Risk and Compliance cheat sheet

Corporate governance is the system by which organizations are directed and controlled; it allocates rights and responsibilities among stakeholders and sets rules for decision-making.

Board responsibilities include approving strategy, overseeing risk appetite, appointing senior management, and ensuring financial reporting integrity.

Separation of duties: the CEO should not also chair the board; independent directors reduce conflicts of interest.

Three lines model: first line owns risk (business units), second line monitors and advises (risk/compliance), third line provides independent assurance (internal audit).

Tone at the top: senior leadership's ethical behavior and commitment to compliance set the control environment for the entire organization.

Regulatory governance requirements often mandate board risk committees, compliance officers with direct access to the board, and whistleblower protections.

Stakeholder theory vs. shareholder primacy: governance frameworks balance interests of shareholders, employees, customers, regulators, and communities.

Disclosure and transparency: timely, accurate reporting of material risks and governance arrangements is a core governance principle.

Governance codes (e.g., OECD Principles, UK Corporate Governance Code) provide voluntary or comply-or-explain standards for board composition and accountability.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws, regulations, or internal policies.

Three lines of defense: business units (1st), compliance/risk functions (2nd), internal audit (3rd) - each has distinct roles in managing compliance risk.

Risk-based compliance: allocate resources to areas with highest inherent risk and weakest controls; assess inherent risk × control effectiveness = residual risk.

Compliance program elements: tone at the top, policies and procedures, training, monitoring and testing, reporting, and remediation.

Regulatory mapping: maintain a inventory of applicable laws and regulations, map them to controls, and track changes.

Key risk indicators (KRIs) for compliance include number of regulatory inquiries, training completion rates, policy exceptions, and audit findings.

Whistleblowing and speak-up mechanisms are required in many jurisdictions; they must protect confidentiality and prohibit retaliation.

Conduct risk focuses on employee behavior that can harm customers, markets, or the firm's reputation, distinct from legal compliance risk.

Risk management process: identify, assess, treat (avoid, reduce, transfer, accept), monitor, and report risks.

Risk appetite is the amount and type of risk an organization is willing to accept; risk tolerance is the acceptable variation around that appetite.

Inherent risk is risk before controls; residual risk is risk remaining after controls. Risk rating often = impact × likelihood.

COSO ERM framework: governance and culture, strategy and objective-setting, performance, review and revision, information and communication.

ISO 31000 principles: risk management creates value, is integrated, structured, customized, inclusive, dynamic, uses best available information, considers human factors, and is continually improved.

Quantitative risk measures: expected loss = probability × impact; value at risk (VaR) estimates maximum loss at a confidence level over a period.

Key risk indicators (KRIs) are metrics that provide early warning of increasing risk exposure; thresholds trigger escalation.

Risk register: a central repository documenting risks, owners, ratings, controls, and treatment plans.

Stress testing and scenario analysis assess impact of extreme but plausible events on risk exposures.