CGIC key terms

The system of rules, practices, and processes by which an organization is directed and controlled, balancing the interests of stakeholders such as shareholders, management, customers, and the community.

The elected or appointed body responsible for overseeing an organization's strategy, major decisions, and management performance on behalf of stakeholders.

The obligation of individuals or bodies to answer for their decisions, actions, and results to those with a legitimate right to ask, such as owners, regulators, or the public.

The practice of openly disclosing relevant information about decisions, performance, and risks so stakeholders can understand and evaluate what the organization is doing.

A state in which a person or body is free from relationships or pressures that could compromise objective judgment when carrying out oversight or assurance duties.

Any individual or group that can affect or is affected by an organization's activities, including shareholders, employees, customers, suppliers, regulators, and the wider community.

The coordinated set of activities for identifying, assessing, treating, and monitoring uncertainties that could affect an organization's objectives.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, usually expressed in qualitative or quantitative statements approved by leadership.

The acceptable variation around a risk appetite level that an organization can bear in a specific area before action is required.

The maximum level of risk an organization can absorb financially and operationally before its objectives or solvency are seriously threatened.

The level of risk that exists before any controls or mitigating actions are applied to reduce it.

The level of risk that remains after management has implemented controls and other responses to address the inherent risk.

A structured record listing identified risks along with their owners, likelihood, impact, ratings, controls, and planned responses.

The process of identifying risks, analyzing their likelihood and impact, and evaluating whether they fall within acceptable levels.

The selection and application of options to address a risk, such as avoiding, reducing, transferring, or accepting it.

The person accountable for managing a specific risk and for ensuring that appropriate responses are implemented and monitored.

The state of conforming to applicable laws, regulations, standards, and internal policies, and the programs an organization uses to achieve and demonstrate that conformity.

A structured set of policies, procedures, training, monitoring, and reporting activities designed to prevent and detect violations of legal and regulatory requirements.

The risk that changes in laws or regulations, or failure to comply with them, will cause financial loss, penalties, or reputational harm.

A formal document stating the behavioral standards and ethical expectations that employees and representatives are required to follow.

A situation where a person's private interests could improperly influence, or appear to influence, their professional decisions or duties.

Independent work that provides objective evaluation and confidence about the reliability of information, the effectiveness of controls, or the adequacy of governance and risk processes.

An independent, objective function within an organization that evaluates governance, risk management, and control processes and reports its findings to the board or audit committee.

A committee of the board, typically composed of independent directors, that oversees financial reporting, external and internal audit, and risk and compliance matters.

The information gathered and evaluated by auditors to support conclusions and opinions, which must be sufficient, relevant, and reliable.

The formal conclusion issued by an auditor stating whether the subject matter, such as financial statements, is presented fairly and in accordance with the applicable framework.

The threshold at which an omission or misstatement could influence the economic decisions of users, guiding auditors on what matters enough to report.

Selecting a subset of items from a population to draw conclusions about the whole, used when testing controls or transactions in audit and compliance work.

Any policy, procedure, or activity designed to prevent, detect, or correct errors, fraud, or other deviations from expected performance.

The overall system of controls, including the control environment, risk assessment, control activities, information and communication, and monitoring, that supports achievement of objectives.

The ongoing or periodic review of controls, compliance, and risk responses to confirm they continue to operate effectively and to identify needed improvements.

A governance framework that separates management's ownership of risk (first line), independent risk and compliance oversight (second line), and independent internal audit assurance (third line).

The principles and standards that guide behavior by distinguishing right from wrong and shaping how individuals and organizations make decisions.

The quality of being honest, consistent, and principled in actions and decisions, even when doing so is difficult or costly.

The state of mind that allows a person to make judgments and decisions without bias, prejudice, or undue influence from others.

A questioning mindset and critical assessment of information and evidence, alert to possible misstatement, bias, or fraud rather than accepting claims at face value.

The reporting of suspected wrongdoing, misconduct, or illegal activity within an organization, often through a protected confidential channel.