CMC (IIMC) common mistakes
CMC · Understand the traps and how to avoid them.
Treating the CMC Competence Framework as a single flat list of duties and answering scenario questions from personal job experience rather than mapping the scenario to the specific competence area and proficiency level it tests.
Candidates often study the framework headings once, then rely on intuition because the framework's structure (competence areas, levels, and behavioural indicators) is not actively rehearsed against realistic situations.
What to do instead
Build a one-page matrix of the framework's competence areas against proficiency levels. For each practice scenario, explicitly name the competence area, the level implied by the wording (for example, 'independently leads' versus 'supports under supervision'), and the behavioural indicator that justifies your answer before choosing an option.
Confusing the role of a compliance or monitoring function with the role of the first-line business or operational owner when a question asks who is accountable for a control.
Many candidates work in one part of the three-lines model and unconsciously assign all accountability to their own function, or assume the compliance team owns every control.
What to do instead
Learn the accountability split cold: the first line owns and operates controls, the second line sets frameworks and challenges, the third line provides independent assurance. Practise restating each scenario as 'who owns the risk, who monitors it, who assures it' and answer from that mapping.
Selecting the most severe or most cautious-sounding response to ethical-dilemma questions instead of the response that follows the correct escalation route and preserves evidence.
Exam anxiety and the intuitive link between compliance and caution push candidates toward 'report to the regulator immediately' or 'refuse to act' answers, which often skip internal governance steps.
What to do instead
Memorise the standard escalation ladder (line manager, then the designated compliance or ethics function, then formal reporting channels) and the duty to document. When two answers are both ethical, choose the one that escalates through the established channel and records the concern.
Answering questions about managing conflicts of interest by disclosing the conflict and then continuing unchanged, rather than applying the appropriate mitigation such as recusal, segregation, or independent oversight.
Disclosure is the most familiar and easiest control to recall, so candidates stop there and overlook that disclosure alone is rarely sufficient where the conflict is material.
What to do instead
For each conflict scenario, run a three-step test: identify the conflict, assess its materiality, then select a mitigation proportionate to it (recusal, independent review, information barriers, or declining the engagement). Treat disclosure as a minimum, not a solution.
Mixing up the purpose of a policy, a procedure, and a control when a question asks which artefact is missing or which should be updated after an incident.
In day-to-day work these documents are used interchangeably, so candidates do not hold a crisp definition of each and choose whichever term appears most often in their own organisation.
What to do instead
Fix the definitions: a policy states the rule and intent, a procedure states the steps, a control is the mechanism that prevents or detects deviation. For each question, ask what is being described (intent, steps, or mechanism) and select the matching artefact.
Ignoring the qualifying words in a question stem, such as 'first', 'most appropriate', 'immediately', or 'before any other action', and choosing a correct-but-out-of-sequence action.
Candidates read for the topic rather than the instruction, especially under time pressure, and several options are deliberately plausible in isolation.
What to do instead
Adopt a two-pass reading habit: first underline the instruction word and any sequencing constraint, then evaluate options only against that constraint. Eliminate any option that is correct in general but wrong in timing or priority.
Assuming a control that has been designed and documented is therefore operating effectively, and answering assurance questions as if design equals effectiveness.
Framework language about 'having controls in place' blurs the distinction between design and operation, and candidates without testing experience conflate the two.
What to do instead
Separate the two questions every time: is the control designed to address the risk, and is there evidence it operated throughout the period? If a scenario gives no evidence of operation, treat the control as unproven and choose the answer that requires testing or evidence.
Missing the requirement to keep records and evidence when handling a breach, complaint, or suspicious activity, and choosing an answer that resolves the issue without documenting it.
Candidates focus on the substantive resolution and treat documentation as administrative, so the audit-trail option looks like a secondary step rather than a mandatory one.
What to do instead
Treat documentation as part of the action, not a follow-up. For any incident-style question, check whether the chosen answer includes recording the decision, the rationale, and the evidence, and prefer the option that does so alongside the resolution.
Applying a single jurisdiction's regulatory habit to questions framed around cross-border or group-wide situations, where the stricter local requirement or the group standard may govern.
Candidates generalise from their own market experience and do not check whether the scenario involves multiple entities, clients, or regulators.
What to do instead
When a scenario mentions more than one country, entity, or regulator, identify the applicable standard for each and apply the stricter one unless the question states a specific rule prevails. Note in your revision the framework's expectation that group-wide standards set the floor, not the ceiling.
Running out of time because candidates over-invest in long scenario stems and then rush the shorter definitional questions where accuracy is easiest to secure.
Scenario questions feel higher-stakes, so candidates spend disproportionate minutes on them and lose the cheap marks at the end of the paper.
What to do instead
Set a per-question time budget, flag any scenario exceeding it, and move on. Bank the short definitional and framework-mapping questions first, then return to flagged scenarios with remaining time, since those marks are earned fastest.