CORCM flashcards
CORCM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, approved by the board and expressed in qualitative and quantitative terms.
- Risk tolerance
- The acceptable variation around the risk appetite for a specific risk category, defining the boundary beyond which escalation and action are required.
- Three lines model
- A governance structure in which the first line owns risk, the second line provides oversight and compliance, and the third line provides independent assurance.
- Inherent risk
- The level of risk before considering the effect of any controls, used as a baseline to evaluate the value added by the control environment.
- Residual risk
- The risk remaining after controls have been applied and their effectiveness assessed, compared against risk appetite to determine whether further treatment is needed.
- Risk register
- A structured record of identified risks with owners, causes, consequences, inherent and residual scores, controls, treatment plans, and review dates.
- Key risk indicator
- A forward-looking metric with defined thresholds that signals rising risk exposure, enabling proactive management before losses occur.
- Risk treatment options
- The four responses to risk: avoid the activity, reduce it through controls, transfer or share it, or accept and retain it with documented approval.
- Preventive control
- A control designed to stop an undesirable event from occurring, such as access restrictions, approvals, or segregation of duties.
- Detective control
- A control that identifies an undesirable event after it has occurred, such as reconciliations, exception reports, or monitoring alerts.
- Segregation of duties
- A control that separates initiation, authorization, custody, and recording of transactions so no single individual can complete and conceal a transaction.
- Compensating control
- An alternative control used when a primary control cannot be applied, documented and approved to provide equivalent risk mitigation.
- Policy versus procedure
- A policy states mandatory requirements and intent, while a procedure provides step-by-step instructions for executing the policy in daily operations.
- Compliance obligation register
- A catalog mapping each regulatory requirement to its owning process, supporting control, evidence source, and monitoring frequency.
- Compliance testing
- Sampling transactions or activities against defined attributes to determine whether controls operate as designed and requirements are met.
- Issue management
- The process of tracking findings from identification through root-cause analysis, remediation, validation, and formal closure.
- Horizon scanning
- Systematic monitoring of proposed and final regulations, guidance, and enforcement trends to anticipate compliance obligations before they take effect.
- Regulatory change log
- A record of each regulatory change with source, effective date, applicability assessment, impact, owner, and implementation status.
- Regulatory gap analysis
- A comparison of current practices against a new requirement that identifies shortfalls and produces a remediation plan with owners and dates.
- Compliance calendar
- A schedule of regulatory filings, reports, attestations, and renewals with assigned owners and due dates tracked ahead of deadlines.
- Vendor risk tiering
- Classifying third parties by data sensitivity, operational criticality, and regulatory exposure to determine the depth of due diligence and monitoring.
- Fourth-party risk
- Risk introduced by a vendor's own subcontractors and service providers, which must be assessed and monitored as part of third-party oversight.
- Concentration risk
- The risk that dependence on a single vendor or a small number of vendors for critical services creates a single point of failure.
- Vendor exit plan
- Documented arrangements for data return or destruction, transition support, and continuity if a third-party relationship is terminated.
- Incident severity classification
- Assigning a severity level based on impact and urgency to determine escalation paths, notification obligations, and response timelines.
- Root-cause analysis
- A structured investigation to identify the underlying failure that allowed an incident, rather than only the proximate trigger, so recurrence is prevented.
- Breach notification
- The obligation to inform regulators, affected individuals, or law enforcement of a data breach within prescribed timeframes after discovery.
- Post-incident review
- A structured debrief after an incident that documents timeline, decisions, lessons learned, and corrective actions tracked to closure.
- Leading indicator
- A forward-looking metric that predicts future risk or performance, such as training completion or open high-severity findings.
- Lagging indicator
- A backward-looking metric that measures outcomes already realized, such as losses, breaches, or regulatory findings.
- Assurance mapping
- An analysis of which risks and controls have been tested and by which line of defense, identifying gaps in coverage.
- Finding structure
- A finding states the condition observed, the criteria it violates, the cause, the effect or risk, and a recommendation for remediation.