CORCM cheat sheet

Three lines model: 1st line owns and manages risk; 2nd line provides oversight and compliance; 3rd line provides independent assurance.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk tolerance is the acceptable variation around that appetite.

Inherent risk is assessed before controls; residual risk is assessed after controls are applied.

GRC capability maturity is commonly described in five levels: ad hoc, developing, defined, managed, and optimized.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

A control's design effectiveness asks whether the control, as designed, would mitigate the risk; operating effectiveness asks whether it actually operated as designed.

Accountability cannot be delegated to a third party; responsibility for a process may be, but the accountable executive remains answerable.

Risk culture is evidenced by how decisions are made when risk and reward conflict, not by stated values alone.

Risk = likelihood × impact; a 5×5 matrix multiplies scores on a 1–25 scale, with heat-map bands set by policy.

Inherent risk score = likelihood × impact before controls; residual risk score = likelihood × impact after control effectiveness is factored.

Control effectiveness ratings typically reduce likelihood and/or impact; a control rated ineffective leaves residual risk at or near inherent.

Risk assessment methods include interviews, workshops, process mapping, loss-event data analysis, scenario analysis, and control self-assessments.

A risk register records risk ID, description, cause, consequence, owner, inherent score, controls, residual score, treatment, and review date.

Key risk indicators (KRIs) are forward-looking measures with thresholds that signal rising exposure; key performance indicators (KPIs) measure achievement.

Risk aggregation combines individual risk scores across a portfolio; correlation and concentration can make aggregate risk exceed the simple sum.

A risk taxonomy provides consistent categories (strategic, operational, financial, compliance, reputational) so risks can be compared and rolled up.

Four treatment options: avoid (eliminate the activity), reduce (apply controls), transfer (share via insurance or contract), and accept (retain with sign-off).

Preventive controls stop an event before it occurs; detective controls identify it after; corrective controls limit or repair the impact.

Segregation of duties separates initiation, authorization, custody, and recording so no single person controls an entire transaction.

A control must have an owner, a frequency, an evidence artifact, and a defined test procedure to be auditable.

The cost of a control should be proportionate to the risk it mitigates; disproportionate controls create unnecessary operational burden.

Compensating controls substitute for a primary control when it cannot be applied; they must be documented and approved.

Automated controls generally provide more consistent evidence than manual controls, but require testing of the underlying logic and configuration.

Risk treatment plans specify action, owner, due date, and success criteria; acceptance of residual risk above appetite requires escalation.

Core program elements: governance and tone at the top, risk assessment, policies and procedures, training, monitoring and testing, issue management, and reporting.

A policy states mandatory requirements; a standard specifies measurable criteria; a procedure gives step-by-step instructions; a guideline is recommended practice.

A regulatory obligation register maps each requirement to the owning process, control, and evidence source.

Compliance testing samples transactions against defined attributes; a finding is raised when the error rate exceeds the tolerance set in the test plan.

Training completion, attestation rates, and policy exception counts are common compliance program metrics.

Issue management tracks findings from identification through root-cause analysis, remediation, validation, and closure.

A compliance risk assessment ranks obligations by likelihood and impact of noncompliance to prioritize monitoring effort.

Whistleblower and speak-up channels are program controls that support early detection of misconduct.

Horizon scanning identifies proposed and final rules from regulators, industry bodies, and legislative sources before they take effect.

A regulatory change log records the rule, source, effective date, applicability assessment, impact, owner, and implementation status.

Impact assessment determines which policies, controls, systems, and training must change and estimates the effort and cost.

The compliance calendar schedules filings, reports, attestations, and renewals with owners and due dates ahead of deadlines.

Regulatory mapping links each obligation to internal controls so change impact can be traced through the control environment.

Gap analysis compares current state to the new requirement and produces a remediation plan with owners and target dates.

Post-implementation review confirms the change was embedded and the control operates as intended.

Regulators may issue guidance, FAQs, and enforcement actions that signal supervisory expectations even without new rules.

Vendor lifecycle: business case and risk tiering, due diligence, contracting, onboarding, ongoing monitoring, and offboarding.

Risk tiering considers data sensitivity, criticality to operations, regulatory exposure, and subcontractor use.

Due diligence reviews financial stability, security posture, compliance certifications, business continuity, and subcontractor arrangements.

Contracts should include audit rights, breach notification timelines, data protection terms, subcontractor approval, and termination/exit provisions.

Concentration risk arises when many critical services depend on one vendor or a small number of vendors.

Fourth-party risk is the risk introduced by a vendor's own subcontractors and must be assessed and monitored.

Ongoing monitoring uses service-level reporting, attestations, security ratings, and periodic reassessment based on risk tier.

Exit planning ensures data return or destruction, transition support, and continuity if the relationship ends.

Incident lifecycle: identification, classification, containment, eradication, recovery, and post-incident review.

Severity classification drives escalation paths, notification obligations, and response timelines.

Regulatory notification deadlines vary by regime and often run from the moment of discovery, not resolution.

An incident response plan defines roles, communication channels, escalation thresholds, and evidence preservation steps.

Root-cause analysis seeks the underlying failure, not just the proximate trigger, to prevent recurrence.

Post-incident reviews produce corrective actions tracked to closure and feed lessons learned into control design.

Breach notification may require notifying regulators, affected individuals, and law enforcement within prescribed timeframes.

Incident logs should capture timeline, impacted systems, data involved, decisions made, and notifications sent.

Reporting audiences differ: the board needs risk posture and trends; management needs operational detail; regulators need prescribed formats.

Leading indicators predict future risk; lagging indicators measure past events such as losses and findings.

A metric is meaningful only if it has a defined owner, data source, calculation method, threshold, and review cadence.

Assurance maps to the three lines: management self-assessment, compliance monitoring, and internal audit independent testing.

A finding should state condition, criteria, cause, effect, and recommendation.

Dashboards should show trend, threshold breaches, and remediation status rather than raw counts alone.

Assurance coverage analysis identifies which risks and controls have been tested and which remain untested.

Report accuracy depends on data lineage; metrics should be traceable to source systems and reconciled.