CBA Certified Compliance & Risk Professional

Compliance Risk Assessment20%

• Identify sources of compliance obligation and translate them into an inventory of organisational risks
• Calculate inherent and residual risk scores using likelihood and impact scales, and justify the scale design
• Distinguish inherent risk, residual risk, risk appetite and risk tolerance in practical scenarios
• Prioritise risks for treatment and select an appropriate treatment response (accept, mitigate, transfer, avoid)
• Evaluate the quality of a risk register entry and identify missing or defective elements
• Interpret changes in an organisation's risk profile triggered by new products, markets, suppliers or technology

Programme Governance, Policies and Controls22%

• Select an appropriate governance structure for a compliance programme given organisational size and risk profile
• Distinguish the responsibilities of operational management, compliance functions and independent assurance within a layered defence model
• Evaluate a draft policy against criteria of clarity, scope, ownership, proportionality and enforceability
• Differentiate preventive, detective and corrective controls and match control types to identified risks
• Design a training and communication approach that targets the right audiences with the right depth
• Assess whether a described programme element is proportionate to the organisation's size and risk exposure

Financial Crime and Data Protection Fundamentals20%

• Explain the three-stage model of money laundering and identify the stage illustrated by a described transaction pattern
• Distinguish customer due diligence, enhanced due diligence and ongoing monitoring, and select the appropriate level for a given customer profile
• Identify red flags for money laundering, bribery and sanctions exposure in workplace scenarios
• Interpret core data-protection concepts including personal data, lawful processing purposes, data minimisation and retention
• Select the correct first response when a possible data breach or suspicious activity is discovered
• Evaluate third-party relationships for financial crime and data-protection risk at a conceptual level

Monitoring, Testing and Investigations22%

• Distinguish continuous monitoring, periodic testing and independent review, and select which is appropriate for a given assurance need
• Design a risk-based monitoring plan including sample selection, frequency and pass criteria
• Interpret monitoring results to distinguish an isolated error from a control weakness or systemic failure
• Evaluate alert-based monitoring output, including tuning thresholds and managing false positives, whether rule-based or AI-assisted
• Select sound practice for the intake, triage and initial handling of a whistleblowing report or suspected breach
• Apply core investigation principles: preserving evidence, maintaining confidentiality, fairness to subjects and documenting steps

Reporting, Culture and Improvement16%

• Select metrics and key risk indicators that give leadership a faithful picture of compliance performance
• Construct a management report from raw programme data, choosing appropriate structure, emphasis and visualisation
• Interpret indicators of compliance culture, including speak-up data, and diagnose likely cultural weaknesses from a scenario
• Distinguish activity metrics from outcome metrics and evaluate a dashboard for balance between them
• Evaluate lessons-learned and programme review processes and select improvements after an incident or audit finding