CORCM key terms

An organizational structure that separates management (first line), independent risk and compliance oversight (second line), and internal audit (third line) so that risk-taking, monitoring, and assurance are performed by different parties.

The condition in which the compliance group has sufficient authority, reporting lines, and freedom from operational pressure to raise concerns and escalate issues without retaliation or conflicts of interest.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively and approved at the top of the organization.

A formal document that articulates the organization's appetite for risk by category and sets boundaries, escalation triggers, and metrics so that business decisions can be tested against agreed limits.

The acceptable variation around a risk appetite limit for a specific activity, process, or metric, often expressed as a threshold or range that triggers action when breached.

The maximum level of risk an organization can absorb before its financial, operational, or reputational viability is threatened, independent of what management is willing to accept.

The signals sent by senior leadership through words, decisions, and resourcing that shape whether employees treat compliance and ethical behavior as genuinely important.

The shared norms, incentives, and behaviors that determine how employees actually handle regulatory obligations and ethical dilemmas in day-to-day work.

The overall set of governance, integrity, structure, and accountability factors set by leadership that provide the foundation for all other internal controls.

A maintained inventory that maps each applicable legal or regulatory requirement to the processes, controls, and owners responsible for meeting it.

A structured process that identifies applicable obligations, rates the likelihood and impact of noncompliance, and prioritizes where compliance resources and controls should be focused.

The level of risk that exists before any controls or mitigations are applied, used as a baseline to judge how much protection controls actually provide.

The risk that remains after existing controls and treatments have been applied, which must be compared against tolerance to decide whether further action is needed.

A visual grid that plots risks by likelihood and impact so that stakeholders can quickly see concentrations, priorities, and changes over time.

A living record of identified risks that captures each risk's description, owner, rating, controls, treatment actions, and status for tracking and reporting.

A forward-looking metric that signals rising exposure in a process or risk category so management can act before a loss or breach occurs.

The documented approach defining how risks are identified, scored, weighted, and reviewed, including scales, criteria, data sources, and refresh frequency.

A technique that explores plausible future events or stress conditions to test whether current controls and capital would hold up under adverse circumstances.

A newly developing or changing exposure whose likelihood or impact is not yet well understood but which may become material, such as new technology or regulatory shifts.

A documented set of actions, owners, resources, and deadlines for addressing a risk by avoiding, reducing, transferring, or accepting it.

A formal, documented decision by an authorized person to retain a risk without further mitigation, typically justified against appetite and reviewed periodically.

A safeguard designed to stop an error, fraud, or noncompliance event from occurring in the first place, such as access restrictions or mandatory approvals.

A safeguard designed to identify problems after they occur, such as reconciliations, monitoring alerts, or periodic reviews, so that issues can be corrected.

The specification of how a control operates, including its objective, trigger, owner, frequency, evidence produced, and escalation path when exceptions arise.

A control that is essential to reducing a significant risk to an acceptable level, and whose failure would materially undermine the compliance objective it supports.

The examination of a control's design and operating effectiveness through inquiry, observation, walkthroughs, or sample testing to confirm it works as intended.

The degree to which a control, as actually operated, achieves its stated objective and reduces the risk it was designed to address.

A control principle that divides incompatible tasks, such as authorization, custody, and recordkeeping, among different people to reduce error and fraud risk.

A governing document that defines the compliance function's mandate, scope, authority, reporting lines, and responsibilities within the organization.

The combined policies, procedures, training, monitoring, reporting, and governance an organization uses to meet its regulatory and ethical obligations on an ongoing basis.

Structured education that gives employees the knowledge and judgment to recognize obligations, spot red flags, and respond appropriately in their roles.

Ongoing, risk-based checks performed by the second line to confirm that controls and processes are operating as designed and obligations are being met.

A confidential, accessible mechanism for staff and others to report suspected misconduct or legal violations, with protections against retaliation for good-faith reports.

An environment in which employees feel safe raising concerns, asking questions, and challenging decisions without fear of blame or retaliation.

The process for identifying, interpreting, and implementing new or amended requirements, including impact assessment, control updates, and communication across the organization.

Systematic monitoring of legislative, regulatory, and enforcement developments to anticipate upcoming changes before they take effect and require action.

A comparison of current practices and controls against a new or existing requirement to identify where the organization falls short and what remediation is needed.

The practice of linking specific regulatory obligations to the controls and processes that satisfy them, revealing overlaps and unmet requirements.

A time-bound action plan assigning owners and milestones to close identified deficiencies, with tracking and escalation until the issue is verified as resolved.

The process of identifying, assessing, monitoring, and controlling risks introduced by vendors, suppliers, and other external parties throughout the relationship lifecycle.

Pre-contract investigation of a third party's financial standing, controls, compliance history, and reputation to decide whether and how to engage them.

Continuous or periodic review of a third party's performance, compliance posture, and risk profile after onboarding, triggered by events or scheduled reassessment.

Risk arising from a vendor's own subcontractors or suppliers, which can affect service delivery and compliance even without a direct contractual relationship.

A contract provision allowing the organization or its designee to examine a vendor's controls, records, and facilities to verify compliance with agreed obligations.

Allocating defined responsibilities, liabilities, indemnities, or insurance requirements to a counterparty through contract terms so that certain risks shift to that party.

The danger that reliance on a single vendor, market, or system creates outsized disruption if that dependency fails or is suddenly unavailable.

A documented playbook defining roles, escalation paths, communication steps, and containment actions to be taken when a compliance or security incident occurs.

The defined process for raising an incident to higher authority or specialized teams within set timeframes based on severity, impact, and regulatory reporting triggers.

A formal report to a regulator about a qualifying event, made within prescribed timeframes and containing the information required by the applicable rule.

A structured investigation to determine the underlying reasons an incident or control failure occurred, so that fixes address causes rather than symptoms.

Documented procedures for maintaining or restoring critical operations during and after a disruption, including alternate resources, recovery priorities, and communication protocols.

The lifecycle process for logging, prioritizing, assigning, tracking, and validating the closure of identified problems, including audit findings and compliance deficiencies.

A reporting view that consolidates key compliance metrics, open issues, and risk trends so leadership can see status and act on exceptions quickly.

The structured communication of compliance status, risks, and issues to management, boards, and regulators in a form suited to each audience's decisions.

Accurate, timely, and relevant data prepared for decision-makers, ideally with trends, comparisons, and clear commentary rather than raw figures alone.

Independent or objective verification that the compliance program and its controls are working as intended, providing confidence to the board and stakeholders.

An independent function that evaluates the adequacy and effectiveness of governance, risk management, and controls and reports its findings to the board or audit committee.

A targeted, usually second-line examination of a specific process, business unit, or obligation to assess adherence and identify improvement opportunities.