BR-ANAC-PLH flashcards
BR-ANAC-PLH · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Three lines model
- A governance structure in which the first line owns and manages risk, the second line provides oversight and challenge, and the third line gives independent assurance.
- Risk appetite
- The amount and type of compliance risk an institution is willing to accept in pursuit of its objectives, approved by the board and translated into measurable tolerances.
- Residual risk
- The risk remaining after existing controls are applied, calculated as inherent risk adjusted for control effectiveness and compared against the approved risk appetite.
- Inherent risk
- The level of risk before any controls are considered, typically scored as likelihood multiplied by impact using defined risk factors such as product, customer, and geography.
- Control owner
- The named individual accountable for a control operating as designed, including its frequency, evidence, and remediation when testing identifies a failure.
- Preventive control
- A control that stops an error or prohibited event before it occurs, such as an approval requirement or a system edit check that blocks an invalid entry.
- Detective control
- A control that identifies an error or prohibited event after it has occurred, such as reconciliation, exception reporting, or post-transaction review.
- Segregation of duties
- A control principle ensuring no single person can initiate, approve, execute, and reconcile the same transaction, reducing fraud and error risk.
- Policy exception
- A documented, time-limited deviation from a policy requirement, approved at the defined authority level and supported by a compensating control.
- Training needs analysis
- A structured assessment mapping each role's responsibilities and risk exposure to required training content, frequency, and depth of assessment.
- Tone at the top
- Visible senior leadership commitment to ethical conduct and compliance, communicated directly to staff and evidenced through decisions, incentives, and escalation behavior.
- Training effectiveness
- Evidence that training changed knowledge or behavior, measured through assessments, scenario testing, and monitoring of conduct indicators after training.
- Control testing
- Periodic independent examination of whether a control operated as designed throughout the review period, using defined populations, samples, and pass/fail criteria.
- Key risk indicator
- A metric tracked against a defined threshold that signals rising compliance risk, such as complaint volume, exception rates, or overdue remediation items.
- Audit finding
- A documented conclusion that a control or process does not meet its objective, stated with condition, criteria, cause, effect, and recommendation.
- Issue validation
- Independent retesting of remediation evidence before an issue is closed, confirming the corrective action addressed the root cause and is operating sustainably.
- Root cause analysis
- A method that moves beyond the immediate error to identify the underlying process, control, or cultural failure that allowed the issue to occur.
- Remediation plan
- A documented set of corrective actions with a named owner, due date, required evidence, and validation step to resolve an identified compliance issue.
- Whistleblower protection
- Legal and policy safeguards prohibiting retaliation against a person who reports a concern in good faith, including protection when the concern is not substantiated.
- Chain of custody
- A documented record of who handled evidence, when, and how, preserving its integrity and admissibility from collection through final disposition.
- Consent order
- A negotiated enforcement action in which an institution agrees to specified remedies, monitoring, and penalties without admitting or denying the findings.
- Sanctions screening
- Checking customers and transactions against applicable sanctions lists at onboarding and on an ongoing basis, with documented investigation and resolution of matches.
- Self-reporting
- Voluntarily disclosing a violation to the regulator before it is discovered externally, which can mitigate penalties when accompanied by cooperation and remediation.
- Case triage
- Initial assessment of a reported concern that assigns a risk classification, an investigator, and a priority based on severity and potential impact.
- Conflict of interest
- A situation where personal, financial, or other interests could improperly influence professional judgment, requiring disclosure and management or recusal.
- Independence
- The condition in which compliance and audit staff do not perform or approve the activities they test, preserving objectivity in assurance work.
- Anti-retaliation
- The principle and control set ensuring no adverse action is taken against a person who raises a concern in good faith or participates in an investigation.
- Ethical decision test
- A structured question set asking whether an action is legal, policy-compliant, fair to the customer, and able to withstand public scrutiny.
- Records retention schedule
- A documented list assigning each record class a retention period based on legal, regulatory, and business needs, with a defined disposal process.
- Data classification
- Assignment of data to tiers such as public, internal, confidential, or restricted, which determines required handling, storage, and sharing controls.
- Legal hold
- A directive suspending routine deletion of records when litigation or investigation is reasonably anticipated, with preservation steps documented.
- Data breach notification
- The obligation to inform affected individuals and regulators of a confirmed data breach within defined timeframes, following containment and risk assessment.