistent, proportionate consequences for misconduct Correct answer.

Explanation

A consistent, proportionate disciplinary framework signals that standards are enforced and deters misconduct. It does not require termination in every case and cannot substitute for training.

Question 48Compliance Program Administration

A compliance officer wants to measure program culture. Which indicator is most informative?

  1. The number of desks in the office
  2. Survey results on comfort raising concerns plus reporting trends Correct answer.
  3. The average length of meetings
  4. The color of the compliance posters

Explanation

Culture is best gauged through employee perceptions, such as willingness to raise concerns, combined with reporting trends that reveal whether concerns surface. Physical or logistical measures do not reflect culture.

Question 49Compliance Program Administration

Which of the following best describes the role of a compliance committee within a program?

  1. To coordinate cross-functional oversight of compliance risks and decisions Correct answer.
  2. To handle only payroll processing
  3. To replace the board of directors
  4. To manage the company's social media accounts

Explanation

A compliance committee brings together functions to coordinate oversight, share risk information, and make or recommend compliance decisions. It does not replace the board or handle unrelated operational tasks.

Question 50Compliance Program Administration

An organization wants to ensure its policies remain current. Which practice is most appropriate?

  1. Set a periodic review cycle with assigned owners and version control Correct answer.
  2. Review policies only when a lawsuit occurs
  3. Never revise policies once published
  4. Let each employee maintain a personal copy

Explanation

Policies should be reviewed on a defined cycle by assigned owners, with version control to track changes and approvals. Never revising or reviewing only after litigation leaves policies outdated.