BCCP cheat sheet

Three-lines model: first line owns and manages risk; second line sets frameworks, policy, and monitoring; third line (internal audit) provides independent assurance to the governing body.

Board or audit-committee oversight duties: approve risk appetite, receive compliance reporting, ensure independence of the compliance and audit functions, and confirm remediation of material issues.

Tone at the top is a control: senior leadership messaging, resource allocation, and consequence management determine whether lower-level controls operate.

Program scope should be defined by a risk-based inventory of laws, regulations, contracts, and standards applicable to each business unit and process.

A compliance charter documents mandate, authority, reporting lines, and scope; it is evidence of a functioning program and should be board-approved.

Key structural elements: governance committee, designated compliance officer, business-line compliance champions, documented escalation paths, and defined reporting cadence.

Maturity models typically progress from ad hoc/reactive, to defined, to measured, to continuously improved; each stage adds documentation, metrics, and integration with strategy.

Independence criterion: the compliance function should not own the business decisions it monitors; conflicts between commercial targets and control duties must be structurally separated.

Sources of obligation hierarchy: statute, then regulation or rule, then guidance and supervisory expectation; guidance is not binding law but informs enforcement posture.

Regulators generally expect a risk-based, documented program; the existence of reasonable procedures is a common defense or mitigating factor in enforcement.

Extraterritorial reach arises where statutes assert jurisdiction over conduct, entities, or effects abroad; assess nexus before assuming a program is domestic-only.

Legal privilege protects attorney-client communications and work product; compliance records created in the ordinary course are generally discoverable.

Records retention obligations come from statute, regulation, litigation holds, and contract; a hold suspends routine destruction immediately on reasonable anticipation of litigation.

Regulatory change management: assign ownership, monitor sources, assess impact, update policy and controls, train, and evidence the change with dates and approvers.

Whistleblower and anti-retaliation protections typically prohibit adverse action against good-faith reporters and may require confidential internal reporting channels.

Personal accountability regimes impose duties on named senior managers; documented allocation of responsibilities is a common supervisory expectation.

Inherent risk = likelihood x impact before controls; residual risk = inherent risk after control effectiveness is applied.

Risk rating scales must be defined with objective anchors (e.g., financial thresholds, customer harm, regulatory history) so ratings are reproducible across assessors.

Control effectiveness ratings: effective, partially effective, ineffective, or not tested; untested controls cannot be assumed effective.

Risk assessment cadence is event-driven as well as scheduled: triggers include new products, new markets, mergers, regulatory change, and significant incidents.

Inherent risk scoring should exclude control quality; mixing controls into inherent risk understates residual risk and distorts prioritization.

Risk appetite translates into tolerance thresholds and escalation triggers; breaches above tolerance require documented acceptance by an accountable owner.

Risk register minimum fields: risk statement, cause, consequence, owner, inherent score, controls, residual score, treatment plan, and review date.

Aggregation matters: individually acceptable risks can exceed appetite when combined by process, product, geography, or counterparty.

Policy states mandatory requirements and authority; procedure states the step-by-step execution; standard states a technical specification; guideline is non-mandatory.

Policy lifecycle: draft, stakeholder review, approval by authorized body, publication, attestation, periodic review, and retirement with version control.

Exceptions to policy require documented rationale, risk acceptance at the correct authority level, compensating controls, and an expiry date.

Control types: preventive vs. detective; manual vs. automated; and segregation-of-duties, authorization, reconciliation, review, and physical or logical access controls.

Key control designation: controls that materially mitigate a high residual risk are key and must be tested on a defined frequency.

Segregation of duties requires that initiation, approval, recording, and reconciliation of a transaction are not performed by the same individual without compensating monitoring.

Policy hierarchy must be consistent; conflicting documents should be resolved by defined precedence and the conflict logged and corrected.

Monitoring is ongoing, performed by the business or second line; auditing is periodic, independent, and performed by the third line.

Test design elements: population definition, sample selection method, sample size rationale, evidence standard, and pass/fail criteria defined before fieldwork.

Sampling: attribute sampling for control compliance; judgmental or risk-based selection is acceptable when documented and not presented as statistical.

A control deficiency is a design gap or an operating failure; severity considers likelihood, impact, pervasiveness, and whether compensating controls exist.

Findings require a root cause statement, an owner, a remediation action, a due date, and validation of closure by an independent party.

Metrics and key risk indicators should be defined with thresholds, data lineage, and owners; a metric without an escalation trigger is informational only.

Issue aging and repeat-finding rates are leading indicators of program weakness; repeat findings indicate the root cause was not remediated.

Documentation standard: a reviewer with no prior knowledge should be able to reperform the test from the workpapers alone.

Training assignment should be risk-based: role, business unit, geography, and access to regulated data determine content and frequency.

Completion is a process metric; effectiveness requires assessment evidence such as post-training testing, scenario exercises, or observed behavior change.

High-risk roles (e.g., onboarding, sales, trading, payments) typically require more frequent and role-specific training than general staff.

Attestation of policy acknowledgment is a separate control from training; both should be tracked with dates and retained as evidence.

Escalation communications must define who is notified, within what timeframe, and through which channel for each incident category.

Training content must be versioned in step with policy changes; stale content creates a defensible-challenge gap in enforcement.

Non-completion handling: defined grace period, escalation to manager, and consequence path documented in policy rather than applied ad hoc.

Investigation stages: intake and triage, scoping, evidence preservation, fact-finding, findings and conclusion, remediation, and closure with lessons learned.

Evidence handling requires chain of custody, documented collection method, integrity preservation, and access restriction to need-to-know personnel.

Independence: the investigator should not report to, or be managed by, individuals who are subjects or beneficiaries of the outcome.

Case prioritization criteria include severity, potential regulatory reporting duty, financial loss, customer harm, and repeat conduct.

Corrective action must address root cause, not just the symptom; effectiveness is verified after implementation, and the issue is closed only on evidence.

Discipline and consequence management should be consistent with policy and comparable cases; inconsistency undermines the program's deterrent effect.

Regulatory notification obligations may run on a fixed clock from discovery; the investigation timeline must accommodate the earliest deadline.

Confidentiality: need-to-know distribution, documented rationale for disclosures, and anti-retaliation protection for reporters and witnesses.

Conflicts of interest are managed by identify, disclose, mitigate, or recuse; undisclosed conflicts are the primary failure mode.

Gifts and entertainment controls rely on monetary thresholds, pre-approval, registries, and prohibitions tied to decision-making influence.

Independence of mind vs. independence in appearance: both are assessed, and appearance failures are reportable even absent improper conduct.

Confidentiality duty persists after employment ends; permitted disclosures are limited to legal obligation, authorized consent, or protected reporting.

Ethical decision tests: legality, policy compliance, stakeholder harm, disclosure test (would transparency be comfortable), and reversibility.

Speaking up: reporters should use designated channels; retaliation is itself a violation independent of whether the underlying concern is substantiated.

Professional competence duty requires maintaining knowledge of applicable rules and escalating when a matter exceeds one's expertise.