CBA (CNCF) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Independence vs objectivity

Independence is the freedom of the internal audit function from conditions that threaten impartiality, while objectivity is an individual auditor's unbiased mental attitude. Both are required for credible assurance.

Three lines model

A governance model where the first line owns and manages risk, the second line provides oversight and challenge, and the third line, internal audit, gives independent assurance to the board.

External quality assessment

An independent review of the internal audit function performed at least once every five years by a qualified assessor outside the organization, concluding on conformance with the Standards.

Audit charter

A formal document approved by the board that defines internal audit's purpose, authority, and responsibility, including unrestricted access to records, personnel, and property needed for engagements.

Finding elements

A well-formed audit finding states the criteria, the condition observed, the cause of the gap, and the effect or risk, often followed by a recommendation and management response.

Sufficient evidence

Evidence is sufficient when it is factual, adequate, and convincing enough that a prudent auditor would reach the same conclusion. Reliability rises with independence of the source.

Sampling risk

The risk that conclusions drawn from testing a sample differ from conclusions that would result from testing the entire population, controlled by sample size and selection method.

Follow-up process

A structured procedure to verify that management completed agreed corrective actions by target dates, escalating unresolved high-risk items to the audit committee.

Residual risk

The level of risk remaining after existing controls are applied. It equals inherent risk reduced by the effect of control activities and is compared to risk appetite.

COSO components

The five internal control components are control environment, risk assessment, control activities, information and communication, and monitoring activities, each supported by underlying principles.

Segregation of duties

Separating authorization, custody of assets, recording, and reconciliation so no single person controls an entire transaction cycle end to end.

Recovery time objective

The maximum acceptable time to restore a business process or system after disruption. It drives the choice of recovery site and backup strategy.

Net interest margin

Net interest income divided by average earning assets. It measures how efficiently a bank converts its earning asset base into interest income net of funding cost.

Nostro account

An account a bank holds in its own name at a foreign correspondent bank, denominated in that bank's currency, used to settle international transactions and manage currency positions.

Efficiency ratio

Noninterest expense divided by the sum of net interest income and noninterest income. A lower ratio indicates more revenue generated per dollar of operating expense.

Brokered deposits

Deposits obtained through third-party intermediaries rather than directly from customers. They are more rate-sensitive and raise liquidity and interest rate risk concerns.

SAR filing deadline

A suspicious activity report must generally be filed within 30 calendar days of initial detection, extendable to 60 days when no suspect has been identified.

CTR threshold

A currency transaction report is required for currency transactions exceeding $10,000 in one business day and must be filed within 15 calendar days.

Beneficial ownership rule

Customer due diligence requires identifying individuals who own 25 percent or more of a legal entity customer, plus one individual with significant managerial control.

Structuring

Deliberately splitting transactions to stay below reporting thresholds. It is prohibited and is itself reportable suspicious activity even if the underlying funds are legitimate.

Five Cs of credit

Character, capacity, capital, collateral, and conditions. These factors frame an underwriter's assessment of a borrower's willingness and ability to repay.

Debt service coverage ratio

Net operating income divided by total debt service. A ratio below 1.0 signals that cash flow is insufficient to cover required principal and interest payments.

Loan-to-value ratio

Loan amount divided by appraised collateral value. Higher ratios mean less equity cushion and greater loss given default if the borrower defaults.

CECL allowance

The current expected credit loss model requires estimating lifetime expected losses at origination, replacing the prior incurred-loss approach that delayed recognition.

CET1 capital ratio

Common equity tier 1 capital divided by risk-weighted assets. The Basel minimum is 4.5 percent, plus a 2.5 percent capital conservation buffer.

Liquidity coverage ratio

High-quality liquid assets divided by net cash outflows over a 30-day stress period. A minimum of 100 percent indicates sufficient short-term liquidity.

Duration

A measure of a bond's price sensitivity to interest rate changes. A duration of five implies roughly a 5 percent value decline for a one percent rate rise.

Fair value hierarchy

Level 1 uses quoted prices in active markets, Level 2 uses observable inputs, and Level 3 uses unobservable inputs, with reliability decreasing across levels.

Multi-factor authentication

Authentication using at least two distinct factor categories: something you know, something you have, or something you are. Two passwords do not satisfy the requirement.

Least privilege

Granting users only the access necessary for their job duties, reviewed periodically, to limit the impact of compromised credentials or insider misuse.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment limits spread before remediation begins.

Change management controls

Testing, approval, and segregation between development and production access, plus rollback plans, ensure system changes do not introduce errors or unauthorized code.