III IC-28 cheat sheet

IC-28 is a certification exam for inspection and compliance professionals; the syllabus is organized into content domains rather than a published code of federal regulations citation list.

Governance documents that frame a compliance program are: charter, scope statement, risk assessment, control matrix, and remediation log; each must be dated and version-controlled.

A compliance program charter typically names the program owner, the governing body it reports to, the review cadence, and the escalation path for unresolved findings.

Segregation of duties is a preventive control: the person who performs an inspection should not be the sole approver of the resulting compliance determination.

Three lines model: operational management owns risk (first line), an independent compliance/risk function monitors (second line), internal audit provides independent assurance (third line).

Materiality threshold: a finding is escalated when it exceeds a defined quantitative or qualitative threshold; the threshold and rationale must be documented before fieldwork begins.

Document retention: compliance records are retained per the applicable retention schedule, and legal hold suspends routine destruction once litigation or an investigation is reasonably anticipated.

A corrective action plan (CAP) must state the root cause, the specific action, a responsible owner, a due date, and the objective evidence that will close the finding.

Risk-based sampling: stratify the population by risk attribute, then select sample items; document the population definition, the sampling method, and the sample size rationale.

Evidence hierarchy: direct observation and original records outrank system-generated summaries, which outrank interviews and management representations.

An audit finding requires four elements: condition (what is), criterion (what should be), cause (why), and effect (risk or consequence).

Sufficient appropriate evidence means enough quantity (sufficiency) and relevant, reliable quality (appropriateness); both are required before a conclusion is issued.

Fieldwork sequence: opening meeting, walkthrough, control testing, evidence collection, exception follow-up, closing meeting, draft report, management response, final report.

Exceptions are not conclusions: each exception must be evaluated for root cause and whether it represents an isolated or systemic control failure.

Chain of custody for physical or electronic evidence records who collected it, when, from where, the hash or identifier, and every subsequent transfer.

Working papers must allow an experienced reviewer who did not perform the work to reperform the steps and reach the same conclusion independently.

Inherent risk is assessed before controls; residual risk is assessed after controls; the difference is the risk reduction attributable to the control environment.

Control types: preventive (stops an event), detective (identifies after the fact), corrective (remediates); directive controls guide behavior but do not by themselves provide assurance.

A key control is one that, if it fails, materially increases residual risk; non-key controls are supporting and are tested on a rotational basis.

COSO-style components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

A control gap exists when a risk has no control, when the control is designed inadequately, or when the control operates but not consistently.

Risk rating formula commonly used: likelihood multiplied by impact, mapped to a scale (for example 1-5 each, giving 1-25) with defined bands for low, medium, high, and critical.

Compensating controls must address the same risk as the missing primary control and must be independently testable; a compensating control that is not documented and tested does not reduce assessed risk.

Control testing attributes: design effectiveness (would the control achieve the objective if performed as described) versus operating effectiveness (was it actually performed consistently over the period).

Report ratings must be defined in advance: for example, critical means a control failure with immediate regulatory or safety exposure requiring escalation within a stated number of business days.

A management response must include an owner, a commitment date, and acceptance of risk where remediation is declined; risk acceptance requires authority at the level defined in the risk appetite statement.

Findings are closed only on validated evidence, not on management assertion; validation is performed by the compliance or audit function, not by the finding owner.

Overdue CAPs are escalated on a defined cadence and reported to the governing body; repeat findings indicate ineffective root-cause analysis rather than isolated failure.

Professional ethics for inspectors: objectivity, confidentiality, competence, due professional care, and avoidance of conflicts of interest including self-review threats.

Confidentiality: information obtained during an inspection is used only for the stated purpose and disclosed only under authorized channels or legal compulsion.

Independence impairment must be disclosed and mitigated; an inspector who previously managed the area under review should be recused from that engagement.

Metrics that indicate program health include finding closure rate within due date, repeat finding rate, average days to remediate, and percentage of key controls tested in the period.