BCCP key terms

A formal, documented system of governance, policies, controls, monitoring, training, and response mechanisms that an organization builds to prevent, detect, and correct violations of laws, regulations, and internal standards.

A governance framework that separates management's ownership of risk (first line), independent risk and compliance oversight functions (second line), and internal audit's independent assurance (third line), clarifying accountability across the organization.

A governing document approved by senior leadership or the board that establishes the compliance function's mandate, authority, independence, reporting lines, and scope of responsibilities within the organization.

The individual accountable for designing, operating, and continuously improving the compliance program, including advising the business, overseeing controls, and escalating material issues to senior management and the board.

The signals senior leaders and the board send through their decisions, incentives, and behavior about whether ethical conduct and legal compliance are genuinely prioritized over short-term results.

The shared values, norms, and everyday behaviors that determine how employees actually treat legal and ethical obligations, shaped by leadership messaging, incentives, peer behavior, and perceived fairness of consequences.

The organizational path through which the top compliance executive reports, ideally to the board or a board committee with a dotted line to the CEO, to preserve independence from the business units being overseen.

The governing body's duty to receive regular compliance reporting, approve program resources and risk appetite, and hold management accountable for remediating significant deficiencies and violations.

The allocation of decision rights, accountability, and oversight among the board, executives, and functions that determines who sets compliance priorities and who answers for failures.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements or metrics that guide compliance decisions and set thresholds for escalation.

The collection of statutes, regulations, supervisory guidance, and enforcement practices from the jurisdictions and agencies that govern an organization's activities and shape its compliance obligations.

A structured process for identifying, interpreting, and implementing new or amended legal requirements, including assigning owners, updating policies and controls, and confirming implementation before effective dates.

The extent to which laws and regulators of one country or territory apply to an organization's operations, customers, or conduct occurring elsewhere, often through extraterritorial or cross-border provisions.

A situation in which requirements from two or more jurisdictions or rule sets cannot both be satisfied, forcing the organization to document its analysis and choose a defensible resolution.

Legal duties governing how personal information is collected, used, stored, shared, and deleted, including notice, consent, minimization, security, retention limits, and breach notification requirements.

A schedule and set of practices defining how long each category of business record must be preserved, where it is stored, and when and how it is lawfully destroyed.

A directive suspending routine destruction of records relevant to actual or reasonably anticipated litigation, investigation, or regulatory inquiry, issued promptly and tracked until formally released.

A systematic process of identifying compliance risks, estimating their likelihood and impact, and prioritizing them against defined criteria so that controls and monitoring resources target the greatest exposures.

The level of risk that exists before considering the effect of any controls, reflecting the nature of the activity, transaction volume, customer base, and regulatory sensitivity.

The risk that remains after existing controls are applied, calculated by adjusting inherent risk for how well those controls are designed and actually operating.

A maintained inventory of identified compliance risks recording owners, ratings, linked controls, monitoring results, and remediation status so that risk information is comparable and trackable over time.

A measurable metric tracked over time that signals rising or falling exposure to a specific compliance risk, with defined thresholds that trigger review or escalation.

An assessment of whether a control is properly designed to address the risk and is operating as intended, typically supported by testing evidence rather than management assertion alone.

Written statements of required conduct and the step-by-step instructions for carrying them out, translating legal obligations and risk decisions into clear, enforceable expectations for employees.

The end-to-end sequence of drafting, review, approval, publication, training, periodic review, revision, and retirement that keeps policies current and demonstrably governed.

The safeguards, approvals, reconciliations, system restrictions, and segregation of duties designed to prevent, detect, or correct errors and noncompliance in business processes.

Dividing responsibilities so that no single person can initiate, authorize, record, and review the same transaction, reducing both error and the opportunity for concealment of misconduct.

Structured examination of a control's design and operation using sampling, walkthroughs, or reperformance to determine whether it works reliably enough to be relied upon.

Ongoing, typically management-owned surveillance of transactions, communications, and processes against defined criteria to detect deviations early and prompt timely correction.

An independent function that provides objective assurance to the board on the adequacy and effectiveness of risk management, controls, and governance, operating outside management's direct control.

A documented conclusion that a control is missing, poorly designed, or not operating effectively, usually stating the condition, criteria, risk, root cause, and required corrective action.

A documented commitment specifying the actions, responsible owner, resources, and target date for correcting a deficiency, with validation that the fix actually resolves the underlying issue.

Planned, role-appropriate delivery of compliance knowledge and expectations, reinforced by regular messaging, acknowledgment of policies, and accessible guidance so employees can act correctly.

A foundational statement of the ethical and behavioral standards expected of everyone in the organization, often covering conflicts of interest, gifts, confidentiality, fair dealing, and reporting obligations.

An environment in which employees feel safe raising concerns or refusing to participate in wrongdoing because reporting channels are trusted and retaliation is visibly and consistently punished.

Legal and organizational safeguards prohibiting retaliation against individuals who report suspected wrongdoing in good faith, including confidentiality of identity and remedies for reprisal.

A structured, documented inquiry into alleged misconduct that gathers and preserves evidence, interviews relevant parties, reaches findings on a defensible standard, and recommends action.

The practice of securing documents, communications, system logs, and other material in a forensically sound and unaltered state so that findings can withstand challenge by regulators or courts.

A disciplined method for identifying the underlying process, incentive, or culture failures that allowed a problem to occur, so corrective action fixes the cause rather than only the symptom.

The concrete steps taken to stop ongoing misconduct, discipline responsible parties, restore affected processes, and prevent recurrence, tracked to completion and verified for effectiveness.

A formal measure by a regulator or prosecutor such as a fine, consent order, cease-and-desist, license restriction, or criminal charge, often requiring monitored remediation commitments.

A situation where personal, financial, or outside interests could improperly influence professional judgment, managed through disclosure, recusal, or removal of the conflicting interest.

A reasoned process for resolving dilemmas by weighing legal requirements, organizational values, stakeholder impact, and long-term consequences, and documenting the rationale for the chosen course.

An attitude of questioning and verifying rather than accepting information at face value, prompting follow-up when evidence is incomplete, inconsistent, or comes from an interested party.

Any adverse action taken against someone for reporting a concern or cooperating with an investigation, prohibited regardless of whether the original allegation is substantiated.

A comparison of current practices against a required standard, such as a new regulation or framework, that identifies specific shortfalls and forms the basis for a remediation plan.