Compliance and Risk Management is the largest aPHR area at 25%. Its 6 statements name 15 federal laws plus the EEOC and the Department of Labor, and add risk work that is not law at all: emergencies, violence, data protection, restructuring. This page explains the administrative rules and points to the PHR pages for legal analysis.
Updated Oct 26, 2026 · Not affiliated with HRCI or SHRM.
25%of the exam weight
≈16scored items (weight × 65, our estimate)
6knowledge statements
18questions on this page
What the outline covers
The six knowledge statements, in our words (outline, pp. 6–7):
Hiring, training and employee rights: nondiscrimination, accommodation, work authorization; EEOC, DOL, Form I-9, at-will employment, Title VII, ADA, IRCA, copyright (Title 17)
Union environments: WARN Act, NLRA, collective bargaining, alternative dispute resolution
Pay and benefits law: ERISA, COBRA, FLSA, USERRA, the ACA, tax treatment
Health, safety, security and privacy: OSHA, Drug-Free Workplace Act, ADA, HIPAA, Sarbanes-Oxley, WARN, sexual harassment
Risk assessment and mitigation: emergency procedures, violence, business continuity, intellectual property and employee data, theft
IRCA makes employers verify the identity and work authorization of every new hire, citizens included. The employee fills in Section 1 by the first day of work; the employer reviews documents and completes Section 2 within three business days of that first day (sooner for very short jobs). Keep each form for three years after the hire date or one year after employment ends, whichever is later, ready for federal inspectors from DHS, the Justice Department or the Labor Department (8 CFR 274a.2).
At-will employment
Unless a contract or law says otherwise, either side may end at-will employment at any time for any lawful reason, or none. The limits are the exceptions: discrimination and retaliation laws, and promises made in a contract or handbook.
Copyright: work made for hire
Training videos, handbooks and code are made at work, so the outline names Title 17. Its work-made-for-hire rule decides who owns what employees create within the scope of their jobs, and a signed written agreement can change the default (17 U.S.C. § 201).
Drug-Free Workplace Act
It applies to federal contractors (41 U.S.C. § 8102) and grantees (§ 8103). The employer publishes a drug-free policy, runs an awareness program, and sets short deadlines for reporting a workplace drug conviction up the chain to the contracting agency.
Sarbanes-Oxley whistleblowers
Section 806 protects employees who report certain kinds of fraud from retaliation; a complaint goes to OSHA within 180 days (18 U.S.C. § 1514A).
USERRA
Employees who leave for service in the uniformed services keep reemployment rights, generally for absences that add up to no more than five years with one employer, and come back with the seniority they would have earned (38 U.S.C. § 4312; DOL: USERRA).
HIPAA
The privacy rule binds health plans and providers, including an employer’s group health plan, but not the employer acting as employer: employment records an employer holds are not protected health information (45 CFR 160.103).
Who enforces what
EEOC: the federal anti-discrimination laws in employment, Title VII and the ADA among them (EEOC: overview).
Department of Labor: the FLSA and FMLA (Wage and Hour Division), ERISA (EBSA), USERRA (VETS), and workplace safety through OSHA, which also takes Sarbanes-Oxley complaints (DOL: major laws).
NLRB: the NLRA, union and nonunion workplaces alike.
USCIS publishes Form I-9 and runs E-Verify (USCIS: I-9 Central); inspections of employers’ forms are done by DHS, Justice and Labor officers.
18 compliance and risk questions
0 of 18 answered · 0 correct
Question 1 of 18 · Compliance and Risk Management · 25%
Lantern Events hires a worker for a two-day festival job. By when must the employer examine her documents and complete Section 2 of Form I-9?
When employment lasts less than three business days, Section 2 must be completed by the end of the first day of work, which is the time of hire.
Three business days is the usual deadline, but it does not apply to jobs shorter than three business days.
Short-term hires still need Form I-9.
30 days is not an I-9 deadline.
Question 2 of 18 · Compliance and Risk Management · 25%
Which single document, if unexpired, proves both identity and employment authorization for Form I-9?
A school ID with a photograph is a List B document: identity only.
A driver's license is a List B document: it proves identity only.
An unrestricted Social Security card is a List C document: it proves work authorization only.
A U.S. passport is a List A document, which establishes both identity and employment authorization on its own.
Question 3 of 18 · Compliance and Risk Management · 25%
Title VII of the Civil Rights Act of 1964 applies to private employers with at least how many employees?
20 employees is the coverage threshold for the Age Discrimination in Employment Act, and also for COBRA.
50 employees is the threshold for FMLA coverage and ACA applicable large employer status, not Title VII.
Title VII covers employers with 15 or more employees for each working day in 20 or more weeks of the current or preceding year.
100 employees is the WARN Act threshold and the EEO-1 reporting threshold, not Title VII coverage.
Question 4 of 18 · Compliance and Risk Management · 25%
Which characteristic is protected by Title VII of the Civil Rights Act of 1964?
Title VII prohibits discrimination based on race, color, religion, sex, and national origin.
Genetic information is protected by GINA, not by Title VII.
Disability is protected by the Americans with Disabilities Act, not by Title VII.
Age is protected by the Age Discrimination in Employment Act, not by Title VII.
Question 5 of 18 · Compliance and Risk Management · 25%
A graphic designer employed by Corwin Media creates a training video as part of her regular job duties. Absent a signed written agreement saying otherwise, who owns the copyright?
Appearing in a video does not give someone copyright ownership of it.
For a work made for hire, the law treats the employer, not the employee, as the author.
Training videos are protected by copyright like other original works.
A work an employee creates within the scope of employment is a work made for hire, and the employer is treated as its author and owner.
Question 6 of 18 · Compliance and Risk Management · 25%
In a dispute between Halden Foods and its union, a neutral third party helps both sides talk and find their own settlement but has no power to impose a decision. What is this process?
Litigation is a lawsuit decided by a court.
In arbitration, the neutral hears both sides and issues a decision, usually binding.
In mediation, a neutral helps the parties reach their own agreement; the mediator cannot impose a decision.
Fact-finding has a neutral issue findings and recommendations after a hearing, not facilitate talks.
Question 7 of 18 · Compliance and Risk Management · 25%
What is the current federal minimum wage under the Fair Labor Standards Act?
$10.10 was a minimum for certain federal contract workers, not the FLSA minimum wage.
The federal minimum wage has been $7.25 per hour since July 24, 2009; many states and cities set higher rates.
$2.13 is the minimum cash wage for tipped employees when the employer takes a tip credit.
$15.00 is a common state or local minimum, not the federal FLSA rate.
Question 8 of 18 · Compliance and Risk Management · 25%
Under the Equal Pay Act, which reason can lawfully explain why a man and a woman doing equal work are paid differently?
Customer preference based on sex is not a lawful factor other than sex.
A sex-based assumption about turnover is not a lawful factor.
Pay based on assumptions about sex roles is sex-based pay, which the EPA prohibits.
The EPA allows differences based on seniority, merit, quantity or quality of production, or a factor other than sex.
Question 9 of 18 · Compliance and Risk Management · 25%
A former employee elects COBRA continuation coverage. What coverage must the plan provide?
COBRA coverage must be identical to the coverage provided to similarly situated active participants.
COBRA continues the group plan itself; the employer cannot substitute an individual policy.
The plan cannot reduce COBRA beneficiaries to a stripped-down plan.
Covered dependents can be qualified beneficiaries with their own COBRA rights.
Question 10 of 18 · Compliance and Risk Management · 25%
Under federal COBRA, what is the most a plan can generally charge a qualified beneficiary for continuation coverage?
The plan may charge the full cost plus 2%, not just the share an active employee pays.
COBRA premiums may not exceed 102% of the applicable premium: the full cost plus a 2% administrative charge.
The employer is not required to pay any of the COBRA premium; the beneficiary can be charged the full cost.
COBRA caps the general premium at 102%; 110% is not a COBRA figure.
Question 11 of 18 · Compliance and Risk Management · 25%
An employee completes a 2-week National Guard training period on Saturday. Under USERRA, when must he report back to work?
90 days applies to service of more than 180 days.
USERRA sets a specific reporting rule; there is no open 30-day window.
14 days applies to service of 31 to 180 days.
For service under 31 days, the employee reports at the first full regularly scheduled work period after safe travel home plus eight hours of rest.
Question 12 of 18 · Compliance and Risk Management · 25%
Under the Affordable Care Act's employer shared responsibility rules, an employer is an 'applicable large employer' if it averaged how many full-time employees, including full-time equivalents, in the prior year?
20 employees is the COBRA threshold, not the ACA ALE threshold.
An employer with an average of 50 or more full-time employees, including full-time equivalents, in the prior year is an ALE.
100 is the WARN Act threshold; the ALE threshold is 50.
15 employees is the Title VII threshold.
Question 13 of 18 · Compliance and Risk Management · 25%
Under OSHA's Hazard Communication Standard, how must an employer handle safety data sheets for the hazardous chemicals used in its workplace?
There is no annual mailing requirement; the sheets must be available in the workplace.
Locking sheets away defeats the requirement that they be readily accessible.
Employers must keep a safety data sheet for each hazardous chemical and make it readily accessible to employees during each work shift.
Access is required at all times during each shift, not only after an injury.
Question 14 of 18 · Compliance and Risk Management · 25%
Under the Drug-Free Workplace Act, an employee working on a covered federal contract is convicted of a drug offense that occurred at work. Within how many days must the employee notify the employer?
10 days is the employer's deadline to notify the contracting agency after learning of the conviction.
30 days is not the employee notice deadline.
Employees must notify the employer of a criminal drug conviction for a workplace violation no later than 5 days after the conviction.
3 days is shorter than the 5 days the Act allows.
Question 15 of 18 · Compliance and Risk Management · 25%
Sarbanes-Oxley whistleblower protection applies mainly to employees of which kind of employer?
SOX Section 806 protects employees of publicly traded companies (and their contractors and agents) who report fraud.
Government agencies are not covered by SOX Section 806.
A privately held company with no registered securities is generally outside SOX whistleblower coverage.
Nonprofits generally do not issue publicly traded securities, so SOX 806 does not cover them.
Question 16 of 18 · Compliance and Risk Management · 25%
What is the main purpose of a designated assembly area in an emergency evacuation plan?
Sheltering indoors is the job of a shelter-in-place area; an assembly area is outside, after evacuation.
An assembly area lets supervisors take a headcount and spot anyone missing.
Equipment is kept in marked locations; the assembly area is for people.
First-responder staging is planned separately and kept clear of the employee assembly area.
Question 17 of 18 · Compliance and Risk Management · 25%
Cobalt Industries sells its consumer electronics division to another company so it can focus on industrial products. What type of restructuring is this?
A furlough is temporary unpaid leave for employees.
A divestiture sells or spins off part of a business.
A merger combines two companies into one.
An acquisition is one company buying another; Cobalt is the seller here.
Question 18 of 18 · Compliance and Risk Management · 25%
Which federal law amended Title VII so that discrimination because of pregnancy, childbirth, or related medical conditions counts as sex discrimination?
The FMLA provides job-protected unpaid leave; it did not define pregnancy discrimination as sex discrimination.
The PDA amended Title VII so that discrimination because of pregnancy, childbirth, or related medical conditions is sex discrimination.
The PWFA (enacted December 2022, effective June 27, 2023) requires reasonable accommodation of known pregnancy-related limitations; it is the 1978 PDA that made pregnancy discrimination sex discrimination under Title VII.
The Equal Pay Act bars sex-based pay differences for equal work; it does not address pregnancy.
Answer every question to see your score
The employee picks the I-9 documents
The employer may not tell a new hire which of the acceptable documents to show, or ask for more than the form requires; doing so can be unlawful discrimination even when the intent is careful verification (USCIS: I-9 Central).
Laws explained on the PHR pages
The rest of the list gets one line here. On this site the PHR pages own US employment law, so the full treatment lives there:
The last two statements are about risk, not law: emergency procedures, workplace violence, business continuity, protecting intellectual property and employee data, theft, and the people side of restructuring. A business continuity plan keeps critical functions running through a disruption; offshoring moves work to another country; integration is the hard part after a merger, when two sets of policies, pay plans and cultures become one.
The outline names 15: Title VII, the ADA, IRCA, Title 17, WARN, the NLRA, ERISA, COBRA, the FLSA, USERRA, the ACA, OSHA, the Drug-Free Workplace Act, HIPAA and Sarbanes-Oxley, plus the EEOC and the Department of Labor (outline, pp. 6–7). Its lists say “for example”, so they are not closed, and questions follow the laws in effect on your exam date.
How many aPHR questions are on compliance and risk management?
HRCI weights the area at 25%. Applied to the 65 scored questions, that is about 16 (our arithmetic; HRCI does not publish counts per area).