Risk and Compliance key terms

The framework of rules, practices, and decision rights by which leadership directs an organization, sets risk appetite, assigns accountability, and monitors whether objectives are met.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by senior leadership or the board.

The acceptable variation around a specific risk appetite level, often stated as a measurable threshold or limit that operational units must stay within when taking risk.

A hard boundary on a defined risk exposure, such as a maximum position size or credit concentration, that triggers escalation or corrective action when breached.

A governance structure where operational management owns risk, an independent risk and compliance function oversees it, and internal audit provides independent assurance to the governing body.

An independent, objective assurance function that evaluates the design and effectiveness of controls, risk management, and governance, and reports findings to the board or audit committee.

The second-line unit that identifies applicable legal and regulatory requirements, advises the business, monitors adherence, and reports compliance risk to senior management and the board.

The potential for legal or regulatory sanctions, financial loss, or reputational damage arising from failure to comply with applicable laws, regulations, rules, or internal standards.

A specific duty imposed on an organization by statute, regulation, or supervisory directive that must be met, tracked, and evidenced through documented controls and records.

The structured process for identifying new or amended regulations, assessing their impact, assigning owners, updating policies and controls, and confirming implementation by a target date.

The integrated set of policies, processes, roles, tools, and reporting arrangements an organization uses to identify, assess, treat, monitor, and communicate risk across all levels.

The process of identifying risks, analyzing their likelihood and impact, and evaluating whether they fall within acceptable levels so that treatment decisions can be prioritized.

The level of risk that exists before any controls or mitigants are applied, providing a baseline for judging how much protection current controls actually deliver.

The risk remaining after existing controls and mitigants have been applied, which must be compared with risk tolerance to decide whether further action is needed.

A policy, procedure, device, or activity designed to prevent, detect, or correct errors, fraud, or non-compliance so that risk is reduced to an acceptable level.

A safeguard applied before or during a process, such as segregation of duties, approval limits, or access restrictions, intended to stop an undesirable event from occurring.

A mechanism such as reconciliation, exception report, or monitoring alert that identifies an error, breach, or irregularity after it has occurred so it can be corrected.

The examination of a control's design and operating effectiveness through inquiry, observation, inspection, or re-performance, producing evidence that the control works as intended.

An arrangement that divides incompatible tasks, such as initiating, approving, recording, and reconciling a transaction, among different people to reduce fraud and error risk.

A living record of identified risks that captures owners, causes, potential impacts, inherent and residual ratings, controls, treatment actions, and review dates.

The named individual accountable for managing a specific risk, including maintaining controls, monitoring exposure, and reporting changes in risk level to governance bodies.

The selection and application of options to address risk, typically avoiding, reducing, transferring, or accepting it, with the choice documented and approved at the right level.

Shifting the financial consequences of a risk to another party, for example through insurance, hedging, or contractual indemnities, without eliminating the underlying exposure.

A forward-looking metric that signals rising or falling exposure in a risk area, giving management early warning before losses or breaches actually materialize.

A measure of progress toward business objectives that, when paired with risk indicators, helps leadership see whether growth or efficiency gains are being achieved by taking excessive risk.

The shared values, attitudes, and behaviors within an organization that determine how openly risks are discussed, escalated, and weighed against commercial pressure.

The example set by senior leaders through their statements and actions, which shapes whether employees treat compliance and ethical conduct as genuine priorities.

A written statement of the ethical standards and behavioral expectations the organization requires of employees and representatives, often supported by training and attestation.

A situation where a person's private interests or relationships could improperly influence their professional judgment, requiring disclosure, recusal, or other mitigation.

The reporting of suspected wrongdoing, often through a protected confidential channel, with safeguards against retaliation so concerns surface without fear.

The obligation of a named person to answer for decisions, results, and control failures to a higher authority, backed by clear authority and consequences.

A defined process for raising breaches, emerging risks, or unresolved issues to more senior levels within set timeframes so decisions are made at the appropriate authority.

Independent confirmation, based on evidence, that controls and risk processes are operating effectively, giving the board confidence in management's reported position.

The lifecycle process for drafting, approving, publishing, training on, and periodically reviewing policies so that documented requirements stay current and are actually followed.

The exposure created when vendors, outsourcers, or partners fail to meet obligations, including service disruption, data breaches, and regulatory or reputational harm.

The investigation and evaluation performed before engaging a counterparty, vendor, or transaction, covering financial standing, integrity, controls, and legal or regulatory status.

The risk that delegated activities are performed poorly or that the organization loses control over a critical function, mitigated by contracts, oversight, and exit planning.

The identification and verification of customers' identities and business profiles, used to detect money laundering, fraud, sanctions issues, and other illicit activity.

The laws, regulations, and controls intended to prevent criminals from disguising the proceeds of crime as legitimate funds through financial systems.

A confidential filing made to the relevant authority when an institution detects transactions or behavior that may indicate money laundering, fraud, or other criminal conduct.

The potential loss of trust, customers, or stakeholder support arising from negative publicity, ethical failures, or operational incidents that damage how the organization is perceived.