GIA Cert Governance & Risk key terms

The system of rules, practices, and processes by which an organization is directed, controlled, and held accountable to its stakeholders. It allocates authority among the board, management, and shareholders.

The elected or appointed body that oversees management on behalf of owners. It sets strategy, approves risk appetite, appoints senior executives, and monitors performance without running daily operations.

The condition in which a director or auditor has no material relationship with the organization or its management that could compromise objective judgment. Independence supports impartial oversight and challenge.

A board committee responsible for overseeing financial reporting, internal and external audit, and internal control. It provides a direct line to auditors and strengthens oversight of financial and compliance risk.

A board or management committee that oversees the enterprise risk framework, reviews significant exposures, and advises the board on risk appetite and emerging risks. It often reviews risk reporting before board meetings.

A framework that separates management (first line, owning risk), risk and compliance functions (second line, providing oversight), and internal audit (third line, giving independent assurance). It clarifies responsibilities for risk and control.

An independent, objective function that evaluates the effectiveness of governance, risk management, and controls. It reports to the audit committee and provides assurance rather than managing risk itself.

The obligation of individuals and bodies to answer for decisions, actions, and results to a higher authority or stakeholders. Clear accountability requires defined roles, authority, and consequences.

The practice of openly disclosing relevant information about decisions, performance, and risks so stakeholders can assess the organization. It supports trust, scrutiny, and informed decision-making.

Any individual or group affected by or interested in an organization's activities, such as shareholders, employees, customers, regulators, and communities. Governance balances their legitimate interests and expectations.

A person or entity that owns equity in a company, giving rights to vote on certain matters and to share in profits. Shareholders elect directors and rely on governance for protection.

The conflict that arises when managers (agents) pursue their own interests rather than those of owners (principals). Governance mechanisms such as board oversight and incentives aim to reduce this divergence.

The pay and benefits provided to senior executives, including salary, bonuses, and long-term incentives. Governance requires it to be aligned with long-term performance and approved transparently.

A board committee that sets or recommends executive pay policy and individual packages. It aims to align incentives with strategy and avoid conflicts of interest in setting pay.

The formal assignment of decision-making power from a higher level to a lower level, with defined limits and accountability. Documented delegations prevent unauthorized commitments and clarify who may approve what.

A situation where a person's private interest could improperly influence their professional judgment. Governance requires identification, disclosure, and management, often through recusal or removal from decisions.

A formal statement of the ethical standards and behavioral expectations the organization requires of directors, employees, and representatives. It guides decisions and provides a basis for discipline when breached.

The ethical culture and priorities demonstrated by senior leadership, which shape behavior throughout the organization. A strong tone at the top reinforces compliance and control effectiveness.

The reporting of suspected wrongdoing, often internally through protected channels. Effective governance provides confidential, independent reporting routes and protects reporters from retaliation.

An environment where employees feel safe raising concerns, challenging decisions, and reporting problems without fear of reprisal. It depends on leadership example, protected channels, and visible follow-up.

The shared values, norms, and behaviors that shape how work is done and decisions are made. Governance seeks to align culture with stated values and risk appetite.

The coordinated activities used to identify, assess, treat, and monitor risks that could affect objectives. It is a continuous process integrated into strategy and operations rather than a standalone task.

A holistic, organization-wide approach to identifying and managing risks across all functions and levels. It connects risk to strategy, aggregates exposures, and supports informed decision-making by the board.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It is expressed in statements or limits and guides decisions, tolerances, and escalation thresholds.

The acceptable variation or deviation from a risk appetite statement that the organization can bear for a specific risk. Tolerances translate broad appetite into measurable limits for operational use.

The maximum level of risk an organization can absorb before breaching its objectives, capital, or solvency constraints. Capacity is a hard limit; appetite should sit within it.

The level of risk that exists before any controls or mitigation are applied. It helps compare exposures and justify the effort and cost of controls.

The risk remaining after existing controls and mitigation have been applied. It is compared with risk tolerance to decide whether further treatment is needed.

The process of identifying risks and analyzing their likelihood and impact to determine their significance. It informs prioritization and the selection of treatment options.

A structured record of identified risks, their owners, assessments, controls, and treatment actions. It supports monitoring, reporting, and accountability for risk at an appropriate level.

The named individual accountable for managing a specific risk, including its assessment, treatment, and monitoring. Clear ownership prevents risks from being overlooked between functions.

The selection and implementation of measures to modify risk, such as avoiding, reducing, transferring, or accepting it. The choice considers cost, benefit, and the organization's risk appetite.

Shifting the financial or contractual consequences of a risk to another party, for example through insurance or outsourcing. The underlying risk may remain, so monitoring and contract terms matter.

A metric that provides early warning of increasing risk exposure or deteriorating controls. Effective indicators are linked to risk appetite thresholds and trigger escalation or action.

The ongoing tracking of risks, controls, and indicators to detect changes and confirm that treatment works. Results feed reporting to management and the board.

The structured communication of risk information to decision-makers, including exposures, trends, and breaches. Good reporting is timely, relevant, and tailored to the audience's responsibilities.

The policies, procedures, and activities designed to provide reasonable assurance that objectives are met, including reliable reporting and compliance. Controls may be preventive, detective, or corrective.

Dividing tasks so that no single person controls all stages of a transaction, such as authorization, recording, and custody. This reduces the risk of error and fraud.

The examination of controls to determine whether they are designed and operating effectively. Results support assurance opinions and identify where remediation is required.

An independent conclusion, based on evidence, about whether a subject matter conforms to criteria. Assurance gives stakeholders confidence in controls, reporting, or risk management.