CPCO Exam Guide: Nine Domains, 100 Questions

The CPCO is AAPC's Certified Professional Compliance Officer exam: 100 multiple-choice questions in 240 minutes, with a pass mark of 70%. It tests healthcare compliance programs, fraud and abuse law, privacy rules and the audit process. Start with the CPCO practice test, then use the nine domains below to plan your study.

Where can you get CPCO practice questions, and does AAPC provide any?

AAPC's CPCO pages, the certification overview and the exam-day page, list two products: an exam voucher starting at $425 and an online self-paced training course starting at $1,195 (October 2026 prices). You will not find a practice exam on either page, so a voucher should not be expected to include one. MedicoExam is separate from AAPC: the questions on our practice test are our own work, written against the published CPCO outline, not AAPC content.

Our CPCO product page describes a premium practice exam with 195+ exam-aligned questions, two months of unlimited access to the question bank, and a result history that shows your answers beside the correct ones. A short demo lets you try the interface first, and sample questions for this exam are available next to the syllabus. Compare any question bank you consider with the nine-domain outline later in this guide; a bank is worth using only if its topics line up with what the exam covers.

Practice matters more for this exam than for many others because the questions are written as scenarios. AAPC says the questions assess several areas of knowledge, many of them presented as situations that test how you apply compliance requirements from government laws, regulations, rules and guidelines. Recalling a definition is not enough; you have to decide which rule fits the facts in front of you.

What is the CPCO exam format, and how long and how costly is it?

The paper holds 100 multiple-choice questions and must be finished in a single four-hour (240-minute) sitting, an average of 2.4 minutes for each. An overall 70% is the pass line, equal to at least 70 correct answers; missing more than 30 means a fail. AAPC advises answering every question, since a best guess beats a blank.

A single attempt costs $425, while two attempts bought together cost $499 (October 2026 prices). The extra attempt in the bundle effectively costs $74, so the bundle is worth weighing if you are unsure of a first-time pass. Fees and conditions change, so confirm them on AAPC's exam-day page before you pay.

Item	CPCO detail
Credential	AAPC Certified Professional Compliance Officer (CPCO)
Category	Core + Compliance
Fee (October 2026)	$425 for one attempt; $499 for two attempts
Time limit	Four hours (240 minutes), one sitting
Number of questions	100 multiple-choice questions
Passing score	70% (at least 70 correct answers)
Credential validity	2 years, renewed with continuing education

You choose between a remote sitting at home, watched by a live proctor, and a computer-based sitting at a testing center. No physical references are allowed; all necessary materials are available inside the exam, and an online calculator is provided. That last point is a difference worth noticing if you are used to code-book exams: for the CPCO, there is no book to bring, so there is no book-tabbing skill to build. Your preparation is knowledge and judgement.

What does the CPCO exam actually test across its nine domains?

AAPC publishes the exact number of questions in each of nine domains. They are listed here in the order AAPC gives them, with the count in brackets, so you can see where the 100 questions go. The descriptions follow AAPC's own outline of each domain, and the CPCO syllabus page on this site sets the topics out in one place.

Healthcare compliance program history (5 questions)

The smallest group of questions covers how healthcare compliance came to exist: the history of healthcare laws in the United States, past healthcare industry investigations, federal sentencing guidelines, the introduction of compliance program guidance, and the key agencies involved. It also includes current statistics from CERT reports and national healthcare expenditures, and the OIG five-principle strategy. Five questions is little, but they are usually the easiest marks if you have read the background once.

OIG compliance program guidance for physicians and small group practices (22 questions)

This is the second-largest domain. It covers the general guidance and the seven steps of an effective program: standards of conduct and operational policies, oversight requirements, compliance training, monitoring and auditing, communications, disciplinary actions, and responding to detected offenses. Learn the seven steps as a working sequence rather than a list, because scenario questions ask which step a described situation belongs to, or which step is missing from a described program.

Compliance program guidance for third-party billing companies and clinical laboratories (3 questions)

Three questions test lab orders and billing, the Balanced Budget Act of 1997 and diagnoses, and the use of outside billing companies. The group is small, so a short, focused review is enough.

OIG compliance program guidance for hospitals (3 questions)

Another three questions address supplemental hospital guidance. Treat it as the hospital-side counterpart to the physician-practice guidance: the same program ideas, applied in a larger organization.

Key and other risk areas (19 questions)

This domain is broad. AAPC lists physician compliance program guidance risks, documentation, conflict of interest, gifts and gratuities, medical necessity, advance beneficiary notices, incident to, overpayments and credit balances, certificates of medical necessity, certifications for home health and therapy services, billing non-covered services as if covered, teaching physicians, gainsharing arrangements, joint ventures, limiting charges for par and non-par practices, professional courtesy, discounts and adjustments, rental of office space, unlawful advertising, and state escheat laws. Make a one-line note for each topic, saying what the risk is and who it affects.

Fraud and abuse laws (12 questions)

Here you are tested on the difference between fraud and abuse, civil monetary penalties, the False Claims Act, the anti-kickback statute, the Stark laws, the Fraud Enforcement and Recovery Act (FERA), and the Patient Protection and Affordable Care Act. Candidates often mix up what each law prohibits, so build a small comparison grid of the law, what conduct it targets and what happens when it is breached.

Other laws and regulations (24 questions)

The largest domain, with 24 questions, covers HIPAA, EMTALA, CLIA, OSHA, RICO, and mail and wire fraud. It is a wide field of different subjects, which is why it carries so many marks and why it rewards steady, repeated review over one long read.

Investigation process and audits (9 questions)

Nine questions cover subpoenas and search warrants, the use of legal counsel, the self-disclosure protocol, qui tam and whistleblowers, corporate integrity agreements, certification of compliance agreements, excluded parties on the OIG and GSA lists, and the contractors involved in review: RACs, UPICs, MICs, PSCs and MFCUs. Learn what each acronym stands for and what it does.

References and resources (3 questions)

The last three questions assess federal regulations, citations and references, the Office of Inspector General, the Centers for Medicare & Medicaid Services, and Medicaid and workers' compensation. These are knowledge-of-sources questions: know where a rule lives and who publishes it.

AAPC adds that the exam relies on a level of understanding that lets you identify the domain a question belongs to. Naming the domain first narrows the rules you need to think about, and it is a habit worth practising in every mock paper.

Which CPCO domains carry the most marks, and where should you spend study time?

Three domains account for 65 of the 100 questions: other laws and regulations (24), OIG guidance for physicians and small group practices (22) and key and other risk areas (19). Fraud and abuse laws add 12, investigation process and audits add 9, and the remaining four domains share the last 14 between them. A candidate who knows the top three well and the fraud and abuse laws thoroughly has already covered 77 questions.

Domain	Questions	Share of the exam
Other laws and regulations	24	24%
OIG guidance for physicians and small group practices	22	22%
Key and other risk areas	19	19%
Fraud and abuse laws	12	12%
Investigation process and audits	9	9%
Healthcare compliance program history	5	5%
Third-party billing companies and clinical laboratories	3	3%
Hospital compliance guidance	3	3%
References and resources	3	3%

Do not read the table as permission to skip the small domains. AAPC says that if you do not pass, you are told which categories or areas of study scored 65% or less, so a weak small domain still shows up in your result. The sensible approach is proportion: spend study time roughly in line with the question counts, and still read every domain at least once.

The weighting also helps you check your practice results. If you score 60% overall but your result is strong in the history domain and weak in other laws and regulations, the overall score understates how much work remains, because the weak domain is the largest one. Review every practice attempt by domain, not just by total.

Who should sit the CPCO, and how much experience do you need first?

AAPC recommends that candidates have at least two years of healthcare work experience and a solid understanding of medical terminology, anatomy and pathophysiology before registering, and that they complete the CPCO training course beforehand to improve their chance of a first-time pass. Its certification overview words the requirement differently: candidates should undertake training and/or have two years of experience working with compliance programs. Read both pages, because between them they describe the background AAPC expects.

AAPC describes the CPCO as a challenging, high-level examination that is not meant for individuals with limited or no compliance experience or training. It is aimed at professional coders, billers and auditors who want to move into compliance leadership, compliance officers and managers who want their expertise formally validated, and healthcare administrators who oversee compliance programs. If that does not describe you yet, AAPC points to recommended prerequisite courses.

You should be familiar with the day-to-day operation of a compliance program, with the key laws that affect physician practices, with the policies used to address potential fraud and abuse including associated penalties and fines, and with how to research an answer when you do not know it. That last skill matters: AAPC wants you to know where to go to find the correct practice, not only to recite one.

If your background is in coding rather than compliance, expect the legal and program-management material to feel unfamiliar even when the clinical vocabulary is not. Plan extra time for the fraud and abuse laws and for the seven program steps.

What happens on exam day, and when do you get your result?

After you buy a voucher, AAPC shows the available dates and times. Testing centers offer a quiet space with equipment provided and on-site proctors; AAPC describes hundreds of locations worldwide. The at-home option has 24/7 scheduling, but your setup must meet the technical requirements, including an external webcam. Check them in advance, not on the day.

Electronic devices with an on/off switch, such as phones and tablets, are not allowed into the examination room, and AAPC warns that failing to comply may result in disqualification. Because everything you need is inside the exam software, there is nothing to carry in beyond what the testing rules permit.

Pacing is simple arithmetic. With 240 minutes for 100 questions, you have 2.4 minutes each. AAPC suggests two time-savers: read the answer choices before reading each question, and leave the difficult questions until last. Scenario questions can be long, so a first pass that answers the quick ones and flags the rest usually leaves enough time for the flagged questions at the end.

Results are shared online in your My AAPC Account Dashboard under My Exams, and AAPC says to expect them within 7-10 business days after taking the exam. Once you have passed, the certificate is sent to you in the mail. A failing result lists the categories with sub-scores of 65% or less, which gives you a ready-made plan for a retake.

Here is how to practise a scenario question without needing any legal knowledge beyond the syllabus. Suppose a question describes a small physician practice that has written policies but no regular review of its billing. First name the domain: this is OIG guidance for physicians and small group practices. Next name the step: monitoring and auditing. Then check each answer choice against that step. The choice that adds a periodic review matches; the choice that rewrites the policy manual does not, because the policies already exist. Working this way turns a long paragraph into a short matching exercise.

Build the same habit for the other large domains. For a fraud and abuse question, ask which conduct is being described and which law targets that conduct. For a risk-area question, ask who is exposed to the risk and what documentation would reduce it. For an audit question, ask which party is acting and what its role is. Every mock paper you finish should leave you with a short list of questions where you named the wrong domain, because those are the cheapest errors to fix.

How should you study for the CPCO: a plan and the mistakes to avoid

The plan below suits a working professional with a few hours each week. It starts with a baseline so you know your starting point, then follows the weighting of the exam rather than the order of any textbook.

1. Take a timed baseline. Sit one full paper under exam conditions and mark it by domain, not just by total.
2. Learn the seven program steps. This is the foundation of the 22-question domain and it helps with the risk-area questions too.
3. Work through other laws and regulations. HIPAA, EMTALA, CLIA, OSHA, RICO and mail and wire fraud each get a one-page summary in your own words.
4. Cover key risk areas and fraud and abuse laws. Use the comparison grid for the fraud and abuse statutes and a one-line note for each risk area.
5. Finish with audits, history and references. These are the small domains, so a single session each is enough.
6. Run timed mixed papers. Practise the 2.4-minute pace and name the domain before you pick an answer.

The same few mistakes recur. The first is memorising lists of laws without being able to say what each one forbids. The second is ignoring the small domains because they are small. The third is practising untimed, then running short of time on the day. The fourth is relying on one source: a question bank, a course and the AAPC outline each show a different angle, and you will find gaps by comparing them.

A last practical point concerns scenario questions. Read the final sentence of the question first so you know what is being asked, then read the scenario for the facts that matter. Many wrong answers on compliance papers are statements that are true in general but do not answer the specific question.

How do you keep the CPCO after you pass?

To maintain the credential you must keep your AAPC annual membership and earn 36 continuing education units (CEUs) every two years. That matches the two-year validity recorded for this credential. AAPC states the membership and CEU requirements on its CPCO overview page, so check it for the current figures and for how units are reported.

Because compliance law changes, ongoing study is also the practical way to stay useful in the role. Updates to OIG guidance, enforcement priorities and privacy rules all feed back into the topics on this exam. Treat the exam as a first checkpoint, not a finish line.

To start your preparation, take a timed baseline on the practice test linked at the top of this guide, and compare the result by domain with the table above. That gives you a plan for the weeks ahead and shows early where your effort will pay off most.

Frequently Asked Questions

How many questions are on the CPCO exam?

Each sitting has 100 multiple-choice questions and a four-hour (240-minute) limit, so pacing averages 2.4 minutes per item. Passing needs 70%. Verify the current format on AAPC's CPCO page before booking.

What is the passing score for the CPCO exam?

AAPC requires an overall score of 70% to pass the CPCO exam, which means at least 70 of the 100 questions correct. If you miss more than 30, you will not pass. A failing result also lists the areas of study where your sub-score was 65% or less.

How much does the CPCO exam cost?

As of October 2026, AAPC lists one CPCO exam attempt for $425 and two exam attempts for $499. AAPC's online training course starts at $1,195. Prices change, so check AAPC's CPCO exam page for the current fee before you pay for a voucher.

Which CPCO domains have the most questions?

Three domains hold 65 of the 100 questions: other laws and regulations with 24, OIG compliance program guidance for physicians and small group practices with 22, and key and other risk areas with 19. Fraud and abuse laws add 12 and investigation process and audits add 9.

Can you take the CPCO exam at home?

Yes. AAPC offers a remote option supervised by a live proctor as well as in-person testing centers. The at-home option needs a setup that meets AAPC's technical requirements, including an external webcam. Phones and tablets are not allowed into the exam room.

How long do CPCO results take?

AAPC says results appear online in your My AAPC Account Dashboard under My Exams, within 7-10 business days after you take the exam. If you pass, your certificate is mailed to you. If you do not pass, the result lists the areas where your sub-score was 65% or less.

How do you renew the CPCO credential?

AAPC states that the CPCO stays valid while you keep an active annual AAPC membership and complete 36 continuing education units in each two-year cycle. Check AAPC's CPCO overview page for the current requirements and for how units are reported, because renewal rules can change.

Select ratingPoorOkayGoodGreatAwesome

No votes yet