CPP (PayrollOrg Certifications) common mistakes
CPP · Understand the traps and how to avoid them.
Selecting a specific control (CCTV, badge readers, guards) as the answer as soon as a scenario mentions a threat, without first stating what asset is at risk, what the loss event looks like, or how likely and severe it is.
Scenario stems are written to sound operationally urgent, and candidates pattern-match on familiar keywords ('theft', 'tailgating') instead of working through a risk-based reasoning chain.
What to do instead
Force a fixed sequence before looking at the options: asset at risk, threat, vulnerability, consequence, then control. Eliminate any option that treats a symptom or names hardware before the risk has been characterised.
Rejecting the correct option because it mentions cost, budget, or return on investment, and instead choosing the option that is simply the most secure or most technically thorough.
Security practitioners are trained to minimise risk, so a 'maximum protection' answer feels safest; candidates underweight the fact that this exam is written from a general-management perspective where security competes for resources.
What to do instead
When two options are both technically defensible, prefer the one that is proportionate, cost-justified, and explicitly tied to the organisation's objectives. Treat unlimited-spend or 'protect everything equally' answers as distractors.
Choosing an action that exceeds the authority of the role described in the scenario, for example having a line security manager unilaterally terminate a programme, fire an employee, or commit capital spend.
Candidates read scenarios as if they are the most senior person in the room, and they conflate 'the right thing to do' with 'the thing I personally would do next' rather than who must decide it.
What to do instead
First identify the role named or implied (officer, supervisor, security manager, CSO, outside consultant) and select the option that fits that role's authority; where the correct action is above that level, the answer is to recommend, document, and escalate to the appropriate decision-maker.
Choosing 'interview the suspect', 'search the workstation', or 'review the files' as the first step of an investigation, or accepting an answer in which evidence moves between hands without recorded transfer.
Detective-style intuition puts people and documents ahead of physical and digital evidence, and chain-of-custody is treated as a formality rather than a foundational step.
What to do instead
Apply a fixed investigative order: establish authority and scope, secure and preserve the scene and evidence, document chain of custody, then analyse, then interview. Any option that interviews first or bypasses documented custody is wrong.
Treating pre-employment screening as a single standard check applied identically to every hire, such as answering 'conduct a criminal records check' when asked how to mitigate insider risk in a high-sensitivity role.
Candidates remember that background checks exist but not that screening depth is calibrated to position sensitivity, and they forget that vetting continues after the start date.
What to do instead
Answer with risk-based, tiered screening: depth matched to the sensitivity of the position and the assets accessed, covering identity, employment history, references and credentials as appropriate, plus continuous or periodic re-evaluation and reinvestigation after hire.
Handling termination as an HR-only event and overlooking the security tasks that must be synchronised with it, such as recovering credentials and badges, revoking system access, and escorting the departing person.
Offboarding is filed mentally under human resources, so candidates do not think of it as a personnel security control, even though the departing employee is a well-documented source of loss.
What to do instead
Recall that offboarding is a joint process with a defined sequence: a pre-planned termination checklist, access revoked at or before notification, property and credentials recovered, and exit interview completed, with the same rigour applied to voluntary and involuntary departures.
Confusing the function of a physical control with the layer it sits in, for example choosing a fence as a detection measure, a lighting system as a delay measure, or an interior control when the question is about the outermost boundary.
Controls are memorised as a flat list of equipment rather than as layered systems, each layer performing deterrence, detection, delay, assessment and response functions.
What to do instead
For each physical security item, name two things before answering: which layer (perimeter, building exterior, interior, asset) and which function (deter, detect, delay, assess, respond). Reject options that misassign either.
Selecting asset-protection actions that conflict with life safety, such as ordering a lockdown or delaying egress during a fire alarm, or prioritising evidence preservation over evacuating occupants.
The exam is dominated by loss-prevention content, so candidates default to protecting property and forget that preservation of life outranks protection of assets in every situation.
What to do instead
Apply the precedence rule explicitly: life safety first, then critical operations and assets, then reputation and information. Any option that could trap or delay occupants is wrong regardless of how well it protects property.
Mislabelling the information security property at issue, for example offering encryption as the control for data that has been altered, or confusing authentication ('who you are') with authorisation ('what you may do').
Encryption and access control are over-learned as generic 'security answers', so they get selected without checking which of confidentiality, integrity or availability the scenario describes.
What to do instead
State the property at risk in one word before reading the options: disclosure means confidentiality, modification means integrity, unavailability means availability. Then choose the control that addresses that property and the access decision that matches the question.
Treating crisis management as a synonym for emergency response or business continuity, answering a reputational or supply-chain scenario with evacuation and fire-suppression steps, and omitting testing, exercising and post-incident review.
The terms overlap in everyday speech and the dramatic imagery of emergencies dominates recall, so the broader management lifecycle is under-weighted.
What to do instead
Separate the concepts: emergency response handles the immediate incident, business continuity keeps critical functions running, crisis management covers the full lifecycle of preparation, detection, containment, communication with stakeholders, recovery and post-incident review. Match the option to the lifecycle phase the scenario is actually in.