IBSL Diploma in Compliance Exam common mistakes
IBSL Diploma in Compliance Exam · Understand the traps and how to avoid them.
Answering 'what would a good compliance officer do?' from personal or ethical instinct, then selecting the most morally satisfying option instead of the one that matches the regulatory framework described in the question.
Candidates from banking, audit, or legal backgrounds import their own house rules and moral intuitions. The exam tests a defined body of compliance knowledge, so the 'right-feeling' answer is often not the technically correct one under the stated regime.
What to do instead
Before selecting, identify which framework or regulator the stem invokes (for example a specific directive, a national supervisor, or an international standard). Anchor the answer to that source, and when the stem gives no framework, choose the option that describes the process or control rather than the ethical outcome.
Treating 'compliance' as synonymous with 'legal' and picking the option that says the matter should be referred to legal counsel or the board, rather than the option describing the compliance function's own monitoring, advice, or reporting duty.
The compliance role is frequently confused with legal advisory and internal audit. Candidates default to escalation because it seems safest, missing that the question is testing the distinct mandate of the compliance function.
What to do instead
Memorise the three-way split: legal advises on legal risk, internal audit provides independent assurance, compliance advises, monitors, and reports on regulatory risk. When a stem asks what the compliance function should do, choose the monitoring/advice/reporting action, not the referral.
Reading a scenario about a suspicious transaction or a customer onboarding case and jumping to the escalation step (file a report, exit the relationship) without first answering the earlier step the stem actually asks about, such as identification, verification, or risk assessment.
Scenario stems are long and the dramatic detail (unusual payments, a politically exposed person) pulls attention forward. Candidates answer the end of the process instead of the step the question marks.
What to do instead
Underline the interrogative in the stem ('what must be done FIRST', 'which control is being tested') before reading the options. Then map the options onto the sequence of the control (identify, verify, assess risk, monitor, escalate) and choose the one matching the requested stage.
Confusing the roles of the first and second lines of defence, so that a question about who owns a risk or who performs a control is answered with 'compliance' when the correct answer is the business line, or vice versa.
The three-lines-of-defence model is taught abstractly and candidates remember the labels without the ownership logic. The exam repeatedly tests who owns the risk versus who oversees it.
What to do instead
Fix the rule in memory: the first line owns and manages the risk and performs the controls; the second line (compliance and risk) sets frameworks, advises, and monitors; the third line (internal audit) gives independent assurance. For any ownership question, default to the business line unless the stem explicitly asks about oversight.
Selecting an answer that describes an outcome ('the customer is reported', 'the breach is avoided') instead of the mechanism ('the control is designed to detect X before Y happens'), when the question asks how a control or process works.
Outcome-focused answers feel complete and are easy to recognise from prior reading. Mechanism questions require distinguishing design from result, which candidates under-prepare.
What to do instead
When the stem asks 'how' or 'which control', reject any option that only states a result. Prefer options that name the trigger, the action, and the timing (for example, screening at onboarding and on an ongoing basis against updated lists).
Assuming a single global standard applies everywhere and choosing the answer that reflects one jurisdiction's rule when the stem describes a different regime, or ignoring that the question is about an international standard rather than national law.
Candidates prepare from one country's materials and over-generalise. Compliance content is jurisdiction-sensitive, and the exam deliberately tests the boundary between international standards and local implementation.
What to do instead
For each topic, note whether it is set by an international body (which sets expectations for members) or by a national supervisor (which sets binding rules). Read the stem for the regulator or jurisdiction named and answer within that regime, choosing the option that reflects local implementation where the stem is national.
Treating a risk-based approach as 'apply the strictest control to everyone', and selecting maximum-due-diligence answers for low-risk customers or simplified measures where the stem describes a proportionate approach.
Risk-based thinking is often reduced to 'more checks are always better'. The exam tests proportionality: enhanced measures for higher risk, simplified measures where risk is demonstrably lower.
What to do instead
For any risk-based question, first classify the customer or activity by the risk factors in the stem, then choose the measure calibrated to that level. Reject options that apply enhanced measures indiscriminately or that skip identification entirely; proportionality is the discriminator.
Confusing 'monitoring' with 'testing' or 'audit', and choosing the option that describes an independent review when the stem is about ongoing transaction or relationship monitoring by the business or compliance function.
The vocabulary overlaps and candidates memorise definitions without the operational distinction: monitoring is continuous surveillance, testing is periodic sample-based checking, audit is independent assurance.
What to do instead
Attach each term to its cadence and owner: ongoing monitoring is continuous and owned by the first or second line; compliance testing is periodic and sample-based, performed by compliance; audit is independent and performed by the third line. Match the cadence and owner in the stem to the option.
Answering a question about the compliance officer's personal liability or the consequences of a breach by choosing the most severe sanction (criminal prosecution, licence withdrawal) rather than the proportionate or most likely regulatory response described in the framework.
Sanctions are memorable in their extremes, and candidates recall headlines rather than the graduated supervisory toolkit. The exam tests the range of responses, not only the maximum.
What to do instead
Learn the escalation ladder of supervisory responses (informal warning, remediation requirement, fine, restriction, withdrawal of authorisation) and the conditions that trigger each. Choose the response that matches the severity and repetition described in the stem, not the maximum available.
Spending disproportionate time on long scenario stems, then rushing the shorter definitional questions at the end and losing easy marks, or changing correct first answers on review without a specific reason.
Scenario items are cognitively heavy and create a time sink; fatigue then degrades judgement on straightforward items. Answer-changing under time pressure is a well-documented source of lost marks.
What to do instead
Do a first pass answering every short definitional item before returning to scenarios, flagging rather than stalling. On review, change an answer only when you can cite the specific stem word or framework rule that makes the original choice wrong.