2026 CPCO Study Guide Certified
Professional Compliance Officer Practice
Questions Answer Explanations • Healthcare
Compliance • Fraud & Abuse • HIPAA
Regulations • Risk Management Review
Domain I: Compliance Program Development & Governance (Questions 1–
30)
1. According to the OIG, what is the foundational framework upon which all
healthcare compliance programs are built?
A) The Joint Commission standards
B) The Seven Elements of an Effective Compliance Program
C) The HIPAA Privacy Rule
D) The Federal Sentencing Guidelines only
Rationale: The OIG's Seven Elements of an Effective Compliance Program serve
as the foundational framework for all healthcare compliance programs. These
seven elements are based on the Federal Sentencing Guidelines and include: (1)
written policies and procedures, (2) compliance leadership and oversight, (3)
training and education, (4) effective lines of communication with the compliance
officer and disclosure program, (5) enforcing standards through well-publicized
disciplinary guidelines, (6) risk assessment, auditing, and monitoring, and (7)
responding promptly to detected offenses and undertaking corrective action.
2. Which of the following is NOT one of the OIG's Seven Elements of an Effective
Compliance Program?
A) Written policies and procedures
B) Compliance leadership and oversight
C) Annual profit maximization
D) Training and education
Rationale: Annual profit maximization is not one of the OIG's Seven Elements.
The seven elements are: written policies and procedures; compliance leadership
,and oversight; training and education; effective lines of communication with the
compliance officer and disclosure program; enforcing standards; risk assessment,
auditing, and monitoring; and responding promptly to detected offenses.
3. In February 2026, the OIG released its second Industry Segment-Specific
Compliance Program Guidance (ICPG). Which industry does this guidance
specifically target?
A) Hospitals
B) Physician practices
C) Medicare Advantage
D) Nursing facilities
Rationale: In February 2026, the OIG released its Industry Segment-Specific
Compliance Program Guidance (ICPG) for Medicare Advantage (MA). This was
the first MA-focused update since 1999 and was issued on February 3, 2026.
4. The OIG's Medicare Advantage ICPG includes compliance recommendations
for all of the following key risk areas EXCEPT:
A) Risk adjustment data validation
B) Marketing to uninsured patients
C) Utilization management
D) Quality of care
Rationale: The Medicare Advantage ICPG addresses key risk areas including risk
adjustment data validation, utilization management, and quality of care. Marketing
to uninsured patients is not a specified risk area for Medicare Advantage
compliance guidance.
5. What does the OIG's use of the word "should" in its compliance program
guidance indicate?
A) It is a mandatory legal requirement
B) It is voluntary, nonbinding guidance
C) It is enforced by CMS
D) It carries criminal penalties
Rationale: OIG uses the word "should" in the Medicare Advantage ICPG and
General Compliance Program Guidance to present voluntary, nonbinding
guidance. The documents do not create any new obligations or standards for any
individual or entity.
,6. What is the primary purpose of a compliance committee in a healthcare
organization?
A) To maximize revenue
B) To oversee the compliance program and provide multidisciplinary
leadership
C) To conduct clinical trials
D) To manage patient scheduling
Rationale: A compliance committee provides high-level, multidisciplinary
oversight of the compliance program. It should include representation from key
departments (legal, clinical, operations, finance) and is responsible for approving
compliance policies, reviewing audit results, and ensuring the compliance program
is effective.
7. To whom should the compliance officer have a direct line of communication?
A) Only to the billing department
B) To the CEO and Board of Directors
C) To the marketing department
D) To the IT help desk
Rationale: The compliance officer should have a direct line of communication to
the CEO and Board of Directors to ensure independence and autonomy of the
compliance function. This reporting structure allows the compliance officer to raise
issues without fear of retaliation.
8. How frequently should a compliance committee typically meet?
A) Annually
B) Every 5 years
C) At least quarterly
D) Only when a violation occurs
Rationale: A compliance committee should meet at least quarterly to oversee the
compliance program, review audit findings, address emerging risks, and ensure
that the program is functioning effectively. Regular meetings demonstrate active
oversight and commitment to compliance.
9. What is the purpose of a code of conduct in a compliance program?
, A) To outline billing procedures
B) To articulate the organization's commitment to ethical behavior and
compliance
C) To replace written policies
D) To serve as a marketing tool
Rationale: The code of conduct establishes a formal statement of the
organization's commitment to ethical behavior and compliance with laws and
regulations. It sets expectations for all employees and serves as the foundation for
the compliance program.
10. How often should compliance policies be reviewed and updated?
A) Every 5 years
B) Never
C) Regularly, as part of a systematic review process
D) Only when a violation occurs
Rationale: Compliance policies should be reviewed and updated on a regular,
systematic basis to reflect changes in regulations, organizational structure, and risk
landscape. This ensures that policies remain current and effective.
11. What is the primary purpose of a compliance program work plan?
A) To track patient appointments
B) To document planned compliance activities and establish accountability
C) To replace the code of conduct
D) To serve as a budget document
Rationale: A compliance program work plan documents the planned activities of
the compliance department over a specified period, including audits, training, and
policy reviews. It establishes accountability and demonstrates proactive
compliance management.
12. Which of the following is a key responsibility of the compliance officer?
A) Managing the organization's investment portfolio
B) Overseeing the day-to-day operations of the compliance program
C) Performing all clinical procedures
D) Setting marketing strategy
Professional Compliance Officer Practice
Questions Answer Explanations • Healthcare
Compliance • Fraud & Abuse • HIPAA
Regulations • Risk Management Review
Domain I: Compliance Program Development & Governance (Questions 1–
30)
1. According to the OIG, what is the foundational framework upon which all
healthcare compliance programs are built?
A) The Joint Commission standards
B) The Seven Elements of an Effective Compliance Program
C) The HIPAA Privacy Rule
D) The Federal Sentencing Guidelines only
Rationale: The OIG's Seven Elements of an Effective Compliance Program serve
as the foundational framework for all healthcare compliance programs. These
seven elements are based on the Federal Sentencing Guidelines and include: (1)
written policies and procedures, (2) compliance leadership and oversight, (3)
training and education, (4) effective lines of communication with the compliance
officer and disclosure program, (5) enforcing standards through well-publicized
disciplinary guidelines, (6) risk assessment, auditing, and monitoring, and (7)
responding promptly to detected offenses and undertaking corrective action.
2. Which of the following is NOT one of the OIG's Seven Elements of an Effective
Compliance Program?
A) Written policies and procedures
B) Compliance leadership and oversight
C) Annual profit maximization
D) Training and education
Rationale: Annual profit maximization is not one of the OIG's Seven Elements.
The seven elements are: written policies and procedures; compliance leadership
,and oversight; training and education; effective lines of communication with the
compliance officer and disclosure program; enforcing standards; risk assessment,
auditing, and monitoring; and responding promptly to detected offenses.
3. In February 2026, the OIG released its second Industry Segment-Specific
Compliance Program Guidance (ICPG). Which industry does this guidance
specifically target?
A) Hospitals
B) Physician practices
C) Medicare Advantage
D) Nursing facilities
Rationale: In February 2026, the OIG released its Industry Segment-Specific
Compliance Program Guidance (ICPG) for Medicare Advantage (MA). This was
the first MA-focused update since 1999 and was issued on February 3, 2026.
4. The OIG's Medicare Advantage ICPG includes compliance recommendations
for all of the following key risk areas EXCEPT:
A) Risk adjustment data validation
B) Marketing to uninsured patients
C) Utilization management
D) Quality of care
Rationale: The Medicare Advantage ICPG addresses key risk areas including risk
adjustment data validation, utilization management, and quality of care. Marketing
to uninsured patients is not a specified risk area for Medicare Advantage
compliance guidance.
5. What does the OIG's use of the word "should" in its compliance program
guidance indicate?
A) It is a mandatory legal requirement
B) It is voluntary, nonbinding guidance
C) It is enforced by CMS
D) It carries criminal penalties
Rationale: OIG uses the word "should" in the Medicare Advantage ICPG and
General Compliance Program Guidance to present voluntary, nonbinding
guidance. The documents do not create any new obligations or standards for any
individual or entity.
,6. What is the primary purpose of a compliance committee in a healthcare
organization?
A) To maximize revenue
B) To oversee the compliance program and provide multidisciplinary
leadership
C) To conduct clinical trials
D) To manage patient scheduling
Rationale: A compliance committee provides high-level, multidisciplinary
oversight of the compliance program. It should include representation from key
departments (legal, clinical, operations, finance) and is responsible for approving
compliance policies, reviewing audit results, and ensuring the compliance program
is effective.
7. To whom should the compliance officer have a direct line of communication?
A) Only to the billing department
B) To the CEO and Board of Directors
C) To the marketing department
D) To the IT help desk
Rationale: The compliance officer should have a direct line of communication to
the CEO and Board of Directors to ensure independence and autonomy of the
compliance function. This reporting structure allows the compliance officer to raise
issues without fear of retaliation.
8. How frequently should a compliance committee typically meet?
A) Annually
B) Every 5 years
C) At least quarterly
D) Only when a violation occurs
Rationale: A compliance committee should meet at least quarterly to oversee the
compliance program, review audit findings, address emerging risks, and ensure
that the program is functioning effectively. Regular meetings demonstrate active
oversight and commitment to compliance.
9. What is the purpose of a code of conduct in a compliance program?
, A) To outline billing procedures
B) To articulate the organization's commitment to ethical behavior and
compliance
C) To replace written policies
D) To serve as a marketing tool
Rationale: The code of conduct establishes a formal statement of the
organization's commitment to ethical behavior and compliance with laws and
regulations. It sets expectations for all employees and serves as the foundation for
the compliance program.
10. How often should compliance policies be reviewed and updated?
A) Every 5 years
B) Never
C) Regularly, as part of a systematic review process
D) Only when a violation occurs
Rationale: Compliance policies should be reviewed and updated on a regular,
systematic basis to reflect changes in regulations, organizational structure, and risk
landscape. This ensures that policies remain current and effective.
11. What is the primary purpose of a compliance program work plan?
A) To track patient appointments
B) To document planned compliance activities and establish accountability
C) To replace the code of conduct
D) To serve as a budget document
Rationale: A compliance program work plan documents the planned activities of
the compliance department over a specified period, including audits, training, and
policy reviews. It establishes accountability and demonstrates proactive
compliance management.
12. Which of the following is a key responsibility of the compliance officer?
A) Managing the organization's investment portfolio
B) Overseeing the day-to-day operations of the compliance program
C) Performing all clinical procedures
D) Setting marketing strategy
