GIA Cert Governance & Risk flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three Lines Model

A governance framework separating management of risk (first line), independent risk and compliance oversight (second line), and independent assurance from internal audit (third line) to the governing body.

Audit committee remit

A board committee of independent directors responsible for overseeing financial reporting, external audit appointment and independence, internal audit, and the integrity of internal control disclosures.

Chair and CEO separation

A governance principle that the board chair should not be the chief executive, preventing concentration of authority; if combined, a lead independent director is a common mitigant.

Comply or explain

A governance approach where entities either follow code provisions or disclose and justify deviation, allowing flexibility while preserving transparency for investors and regulators.

SOX Section 302

Requires the CEO and CFO to certify that periodic financial reports fairly present the financial condition and that disclosure controls and procedures are effective.

SOX Section 404

Requires management to assess and report on internal control over financial reporting, with the external auditor attesting to management's assessment for larger filers.

Agency theory

A framework describing conflicts between principals (owners) and agents (managers); governance mechanisms such as independent boards, audit, and incentives reduce resulting agency costs.

Stakeholder theory

The view that firms are accountable to employees, customers, suppliers, communities, and shareholders, shaping board duties and broadening corporate reporting beyond financial returns.

Shareholder primacy

The view that the board's primary duty is to maximize long-term value for residual claimants, prioritizing shareholder interests over other stakeholder claims in governance decisions.

Board delegation limits

Documented thresholds and reserved matters specifying which decisions require board approval and which are delegated to management, with breaches escalated and recorded.

Lead independent director

An independent director empowered to convene independent director sessions and provide counterbalance when the chair role is combined with the chief executive role.

Independence of directors

A status where a director has no material relationship with the company, its advisers, or management that could compromise objective judgment on board decisions.

Remuneration committee

A committee of independent directors that sets executive pay and incentive structures, aligning rewards with long-term performance and avoiding conflicts of interest.

Governance code disclosure

Annual reporting of board composition, committee membership, independence, and any deviation from code provisions, enabling investor scrutiny of governance quality.

Risk appetite

The aggregate amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements and metrics approved by the board.

Risk tolerance

The acceptable variation in outcomes around the stated risk appetite, often expressed as thresholds or limits that trigger escalation when breached.

Risk capacity

The maximum risk an organization can bear before breaching legal, regulatory, or financial constraints; appetite must not exceed available capacity.

Expected loss formula

Expected loss equals probability of default multiplied by loss given default multiplied by exposure at default, giving the average loss forecast for a portfolio.

Inherent risk

The level of exposure before considering the effect of existing controls, used as the starting point for assessing control effectiveness.

Residual risk

The exposure remaining after existing controls operate, compared against tolerance to decide whether further treatment or escalation is required.

Control effectiveness

The degree to which a control reduces inherent risk to residual risk, evidenced by design assessment and operating effectiveness testing over a defined period.

Risk treatment options

The four responses to assessed risk: accept, avoid, transfer to a third party, or reduce through mitigating controls, each documented with an owner.

ISO 31000 process

A cyclical process of scope and context, identification, analysis, evaluation, treatment, and monitoring, with communication and consultation applied throughout.

COSO ERM components

Five components - governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting - underpinning twenty risk principles.

Risk register

A structured record of identified risks with owners, causes, consequences, inherent and residual ratings, controls, and treatment actions, reviewed at set intervals.

Key risk indicator

A leading metric with defined thresholds and an owner that signals rising exposure, distinct from performance indicators that measure achievement of objectives.

Risk heat map

A matrix plotting likelihood against impact, typically five by five, producing scores from one to twenty-five that map to low, medium, and high escalation bands.

Bow-tie analysis

A diagram placing a central risk event between causes on one side and consequences on the other, mapping preventive and mitigating controls along each pathway.

Risk owner

The named individual accountable for managing a specific risk, including maintaining controls, monitoring indicators, and reporting changes in residual exposure.

Control testing

Evidence-gathering to confirm a control is designed appropriately and operates consistently, using inspection, observation, inquiry, or re-performance over a sample period.

Risk criteria

The thresholds and scales set at the outset of risk assessment that determine whether a risk is acceptable, tolerable, or requires treatment and escalation.

Risk escalation

A defined process by which exposures exceeding tolerance or indicator thresholds are raised to higher authority within set timeframes for decision.