BR-ANAC-PLH cheat sheet

Three lines model: first line owns and manages risk; second line provides oversight, policy, and challenge; third line (internal audit) gives independent assurance.

Board accountability: the governing body approves the compliance program, sets risk appetite, and receives regular reporting on compliance risk and control effectiveness.

Regulatory hierarchy: statute > regulation/rule > guidance > supervisory expectation; guidance is not binding law but signals examiner priorities.

Risk appetite statement defines the level and types of compliance risk the institution is willing to accept; tolerance levels translate appetite into measurable limits.

Materiality threshold: a compliance failure is material if it could affect licensure, cause customer harm, trigger enforcement, or exceed a defined financial or reputational limit.

Change management rule: regulatory changes must be mapped to affected policies, controls, and systems before the effective date, with named owners and completion evidence.

Governance escalation: unresolved compliance issues escalate through the compliance committee to the board risk committee within defined timeframes.

Regulatory relationship protocol: examinations and supervisory inquiries are coordinated by a designated function with legal counsel involved where privilege or enforcement risk exists.

Risk assessment formula: inherent risk (likelihood × impact) minus control effectiveness = residual risk; residual risk is compared to risk appetite.

Risk factors typically scored: customer type, product complexity, geography, transaction volume, delivery channel, and regulatory intensity.

Risk rating scale must be defined with objective criteria for each level so different assessors reach consistent results.

Program elements: governance, risk assessment, policies and procedures, training, monitoring and testing, reporting, investigation, remediation, and records management.

Scoping rule: every product, service, channel, and legal entity is mapped to applicable requirements; gaps in the mapping are themselves a risk finding.

Risk assessment refresh triggers: new product or market entry, mergers or acquisitions, significant regulatory change, material incident, or passage of the defined review cycle.

Control design standard: each control has an owner, a description of how it operates, a frequency, evidence requirements, and a mapped risk it mitigates.

Proportionality: resource allocation to compliance controls should be commensurate with residual risk, documented in the risk assessment output.

Policy hierarchy: policy states principles and mandatory requirements; procedure states step-by-step execution; standard defines technical or operational specifications.

Policy lifecycle: draft, review, approve, publish, train, attest, monitor, and periodic review; each stage has an owner and a record.

Approval authority matrix: policies are approved at the level matching the risk they govern, with board approval for the highest-risk or enterprise-wide policies.

Control types: preventive (blocks the event) versus detective (identifies after the event); manual versus automated; each has different evidence and testing needs.

Segregation of duties: no single person should be able to initiate, approve, execute, and reconcile the same transaction; conflicts are identified and mitigated.

Exception handling: deviations from policy require documented approval at the defined authority level, a time limit, and a compensating control.

Attestation rule: staff confirm they have read and will comply with applicable policies at onboarding and at defined intervals thereafter.

Version control: superseded policies are withdrawn from circulation, and the current version is identifiable by date and version number.

Training needs analysis maps role, risk exposure, and regulatory requirement to a defined curriculum; high-risk roles receive enhanced training.

Completion tracking: training records show who completed what, when, and the result; non-completion is escalated through line management.

Effectiveness measurement: knowledge checks, scenario-based assessments, and post-training testing results are used to evaluate whether training changed behavior.

Tone at the top: senior leaders communicate expected conduct through direct messages, and this is documented and repeated at defined intervals.

Communication channels: staff have a documented route to raise compliance questions and concerns, including anonymously where permitted by law.

Regulatory change communication: new requirements are communicated to affected staff before the effective date, with acknowledgement evidence.

Third-party training: agents, vendors, and intermediaries performing regulated functions receive training proportionate to the risk they carry.

Monitoring is ongoing, performed by the first or second line; testing is periodic and independent; auditing is performed by the third line.

Test design: define the control objective, population, sample method, pass/fail criteria, and evidence standard before fieldwork begins.

Sampling rule: sample size increases with population size and desired confidence; judgmental samples must be justified in the workpaper.

Exception rate threshold: results above the defined tolerance indicate the control is not operating effectively and require a finding.

Findings must state the condition, criteria, cause, effect, and recommendation; management response includes an owner and a due date.

Issue validation: remediation is retested before closure, and repeat findings are escalated because they indicate a systemic control failure.

Metrics and key risk indicators are monitored against thresholds; a breach triggers investigation and, where warranted, a corrective action plan.

Quality assurance: testing workpapers are reviewed by a second person before findings are reported, and review evidence is retained.

Investigation steps: intake and triage, scoping, evidence preservation, interviews, analysis, conclusion, and reporting.

Privilege rule: legal privilege applies only where counsel directs the investigation for the purpose of legal advice; factual investigation work is not automatically privileged.

Evidence handling: documents and data are preserved with a documented chain of custody; alteration or deletion after notice is a separate violation.

Whistleblower protection: retaliation against a reporter is prohibited by law in many jurisdictions and is itself a reportable conduct breach.

Remediation plan elements: root cause, corrective action, owner, due date, evidence of completion, and validation by an independent function.

Root cause analysis distinguishes the proximate error from the underlying control, process, or culture failure that allowed it.

Reporting cadence: compliance reports to management and the board include risk profile, issue status, testing results, and regulatory developments.

Regulatory notification: certain events require notification to the regulator within a defined period; legal counsel determines the obligation and timing.

Enforcement tools include warning letters, consent orders, civil money penalties, cease-and-desist orders, license conditions, and referral for criminal prosecution.

Sanctions screening: names are checked against applicable lists at onboarding and on an ongoing basis; matches are investigated and resolved with documented rationale.

Case handling workflow: intake, classification, assignment, investigation, decision, sanction where warranted, appeal, and closure.

Proportionality in internal discipline: sanctions are consistent with the conduct, the employee's role, and precedent, and the rationale is documented.

Self-reporting and cooperation can reduce penalties; concealment or repeat violations generally increase them.

Sanctions lists may include asset freezes and transaction prohibitions; a confirmed match requires reporting to the competent authority.

Case records include the allegation, evidence, analysis, decision, and any remedial action, retained per the records schedule.

Escalation rule: cases involving senior personnel, significant financial loss, or potential regulatory breach go to the compliance committee or board.

Conflicts of interest: identify, disclose, and manage; where management is not possible, the conflicted person is recused from the decision.

Gifts and entertainment: thresholds and approval requirements are defined; anything of value that could influence judgment is prohibited or requires approval.

Independence: compliance and audit staff must not perform or approve the activities they are responsible for testing.

Confidentiality duty: information learned in the course of work is used only for legitimate business purposes and shared on a need-to-know basis.

Ethical decision test: is it legal, consistent with policy, fair to the customer, and would it withstand public scrutiny?

Anti-retaliation: reporting in good faith is protected even if the concern is not substantiated; retaliation is a disciplinary matter.

Professional competence: staff performing compliance functions hold the qualifications and continuing education required for their role.

Speak-up culture: near misses and errors are reported without fear, and reporting is encouraged through visible leadership behavior.

Record retention: each record class has a defined retention period based on legal, regulatory, and business requirements, after which disposal is documented.

Data minimization: only data necessary for the defined purpose is collected, and access is limited to those with a legitimate need.

Data classification tiers (public, internal, confidential, restricted) determine handling, storage, transmission, and sharing requirements.

Cross-border transfer: personal data movement across jurisdictions requires a lawful transfer mechanism and, where applicable, customer notice or consent.

Breach response: contain, assess, notify affected parties and regulators within required timeframes, and remediate the root cause.

Legal hold: when litigation or investigation is reasonably anticipated, deletion is suspended and preservation is documented.

Access controls: role-based access, periodic access reviews, and prompt revocation on termination are core confidentiality controls.

Confidentiality agreements with third parties define permitted use, security obligations, and breach notification duties.