ICG AC (CGCAT) common mistakes
ICG AC (CGCAT) · Understand the traps and how to avoid them.
Treating 'facilitation payment' as a synonym for 'bribe' and marking every small payment to a low-level official as prohibited under the UK Bribery Act, instead of distinguishing the two concepts and then applying the Act's no-exception rule separately.
Candidates learn the FCPA's narrow facilitation-payment exception and the UK Bribery Act's absence of one, then collapse the two into a single definition. The exam tests both the conceptual distinction and the jurisdictional difference, so the conflation produces errors on either side.
What to do instead
Memorise a two-step routine: first classify the payment (routine, non-discretionary, low-level official action = facilitation payment in FCPA terms), then apply the relevant statute. Under the FCPA it may fall within the exception if recorded properly; under the UK Bribery Act there is no exception and it is a bribe. Practise stating both answers for the same fact pattern.
Assuming the UK Bribery Act has the same jurisdictional reach as the FCPA, i.e. that it only applies where a UK national or UK-incorporated entity is involved, or conversely that the FCPA applies to any foreign company with any US connection.
Both statutes are taught together, and candidates remember 'territorial' versus 'nationality' labels without the detail: the Bribery Act's section 7 corporate offence captures commercial organisations carrying on a business in the UK regardless of where the bribe occurs, and the FCPA's books-and-records and issuer provisions can reach foreign subsidiaries whose results are consolidated by a US issuer.
What to do instead
Build a one-page jurisdiction matrix with rows for FCPA anti-bribery, FCPA accounting provisions, Bribery Act sections 1, 2, 6 and 7, and columns for who is covered and where the conduct occurred. For each practice question, identify the entity's nexus before selecting an answer.
Answering third-party due diligence questions by choosing the most intensive option (full enhanced diligence on every counterparty) or the least intensive (self-certification only), rather than risk-based, tiered diligence proportionate to the identified corruption risk.
Candidates equate 'best practice' with 'maximum effort' and overlook that the OECD Good Practice Guidance and most enforcement settlements expect risk-based proportionality. Over-diligence is a real answer trap because it looks safest.
What to do instead
Internalise a three-tier model (low, medium, high risk) with defined triggers for each tier, and always ask what red flag in the stem raises or lowers the risk. Select the answer that matches diligence intensity to the specific risk indicator described, not the most or least burdensome option.
Identifying red flags correctly but then failing to state the required follow-through, e.g. flagging an unusually large success fee but not escalating, withholding payment, or documenting the resolution.
Red-flag questions are often written so that the flag is obvious, and candidates stop reading once they spot it, choosing an option that merely 'notes' or 'monitors' the issue rather than one that requires escalation and a documented decision.
What to do instead
For every red-flag question, apply a fixed chain: identify the indicator, pause or condition the payment, escalate to compliance or the relevant committee, conduct enhanced diligence, document the rationale, and only then proceed or terminate. Choose the option that completes the chain rather than one that stops at detection.
Confusing the role of gifts and hospitality registers with the substantive test, and answering that any gift above a fixed monetary threshold is automatically a bribe or automatically permitted.
Candidates look for a bright-line number, but there is no universal threshold in the FCPA or Bribery Act; the test is intent, proportionality, transparency and whether the benefit is intended to influence improperly. Fixed thresholds are internal policy tools, not legal safe harbours.
What to do instead
Answer using the substantive criteria: purpose, value relative to the recipient's position, timing relative to a decision, transparency and recording, and whether it could create a sense of obligation. Treat any stated monetary limit as a policy trigger for approval, not as a legal defence.
Treating the FCPA's books-and-records and internal controls provisions as merely technical accounting rules, and missing that they can be violated without any bribe being paid, for example through off-book slush funds, false invoices, or unrecorded agents' commissions.
Candidates focus on the anti-bribery provisions and see the accounting provisions as secondary, so they fail questions where no bribery is alleged but records were falsified or controls were circumvented.
What to do instead
Learn the accounting provisions as a standalone offence: reasonable detail, fair reflection of transactions, and a system of internal accounting controls sufficient to provide reasonable assurances. Practise spotting fact patterns where inaccurate recording alone creates liability, including liability for a subsidiary's improper payments in consolidated books.
Describing an anti-corruption programme by listing elements (tone at the top, code of conduct, training, risk assessment, due diligence, monitoring) without linking each element to the specific risk it addresses or to how effectiveness would be measured.
Candidates memorise framework headings from the US Sentencing Guidelines, the OECD Convention and the Bribery Act's adequate-procedures guidance, then reproduce them as a checklist. Exam questions increasingly ask about effectiveness and proportionality, which a bare list cannot answer.
What to do instead
For each programme element, prepare a sentence on the risk it mitigates, the evidence of operation, and the metric of effectiveness. When a question asks what is missing from a described programme, compare the facts against the six adequate-procedures principles (proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, monitoring and review) and name the gap specifically.
Handling whistleblowing questions by choosing 'report to the line manager' as the default answer, even where the line manager is implicated, and ignoring the need for confidential, anonymous and non-retaliatory reporting channels.
Candidates default to ordinary organisational hierarchy and underweight the specific features that make a speak-up channel effective: independence from the implicated chain, anonymity where permitted, protection against retaliation, and a documented investigation and feedback loop.
What to do instead
When a stem implicates a supervisor or local management, route the report to an independent function (compliance, audit committee, external hotline). Remember the design requirements: multiple channels, confidentiality, anti-retaliation policy, triage and investigation protocol, and reporting back to the reporter where feasible.
Treating 'cooperation with authorities' as a binary (cooperate or not) and missing the graded credit available for self-disclosure, full cooperation, remediation and timely resolution, or conversely assuming self-reporting guarantees a declination.
Candidates reduce enforcement incentives to a slogan. In practice, credit depends on voluntariness, timeliness, completeness, preservation of evidence, and whether the company remediated; aggravating factors can offset cooperation credit.
What to do instead
Learn the cooperation factors as a checklist: voluntary self-disclosure, full and proactive cooperation, timely and appropriate remediation, disgorgement of profits, and the quality of the compliance programme at the time of the conduct and at resolution. Answer questions by weighing these factors against aggravating ones such as involvement of senior management or a pervasive scheme.
Assuming a risk assessment is complete once a country tiering or corruption perception index score is produced, and not assessing risk at the transaction, sector, counterparty and relationship level.
Candidates latch onto published indices because they are concrete and numeric, but indices are perception-based starting points, not a risk assessment. The OECD and enforcement guidance expect assessment of the specific business relationship, including government touchpoints and payment structures.
What to do instead
Structure risk assessment across dimensions: country, sector, transaction type, counterparty, government interaction and internal control environment. Use indices only as an initial filter, then document the specific factors that raise or lower risk and how they drive diligence and controls.