Which are typical sections of a CCO compliance program?

• A. Governance and risk management only
• B. Controls, training, and auditing
• C. Governance, risk management, controls (procurement, storage, transport), training, and auditing
• D. Financial controls and marketing compliance

Answer: (C)

A CCO compliance program is built on a holistic framework that combines governance and risk management with practical controls, training, and auditing. Governance establishes who is responsible for compliance and the overall structure, while risk management identifies hazards, evaluates their likelihood and impact, and sets priorities for mitigation.

Then you translate that framework into concrete controls across how chemicals are handled: procurement controls ensure proper supplier vetting, approvals, and recordkeeping; storage controls cover labeling, containment, segregation, inventory management, and spill or incident readiness; and transport controls address packaging, labeling, permits, documentation, and secure chain-of-custody practices. Training ensures everyone understands their duties, procedures, and responses to incidents, with ongoing refreshers and role-specific content. Auditing provides ongoing verification of how well the program works, uncovers gaps, and drives corrective actions.

Together, these elements form the complete set needed for a robust CCO compliance program. The other options miss essential pieces: focusing only on governance and risk management omits the day-to-day controls, training, and monitoring; listing controls, training, and auditing excludes governance and risk assessment; and a financial or marketing focus misses the core safety, procurement, storage, and transport controls central to CCO compliance.