CBA (CNCF) key terms

A formal written document approved by the board or audit committee that defines the internal audit function's purpose, authority, scope, and reporting lines. It establishes the mandate for unrestricted access to records and personnel.

The freedom of internal auditors from conditions that threaten their ability to make impartial judgments, including reporting lines, compensation, and personal relationships. It requires reporting to the audit committee rather than management.

An unbiased mental attitude that lets auditors perform engagements without subordinating judgment to others. It is an individual attribute, undermined by conflicts of interest, prior operational responsibility, or pressure to soften findings.

A subset of the board of directors responsible for overseeing financial reporting, external and internal audit, and risk management. It approves the audit charter, reviews audit results, and protects auditor independence.

A situation in which a person's private interest or outside role could improperly influence their professional judgment or actions on behalf of the bank. Such situations must be disclosed and managed or avoided.

A formal statement of the values and behavioral expectations governing employees or auditors, covering integrity, objectivity, confidentiality, and competence. It sets the standard for acceptable conduct and the consequences of violations.

A governance framework separating management and internal controls (first line), independent risk and compliance oversight (second line), and internal audit (third line). It clarifies accountability for risk management across the organization.

The phase in which auditors define objectives, scope, criteria, and a resource and timing plan for an assignment. It includes understanding the process, identifying risks, and designing procedures to address them.

An approach that allocates audit resources according to the assessed likelihood and impact of risks across activities. Higher-risk areas receive more frequent and deeper coverage than low-risk areas.

A complete inventory of the auditable entities, processes, and systems within the bank's scope. It is used to rank risk and build the annual audit plan and coverage cycle.

A detailed document listing the specific procedures and tests to be performed during an engagement, often linked to control objectives. It guides fieldwork and supports consistent, complete evidence gathering.

Documentation prepared or obtained by auditors that records the procedures performed, evidence examined, and conclusions reached. It must be sufficient to allow an experienced reviewer to reperform the work.

Information collected to support audit findings and conclusions, which must be sufficient, reliable, relevant, and useful. Its quality depends on source independence, timeliness, and the strength of controls over its production.

Selecting a subset of a population to draw conclusions about the whole, using statistical or judgmental methods. Sample size and selection method must support the confidence needed for the conclusion.

The threshold at which an omission or misstatement, individually or in aggregate, could influence decisions of users such as regulators, investors, or the board. It guides scoping, sampling, and the rating of findings.

A documented conclusion that a condition differs from established criteria, typically presented with the criteria, condition, cause, effect, and a recommendation. Findings are rated by severity and tracked to resolution.

The process of monitoring management's remediation of audit findings and verifying that corrective actions were implemented and are effective. Unresolved issues are escalated to senior management and the audit committee.

The level of risk that exists before considering the effect of controls, based on the nature and complexity of the activity. It drives how much control testing is warranted.

The risk that remains after existing controls have been applied, which must be compared against the bank's risk appetite. It is the basis for deciding whether additional mitigation is needed.

Policies, procedures, and systems designed to provide reasonable assurance of reliable reporting, effective operations, and compliance with laws. Controls are preventive, detective, or corrective and may be manual or automated.

Dividing responsibilities so that no single person controls all stages of a transaction, such as initiation, authorization, custody, and reconciliation. It reduces the risk of error and fraud going undetected.

The amount and type of risk a bank is willing to accept in pursuit of its objectives, expressed in qualitative statements and quantitative limits. It is set by the board and cascades into business line limits.

A firm-wide approach to identifying, assessing, and managing risks across credit, market, liquidity, operational, and compliance categories. It aggregates risk information to support board-level oversight and capital planning.

Procedures used to determine whether a control is designed appropriately and operating effectively throughout the period. Techniques include inquiry, observation, inspection, and reperformance of the control.

A government-backed guarantee protecting depositors up to a statutory limit if an insured bank fails. It maintains public confidence and is funded through premiums assessed on insured institutions.

The difference between interest income earned on assets and interest expense paid on liabilities, divided by earning assets. It measures the profitability of the bank's core lending and funding activities.

The risk that a bank cannot meet its obligations as they come due without incurring unacceptable losses. It is managed through diversified funding, liquid asset buffers, and cash flow projections.

The process of identifying and verifying customers and understanding their business and expected activity before and during the relationship. It forms the foundation for monitoring and reporting suspicious transactions.

Ongoing procedures to establish customer identity, beneficial ownership, source of funds, and expected transaction patterns. Enhanced due diligence applies to higher-risk customers such as politically exposed persons.

Identifying the natural persons who ultimately own or control a legal entity customer, typically those holding a specified ownership percentage or exercising control. It prevents criminals from hiding behind corporate structures.

A confidential filing to the financial intelligence unit reporting transactions that may involve illegal activity or violate rules. Banks must file within prescribed deadlines and are prohibited from tipping off the customer.

Deliberately breaking up transactions to stay below reporting or recordkeeping thresholds in order to avoid scrutiny. It is a federal offense and a common red flag detected through transaction monitoring.

A filing required for currency transactions exceeding a specified dollar threshold, identifying the individual and the transaction. It supports law enforcement analysis and must be filed within regulatory timeframes.

The risk that a borrower or counterparty fails to meet contractual obligations, resulting in financial loss. It is managed through underwriting standards, limits, collateral, and ongoing monitoring of exposures.

A measure comparing the loan amount to the appraised value of the collateral, commonly used in mortgage underwriting. Higher ratios indicate greater loss exposure and typically require insurance or stricter terms.

Assets pledged to secure a loan, which the lender may seize and liquidate if the borrower defaults. Its value must be periodically re-evaluated and properly perfected through legal filings.

A valuation account estimating expected credit losses on the loan portfolio, reducing the carrying value of loans. Its adequacy is assessed using historical loss experience, economic forecasts, and portfolio risk characteristics.

A loan placed on cash basis for interest recognition because principal or interest is past due beyond a defined period or full collection is doubtful. It signals elevated credit deterioration.

The exposure of earnings and capital to changes in interest rates, including repricing, basis, yield curve, and option risk. It is measured through gap analysis, duration, and earnings simulations.

The capital a bank must hold to absorb losses, measured in tiers and compared to risk-weighted assets. Minimum ratios and buffers constrain growth and distributions to shareholders.

Exposures adjusted by regulatory risk factors reflecting credit, market, and operational risk, used as the denominator in capital ratios. Higher-risk assets require more capital support.

The sufficiency of a bank's capital relative to its risk profile and regulatory minimums, including stress-tested scenarios. Weak adequacy can trigger supervisory action and restrict dividends or growth.

Periodic filings of financial and risk data to supervisors, such as call reports and capital schedules, which must be accurate and timely. Errors can result in penalties and restatement.

The threat of loss from cyber attacks, data breaches, or system compromise, including financial, reputational, and operational harm. It is managed through layered defenses, monitoring, and incident response planning.

Mechanisms that restrict system and data access to authorized users based on role and least-privilege principles. It includes authentication, authorization, and periodic review of user entitlements.

A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents, including notification obligations. It assigns roles and requires periodic testing through exercises.

The process of assessing and monitoring third-party providers that handle data or perform critical functions, including due diligence, contractual safeguards, and ongoing oversight. Weak oversight can create operational and compliance exposure.