Risk and Compliance flashcards
Risk and Compliance · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Corporate governance
- The system of rules, practices, and processes by which a company is directed and controlled, balancing interests of shareholders, management, and other stakeholders.
- Board of directors
- Elected group responsible for overseeing company strategy, appointing executives, ensuring financial integrity, and protecting shareholder interests.
- Tone at the top
- The ethical atmosphere created by leadership's behavior and messaging, which sets the standard for compliance and risk culture throughout the organization.
- Three lines model
- Governance framework: first line owns and manages risk; second line provides oversight and compliance; third line (internal audit) gives independent assurance.
- Separation of duties
- Control principle that no single person should control all aspects of a transaction, preventing fraud and errors by dividing responsibilities.
- Stakeholder theory
- Governance view that firms should consider interests of all stakeholders-employees, customers, suppliers, communities-not just shareholders.
- Independent director
- Board member with no material relationship with the company, enhancing objectivity and reducing conflicts of interest in oversight.
- Risk committee
- Board-level committee responsible for overseeing the organization's risk appetite, risk management framework, and major risk exposures.
- Compliance risk
- The risk of legal or regulatory penalties, financial loss, or reputational harm resulting from failure to comply with laws, regulations, or internal policies.
- Risk-based compliance
- Approach that allocates compliance resources according to the likelihood and impact of regulatory breaches, focusing on highest-risk areas first.
- Compliance program
- Structured set of policies, training, monitoring, and reporting designed to prevent, detect, and remediate violations of laws and regulations.
- Regulatory mapping
- Process of identifying all applicable laws and regulations, linking them to internal controls, and tracking changes to ensure ongoing compliance.
- Key risk indicator (KRI)
- Metric providing early warning of increasing risk exposure, with thresholds that trigger escalation or corrective action.
- Whistleblowing
- Reporting of illegal or unethical conduct within an organization, often protected by law and internal policies against retaliation.
- Conduct risk
- Risk arising from employee behavior that may harm customers, markets, or the firm's reputation, distinct from legal or regulatory compliance risk.
- Residual risk
- The level of risk remaining after controls and mitigation measures have been applied; used to determine acceptability against risk appetite.
- Compliance monitoring
- Ongoing surveillance and testing of business activities to ensure adherence to policies, laws, and regulations, enabling timely remediation.
- Regulatory change management
- Process for identifying, assessing, and implementing responses to new or amended regulations affecting the organization.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively and/or quantitatively.
- Risk tolerance
- The acceptable variation around the risk appetite; the maximum deviation from desired risk levels before action is required.
- Inherent risk
- The level of risk before considering the effect of existing controls; used as a baseline for assessing control effectiveness.
- Risk register
- A central document listing identified risks, their owners, ratings, controls, and treatment plans, used to track and manage risk.
- Risk treatment options
- Four main responses to risk: avoid (eliminate activity), reduce (mitigate), transfer (insurance), or accept (retain).
- COSO ERM framework
- Enterprise risk management framework with five components: governance and culture, strategy and objective-setting, performance, review and revision, information and communication.
- ISO 31000
- International standard providing principles and guidelines for risk management, emphasizing value creation, integration, and continual improvement.
- Value at risk (VaR)
- Statistical measure estimating the maximum loss over a given time period at a specified confidence level under normal market conditions.
- Stress testing
- Technique assessing the impact of extreme but plausible adverse scenarios on an organization's financial condition and risk exposures.
- Risk heat map
- Visual tool plotting risks by likelihood and impact, often color-coded, to prioritize risk management efforts.
- Key control
- A control critical to mitigating a significant risk; its failure could result in material loss or regulatory breach.
- Control testing
- Process of evaluating whether controls are designed and operating effectively to mitigate identified risks.
- Risk owner
- Individual accountable for managing a specific risk, including implementing controls and monitoring exposure.
- Scenario analysis
- Forward-looking method exploring potential future events and their impacts to inform risk assessment and strategic planning.