CLRE cheat sheet

Notice-and-comment sequence: publish a proposed rule, open a public comment period, issue a final rule responding to significant comments, then satisfy the statutory effective date (commonly 30 days after publication for substantive rules).

Legislative rules bind the public with the force of law; interpretive rules and general statements of policy announce the agency's reading of existing law and generally are exempt from notice-and-comment.

Rulemaking creates prospective, category-wide obligations; adjudication determines a named party's rights through an order issued after notice and an opportunity to respond.

Formal, on-the-record adjudication bars ex parte communications; any contact with the decision-maker about the merits must be logged and disclosed to all parties.

Judicial review: legal questions are decided de novo, formal-proceeding facts are upheld if supported by substantial evidence, and action is vacated if arbitrary, capricious, or an abuse of discretion.

Chevron deference was overruled in 2024 (Loper Bright); courts now exercise independent judgment on statutory meaning while deferring to agency fact-finding and procedural expertise.

Substantive rules require publication in the official register; agencies also publish a semiannual regulatory agenda listing pending and recently completed rulemakings.

Rules apply prospectively unless the authorizing statute permits retroactive effect; procedural and housekeeping rules commonly take effect on issuance.

Interpretive sequence: statutory text, then structure and context, then canons of construction, then legislative history, then overall purpose.

Expressio unius est exclusio alterius: express mention of one item excludes others; ejusdem generis: a general term following a specific list is limited to items of the same class.

'Shall' and 'must' are mandatory; 'may' is permissive; 'should' is hortatory and generally creates no enforceable legal duty.

Specific provisions control general ones within the same instrument; enactments on the same subject are read in pari materia, and implied repeals are disfavored.

Rule of lenity: genuine ambiguity in penal or punitive provisions is resolved in favor of the person charged; remedial statutes are construed liberally to effect their purpose.

An agency acting beyond its delegated authority is ultra vires and its action is invalid; agencies may not subdelegate authority absent statutory authorization.

Express preemption requires explicit statutory language, field preemption occupies an entire subject area, and conflict preemption applies when dual compliance is impossible.

Definitions sections govern the whole instrument; undefined terms take their ordinary meaning at the time of enactment, informed by context.

Three lines model: business management owns risk (first line), compliance and risk functions advise and monitor (second line), and internal audit gives independent assurance (third line).

Seven elements of an effective program: standards and procedures, oversight, training, monitoring and auditing, reporting, enforcement and discipline, and remediation.

Independence markers: the compliance officer has direct board or audit committee access, a documented reporting line, and a budget not controlled solely by the business.

Segregation of duties separates authorization, custody, recording, and reconciliation; where staffing is thin, documented compensating detective controls are required.

Annual code-of-conduct attestation plus role-based training creates a documented record of individual accountability and acknowledged obligations.

Policies require an owner, version control, approval date, defined review cycle, and explicit retirement of superseded versions.

Speak-up channels must permit anonymity where lawful, guarantee non-retaliation, and have defined intake, triage, and escalation timelines.

Key performance indicators measure program activity (for example, training completion); key risk indicators measure exposure and carry documented escalation thresholds.

Inherent risk = likelihood x impact; residual risk = inherent risk adjusted for the design and operating effectiveness of the controls in place.

Assessment cycle: identify obligations and threats, score likelihood, impact, and velocity, prioritize, assign controls, then monitor and refresh on a set cadence.

Design effectiveness asks whether a control as written would prevent or detect the risk; operating effectiveness asks whether it actually worked during the test period.

Sample sizes rise with control frequency and desired confidence; a passing sample supports a conclusion only for the population and period tested.

Ongoing monitoring is continuous and owned by the business; periodic monitoring and internal audit are independent, scheduled reviews reported outside the tested function.

Audit evidence must be sufficient, competent, and relevant; workpapers record criteria, testing performed, results, exceptions, and the conclusion reached.

Findings carry a severity rating, a named owner, and a target date, and remediation is tracked to validated closure rather than to a management assertion.

Exception reports and data analytics flag outliers against documented thresholds that are periodically tuned to limit false positives and blind spots.

Investigation lifecycle: intake and triage, scoping, evidence preservation, document review and interviews, analysis, reporting, and remediation with closure tracking.

An Upjohn warning tells the interviewee that counsel represents the company, that the discussion is privileged, and that the individual may wish to retain personal counsel.

A legal hold suspends routine destruction; preservation includes halting auto-deletion, imaging devices, and collecting messaging and collaboration data.

Spoliation can yield adverse inference instructions, sanctions, and separate claims; preservation duties attach when litigation or a regulatory demand is reasonably anticipated.

Enforcement instruments include subpoenas and civil investigative demands, consent orders, cease-and-desist orders, monetary penalties, debarment, and individual liability.

Cooperation credit typically requires timely voluntary disclosure, a full factual presentation, and prompt remediation; withholding or slow-rolling can forfeit credit.

Cross-border reviews must satisfy local data protection, works council, and employee-representation rules before transferring personal data or conducting interviews.

Remediation closes with root cause analysis, control redesign, consistent discipline, a look-back where harm may be widespread, and refreshed training.

Core professional duties: competence, diligence, objectivity, integrity, confidentiality, and avoidance or management of conflicts of interest.

Conflicts are managed by disclosure, recusal, or informed written consent; an undisclosed conflict undermines the reliability of conclusions and work product.

A legal hold overrides any retention schedule; destruction resumes only after the hold is formally released and the scheduled retention period has run.

Records are destroyed under an approved schedule that states the record class, retention period, custodian, and destruction method, with a destruction log.

Privileged material is labeled, circulated on a need-to-know basis, and never forwarded outside the privilege circle without counsel approval.

Data minimization and purpose limitation restrict collection and use; cross-border transfers require a documented approved legal transfer mechanism.

Contemporaneous notes are made at or near the time of the event, identify author and date, and are never altered; corrections are dated addenda.

Anti-retaliation protections extend to good-faith reporters even when the underlying allegation is ultimately not substantiated.