- ACFC Exam Structure Overview
- Domains 1 & 2: ACA Compliant Advanced Planning Techniques
- Domain 3: Preparing for and Surviving a DOL Audit
- Domain 4: Best Practices
- Domain 5: Cyber Liability
- Domain 6: Benefits Calendar
- Domain 7: HIPAA & HITECH
- Domain 8: TPA Liability
- Scheduling the 8 Domains Against Your Study Calendar
- Who Actually Tests on This Content
- FAQ
- The ACFC exam is organized into 8 domain lines mirroring the official study-program sessions, unweighted as site categories.
- Domains 1 and 2 cover Part 1 and Part 2 of advanced ACA planning techniques - the largest content block.
- The exam is 100 multiple-choice questions, 3 hours, with a 60% passing score, delivered through ECFC's MY LEARNING system.
- Exam access expires 120 days after purchase, so domain-by-domain pacing matters more than cramming.
ACFC Exam Structure Overview
The Advanced Certified in Flexible Compensation (ACFC) credential, administered by the Employers Council on Flexible Compensation (ECFC), is the advanced designation that benefits professionals pursue after earning their CFC. Unlike entry-level certifications that test broad definitions, ACFC assumes you already understand flexible compensation fundamentals and instead pushes into compliance depth, audit readiness, and operational risk - the areas where experienced practitioners actually get tripped up.
The exam itself is delivered online through ECFC's MY LEARNING system: 100 multiple-choice questions, a 3-hour window, and a 60% passing threshold. Your exam access must be used within 120 days of purchase, so understanding the domain breakdown early lets you plan a realistic study runway instead of discovering late that time has run out. For a full walkthrough of registration mechanics and deadlines, see ACFC Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
The 8 domains below correspond directly to the sessions in the official ACFC study program. They are presented as unweighted content categories rather than percentage-weighted sections, which means no single domain is officially flagged as "worth more" - but in practice, the first two domains carry the most material because they split advanced ACA planning into two parts.
Domains 1 & 2: ACA Compliant - Advanced Planning Techniques, Parts 1 and 2
The first two domains function as a matched pair. Domain 1 opens the advanced ACA planning material and Domain 2 continues it, together forming the largest and most technically dense portion of the study program. If you're building a study calendar, treat these two sessions as a single extended unit rather than two separate short reviews.
Domain 1: ACA Compliant - Advanced Planning Techniques, Part 1
Establishes the advanced framework for structuring flexible compensation plans so they remain compliant under the Affordable Care Act as regulations and employer situations evolve.
- How advanced plan design decisions interact with ACA compliance obligations
- Identifying planning scenarios where standard approaches create compliance exposure
Domain 2: ACA Compliant - Advanced Planning Techniques, Part 2
Extends the Part 1 material into more complex or edge-case planning situations that advanced practitioners are expected to navigate independently.
- Applying the frameworks from Part 1 to nuanced, real-world plan situations
- Recognizing when advanced planning decisions require escalation or additional documentation
Because these two domains are session-based rather than weighted by percentage, don't assume a shortcut is available. Expect questions that require you to trace a planning decision through to its compliance consequence rather than simply recall a definition. For a deeper breakdown of how these domains typically show up on the exam and how to prepare for them specifically, the ACFC Study Guide 2026: How to Pass on Your First Attempt walks through pacing recommendations in more detail.
Domain 3: Preparing for and Surviving a DOL Audit
This domain shifts from planning to defense. Candidates are expected to understand what triggers a Department of Labor audit, what documentation an employer needs on hand before one starts, and how to respond once an auditor is engaged.
What to Master
- The documentation trail a compliant flexible compensation plan should maintain continuously, not just at audit time
- Common audit triggers and how administrative practices can either reduce or invite scrutiny
- The sequence of steps an organization should follow once notified of a DOL audit
Expect scenario-based questions here rather than pure recall - the exam tends to describe a situation (an incomplete filing, a missed deadline, an employee complaint) and ask what the correct next step should be.
Domain 4: Best Practices
Best Practices is the domain most likely to test judgment calls that don't have a single obvious textbook answer. It covers the operational habits and administrative standards that separate well-run flexible compensation programs from ones that are technically compliant but poorly managed.
Domain 5: Cyber Liability
Flexible compensation programs handle sensitive employee financial and health data, which makes cyber liability a natural fit for the advanced curriculum. This domain covers the exposure organizations face when plan data is compromised and what liability follows a breach.
Core Topics
- How liability for a data breach is allocated between the employer, the plan administrator, and any outside vendors
- Preventive controls that reduce cyber exposure in benefits administration
- What obligations arise once a breach involving plan participant data is discovered
Domain 6: Benefits Calendar
The Benefits Calendar domain tests your command of the recurring timeline that governs flexible compensation administration - open enrollment windows, filing deadlines, plan-year transitions, and the notice periods tied to each. This is less about memorizing specific dates and more about understanding the sequencing logic: what has to happen before what, and what the consequences are when a step in the calendar is missed or delayed.
Domain 7: HIPAA & HITECH
Privacy regulation gets its own dedicated domain, reflecting how central protected health information handling is to flexible compensation administration. Candidates need working familiarity with both HIPAA's privacy and security requirements and the breach-notification expansions introduced under HITECH.
What Candidates Must Know
- How HIPAA's privacy rule applies specifically to flexible spending and benefits data, not just general medical records
- Security safeguards expected of plan administrators handling protected health information
- How HITECH extends notification obligations when a privacy or security incident occurs
This domain pairs conceptually with Domain 5 (Cyber Liability) - a breach scenario question may test both privacy notification rules and liability allocation in the same item, so it's worth reviewing them back to back.
Domain 8: TPA Liability
The final domain addresses third-party administrator (TPA) liability - a subject that comes up repeatedly across the exam's scenario questions because so much day-to-day flexible compensation administration is outsourced. Candidates need to understand where an employer's liability ends and a TPA's liability begins, and what contractual language actually protects the plan sponsor.
Focus Areas
- How liability is typically allocated between plan sponsor and TPA in administrative agreements
- Warning signs that a TPA relationship is creating uncompensated risk for the employer
- The employer's ongoing oversight duties even after administration is outsourced
Key Takeaway
Domains 5, 7, and 8 (Cyber Liability, HIPAA & HITECH, and TPA Liability) form a connected risk cluster on the exam. Study them as a group rather than in isolation - breach and liability scenarios frequently touch all three.
Scheduling the 8 Domains Against Your Study Calendar
Because exam access expires 120 days after purchase, the smartest approach is to map the 8 domains onto a fixed calendar rather than studying reactively. A simple, domain-aligned schedule keeps the heaviest material (Domains 1 and 2) from being rushed at the end.
ACA Advanced Planning, Parts 1 & 2
- Work through Domain 1 and Domain 2 material together since they form one continuous topic
- Practice scenario questions that require tracing a planning decision to its compliance outcome
Audit Readiness & Best Practices
- Cover Domain 3 (DOL Audit) and Domain 4 (Best Practices) back to back
- Focus on judgment-based questions rather than pure recall
Risk Cluster: Cyber, Privacy, TPA
- Study Domain 5, Domain 7, and Domain 8 together as a connected liability cluster
- Review Domain 6 (Benefits Calendar) sequencing alongside these for context
Full Review & Scheduling
- Run a full practice exam under the 3-hour, 100-question format
- Confirm your exam access window before locking in a test date - see the ACFC Exam Dates 2026 guide
This kind of structured pacing is more useful for ACFC than generic study hacks, because the exam's own architecture - 8 domain-based sessions rather than weighted topics - practically hands you a study outline. For a broader look at how difficult candidates generally find this material, see How Hard Is the ACFC Exam? Complete Difficulty Guide 2026.
Who Actually Tests on This Content
ACFC is built for professionals already working in benefits administration, flexible compensation plan design, or HR compliance roles who are upgrading from a CFC designation. The domain list reflects that reality - this isn't introductory material, it's the compliance and risk-management layer that sits on top of foundational flexible compensation knowledge.
If you're still deciding whether the credential fits your career path, Is the ACFC Certification Worth It? Complete ROI Analysis 2026 covers the decision factors, and ACFC Jobs looks at where the designation tends to matter on a resume. For eligibility specifics before you commit to the study program and exam bundle, review ACFC Requirements 2026: Eligibility, Prerequisites & How to Qualify.
| Domain | Core Focus |
|---|---|
| 1. ACA Advanced Planning, Part 1 | Advanced ACA-compliant plan structuring |
| 2. ACA Advanced Planning, Part 2 | Complex/edge-case ACA planning scenarios |
| 3. DOL Audit | Audit preparation and response |
| 4. Best Practices | Administrative judgment and operational standards |
| 5. Cyber Liability | Data breach exposure and liability allocation |
| 6. Benefits Calendar | Deadline sequencing and plan-year timing |
| 7. HIPAA & HITECH | Privacy rules and breach notification |
| 8. TPA Liability | Third-party administrator risk and oversight |
Once you've mapped the domains, the next practical question is what score you actually need across them. The exam applies a single 60% passing threshold rather than domain-by-domain minimums, which is explained in more detail in ACFC Passing Score 2026: Exactly What You Need to Pass. And if you want the numbers behind registration - the $1024 member / $2048 non-member study-and-exam bundle plus the $180 retake fee - see ACFC Certification Cost 2026: Complete Pricing Breakdown.
For a condensed, exam-day reference that pulls the highest-value facts from all 8 domains into one page, bookmark the ACFC Cheat Sheet 2026: One-Page Review of Must-Know Facts. And if you'd rather test your domain knowledge right now under realistic conditions, head back to the ACFC practice test hub to run a full-length simulated exam.
Frequently Asked Questions
No. The 8 domain lines organize the official study-program sessions as unweighted categories. There is no published percentage breakdown per domain - the 100 questions draw from across all 8 sessions.
Start with Domains 1 and 2 (ACA Compliant Advanced Planning Techniques, Parts 1 and 2) since they form the largest, most interconnected block of material and set up concepts referenced elsewhere in the exam.
Exam access must be used within 120 days of purchase, so it's important to schedule your domain review and testing date well within that window.
There's no per-domain pass/fail - only an overall score. If your overall result falls below the 60% passing threshold, you'll need to retake the exam, which carries a published $180 retake fee.
Because domains are unweighted and questions are drawn from all 8 sessions, skipping any domain entirely raises risk. Liability-focused domains (Cyber Liability, HIPAA & HITECH, TPA Liability) especially tend to appear in linked scenario questions, so partial coverage is risky.