Risk and Compliance study guide
Risk and Compliance · Work through your exam, one topic at a time.
The ICA Certificate in Risk and Compliance is a professional qualification offered by the International Compliance Association (ICA), a body that describes itself as the leading professional body for the global regulatory and financial crime compliance community and states that it has trained over 190,000 professionals and serves more than 30,000 members across 155 countries. The credential sits within ICA's Governance, Risk and Compliance subject area, one of the subject areas listed on the ICA site alongside Anti Money Laundering, Financial Crime Prevention, Customer Due Diligence/KYC, Managing Sanctions Risk and Cyber Risk. It is aimed at professionals whose responsibilities touch regulatory compliance, risk control and governance, including those building a foundational understanding before progressing to advanced study. An advanced-level variant, the ICA Advanced Certificate in Risk and Compliance, is also referenced in the qualification landscape. Topics on this exam: Governance, Risk and Compliance and Risk Management. The Risk and Compliance study guide has 2 sections and about 628 words.
01Governance of Risk and Compliance
Governance is the system by which decisions are made, authority is delegated, and accountability is enforced. For a risk and compliance candidate, the core concepts are the three lines model, the board's risk appetite statement, the compliance charter, and the escalation paths that connect them. The board sets appetite and oversight; management owns and operates controls in the first line; an independent risk and compliance function provides challenge and monitoring in the second line; internal audit gives assurance in the third. Questions often blur ownership with assurance .
337 words, about 2 min02Risk Management Fundamentals
Candidates must be fluent in the risk management process: identify, assess, treat, monitor, and report. Assessment combines likelihood and impact , often through a risk matrix or heat map, and should distinguish inherent risk (before controls) from residual risk (after controls). Treatment options are traditionally accept, avoid, transfer, and mitigate - sometimes extended with exploit for positive risk. Key control concepts include preventive versus detective controls, key risk indicators, control testing, and the concept of risk appetite versus risk tolerance.
291 words, about 1 min