BCCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance structure in which the first line owns and manages risk, the second line provides oversight, frameworks, and monitoring, and the third line gives independent assurance to the governing body.

Compliance charter

A board-approved document defining the compliance function's mandate, authority, scope, reporting lines, and independence, serving as evidence of a formally structured program.

Risk appetite statement

A governing-body-approved expression of the amount and type of risk an organization is willing to accept in pursuit of its objectives, translated into tolerances and escalation thresholds.

Tone at the top

The observable commitment of senior leadership, shown through messaging, resourcing, and consequence management, that determines whether lower-level controls operate as designed.

Statute versus guidance

Statutes and regulations create binding legal obligations, while supervisory guidance communicates regulator expectations and informs enforcement posture without itself carrying the force of law.

Extraterritorial jurisdiction

The assertion of legal authority over conduct, entities, or effects located outside a jurisdiction's borders, requiring assessment of nexus before limiting a program's scope domestically.

Legal privilege

Protection for attorney-client communications and attorney work product that generally does not extend to compliance records created in the ordinary course of business.

Litigation hold

A directive suspending routine records destruction once litigation or investigation is reasonably anticipated, overriding scheduled retention and disposal policies.

Whistleblower anti-retaliation

Legal and policy protection prohibiting adverse action against individuals who report concerns in good faith, independent of whether the underlying concern is later substantiated.

Regulatory change management

A controlled process to monitor legal sources, assess impact, update policies and controls, train affected staff, and evidence each step with dates and approvers.

Inherent versus residual risk

Inherent risk is assessed before controls are considered; residual risk is the remaining exposure after applying rated control effectiveness. Conflating the two understates exposure.

Control effectiveness rating

A defined rating such as effective, partially effective, or ineffective, supported by testing evidence; untested controls cannot be assumed effective when calculating residual risk.

Risk register fields

Minimum content includes the risk statement, cause, consequence, owner, inherent score, controls, residual score, treatment plan, and next review date.

Risk aggregation

The practice of combining individually acceptable exposures across processes, products, geographies, or counterparties, which can reveal concentration exceeding overall risk appetite.

Risk assessment triggers

Events requiring reassessment outside the scheduled cycle, including new products, new markets, mergers, regulatory change, and significant incidents or losses.

Policy versus procedure

A policy states mandatory requirements and authority, while a procedure describes the step-by-step execution method; standards give technical specifications and guidelines are non-mandatory.

Policy exception handling

Documented rationale, risk acceptance at the correct authority level, compensating controls, and a defined expiry date for any approved deviation from policy requirements.

Key control

A control that materially mitigates a high residual risk and therefore must be tested on a defined frequency with documented evidence of operating effectiveness.

Segregation of duties

A control requiring that initiation, approval, recording, and reconciliation of a transaction are not performed by one individual, or that compensating monitoring exists.

Preventive versus detective control

Preventive controls stop an error or violation before it occurs, such as approval gates; detective controls identify it afterward, such as reconciliations and exception reports.

Monitoring versus auditing

Monitoring is ongoing and performed by the business or second line; auditing is periodic, independent testing performed by the third line with reporting to the governing body.

Attribute sampling

A testing method measuring the rate at which a defined characteristic, such as required approval, appears in a population, using documented selection and pass/fail criteria.

Control deficiency severity

A rating reflecting likelihood, impact, and pervasiveness of a design gap or operating failure, and whether compensating controls reduce the exposure.

Finding root cause

The underlying reason a deficiency occurred, stated explicitly in a finding so remediation addresses cause rather than symptom and prevents repeat findings.

Issue validation of closure

Independent verification, supported by evidence, that a remediation action was implemented and is operating effectively before the finding is formally closed.

Risk-based training assignment

Allocating training content and frequency according to role, business unit, geography, and access to regulated data, with higher-risk roles trained more often.

Training effectiveness evidence

Proof that learning or behavior changed, such as post-training assessments, scenario exercises, or observed performance, as distinct from completion rates alone.

Policy attestation

A tracked acknowledgment that an individual has read and will comply with a policy, recorded with date and retained as evidence separate from training completion.

Escalation matrix

A documented mapping of incident categories to notification recipients, timeframes, and channels, so escalation is determined in advance rather than ad hoc.

Chain of custody

A documented record of who collected, handled, and stored evidence, when, and how integrity was preserved, restricting access to need-to-know personnel.

Investigation independence

A structural safeguard ensuring investigators do not report to, or are not managed by, individuals who are subjects or beneficiaries of the investigation's outcome.

Corrective action verification

Post-implementation testing confirming that a remediation addressed the root cause and operates effectively, required before an issue is closed.