CISI Technology in Investment Management cheat sheet

Core front-to-back stack: order management (OMS), execution management (EMS), portfolio management and investment book of record (IBOR), accounting book of record (ABOR), post-trade/settlement, data warehouse and reporting layer.

Front office = pre-trade analytics, order capture, execution; middle office = confirmation, allocation, risk, compliance monitoring; back office = settlement, custody, accounting, reconciliation.

FIX (Financial Information eXchange) is the dominant messaging protocol for order flow; FIX 4.2/4.4 remain common, with FIXML for XML-based variants.

SWIFT MT messages are being migrated to ISO 20022 (MX) for payments and securities messaging; coexistence periods require dual-format handling.

Straight-through processing (STP) rate = trades processed without manual intervention / total trades; a standard operational KPI.

Buy-side vs sell-side systems differ: buy-side emphasises portfolio/IBOR and compliance pre-trade; sell-side emphasises order routing, market connectivity and position keeping.

Cloud deployment models (IaaS, PaaS, SaaS) shift cost from capex to opex; hybrid models are common where data residency or latency constrains full public cloud.

APIs and microservices increasingly replace batch file transfer for intraday position, price and reference data distribution.

Data quality dimensions: completeness, accuracy, timeliness, consistency, validity and uniqueness; each is measurable via defined rules.

Data lineage records the origin and transformation path of a data element from source to report; required for regulatory traceability and impact analysis.

Golden source (system of record) = the single authoritative system for a given data element; conflicts resolved by mastering rules, not by downstream patching.

Reference data (instrument static, counterparty, calendar, currency) changes rarely but errors propagate widely; security master is the central instrument repository.

BCBS 239 principles require risk data aggregation and risk reporting capability: governance, data architecture, accuracy, completeness and timeliness.

Reconciliation breaks are classified by root cause (timing, static data, mapping, booking error); recurring static-data breaks indicate a mastering defect.

Data stewards own business definitions and quality thresholds; data owners are accountable at executive level; custodians (IT) operate the platforms.

Pricing hierarchies define fallback order (e.g., primary vendor, secondary vendor, broker quote, model price) and must be documented and auditable.

OMS functions: order capture, compliance pre-trade checks, allocation, routing, execution monitoring and post-trade handoff; EMS focuses on execution tactics and venue connectivity.

Order lifecycle states typically include new, validated, routed, partially filled, filled, cancelled and rejected; systems must reconcile state across OMS and EMS.

Pre-trade compliance checks include restricted lists, mandate limits, concentration, cash availability and short-sale eligibility; failures block or flag the order.

Best execution obligations require evidence of venue selection, price and timing; transaction cost analysis (TCA) compares execution against benchmarks such as VWAP or arrival price.

Smart order routers (SOR) split orders across venues using rules on price, liquidity, fees and latency; routing logic must be documented and tested.

Market impact and slippage increase with order size relative to average daily volume (ADV); algorithms (POV, TWAP, VWAP, implementation shortfall) target different benchmarks.

FIX session management includes sequence numbers, heartbeats, resend requests and gap fills; a sequence gap halts message processing until resolved.

Clock synchronisation (e.g., MiFID II RTS 25 granularity) is required for event timestamping and audit trail reconstruction.

IBOR holds front-office positions and cash on a trade-date basis, updated intraday; ABOR holds accounting positions on settlement date with accounting rules applied.

Position quantity reconciliation between IBOR and ABOR is a core daily control; differences arise from trade date vs settlement date, income accruals and corporate actions.

Corporate actions (splits, dividends, mergers, rights issues) require entitlement calculation, election processing and position adjustment; missed events cause position breaks.

Portfolio modelling supports what-if analysis, rebalancing and drift monitoring against target weights and mandate bands.

Accrual accounting recognises interest and dividends over time; amortised cost vs fair value classification changes NAV and P&L presentation.

Performance measurement uses time-weighted return (TWR) to remove cash-flow effects and money-weighted return (MWR/IRR) to reflect investor experience.

Shadow accounting or independent valuation is used to challenge the IBOR/ABOR for NAV production and control.

Multi-currency portfolios require FX rate sourcing, translation policy and hedging sub-ledgers to separate local and base currency P&L.

Trade lifecycle post-execution: capture/confirmation, enrichment (SSIs, standing settlement instructions), allocation, affirmation, clearing, settlement and reconciliation.

T+1 settlement in major markets compresses affirmation windows; automated matching and same-day allocation become mandatory controls.

Central securities depositories (CSDs) and central counterparties (CCPs) perform settlement and clearing; matching platforms (e.g., CTM-style) confirm allocations pre-settlement.

ISO 20022 migration affects payment and securities messages; mapping tables between MT and MX fields are required during coexistence.

Corporate action event processing includes announcement capture, entitlement, election deadline tracking, instruction submission and payment reconciliation.

Fails management tracks unsettled trades past intended settlement date; buy-ins and penalties apply under market rules.

Reconciliation types: position, cash, trade and transaction; automated matching with tolerance thresholds and exception queues drives efficiency.

Asset servicing includes custody, fund accounting, transfer agency, securities lending and collateral management, each with distinct technology platforms.

RegTech categories: trade surveillance, communications surveillance, AML/KYC screening, regulatory reporting, sanctions screening and compliance monitoring.

Pre-trade and post-trade compliance engines apply rule sets (investment restrictions, issuer limits, liquidity) against positions and orders; rule changes require controlled release.

Value at risk (VaR) estimates potential loss at a confidence level over a horizon; limitations include tail risk and reliance on historical correlations.

Stress testing applies hypothetical or historical scenarios beyond normal VaR assumptions; results feed limit setting and capital planning.

Regulatory reporting regimes include MiFID II transaction reporting, EMIR trade reporting, SFTR securities financing reporting and Dodd-Frank; each has field-level data requirements.

AML transaction monitoring uses rule-based and behavioural analytics; alert triage, false positive rates and case management are key operational metrics.

Model risk management requires model inventory, independent validation, ongoing performance monitoring and documented governance.

Record-keeping obligations require immutable, retrievable communications and order records with defined retention periods and legal hold capability.

Client reporting outputs: holdings, transactions, performance, attribution, risk statistics, fees and regulatory disclosures; consistency with IBOR/ABOR is essential.

GIPS (Global Investment Performance Standards) govern performance presentation; composites must include all fee-paying discretionary portfolios meeting definition.

Attribution analysis decomposes excess return into allocation, selection and interaction effects (Brinson-style) or factor contributions.

Digital channels include investor portals, mobile apps, APIs and robo-advisory interfaces; authentication and data entitlement controls are critical.

Self-service portals reduce servicing cost but require real-time data feeds and clear disclosure of data latency and valuation basis.

Client onboarding (KYC/AML, suitability, documentation) is increasingly digitised; e-signature and automated screening shorten cycle times.

Reporting automation depends on a governed data layer; manual spreadsheet overlays create key-person risk and control gaps.

Distribution technology includes platform connectivity, fund data feeds and order routing to intermediaries, often via standard templates.

Supervised learning predicts labelled outcomes (e.g., default, price direction); unsupervised learning clusters unlabelled data (e.g., client segmentation, anomaly detection).

Natural language processing supports document extraction, sentiment analysis and communications surveillance; accuracy depends on training data quality and domain tuning.

Robotic process automation (RPA) mimics user interface actions for repetitive tasks; it is brittle to UI changes and best suited to stable, rule-based processes.

Generative AI and large language models produce probabilistic outputs; hallucination risk requires human review, grounding and audit logging in regulated use.

Explainability (SHAP, feature importance) is required where models affect clients or regulatory decisions; black-box models face governance challenges.

Model drift occurs when live data diverges from training distribution; monitoring for accuracy decay and periodic retraining are standard controls.

Bias in training data can produce discriminatory outcomes; testing for disparate impact and documenting data provenance are governance requirements.

Automation governance includes human-in-the-loop design, model inventory, change control and clear accountability for automated decisions.

CIA triad: confidentiality, integrity and availability; controls are mapped to each dimension.

Defence in depth layers controls: perimeter, network segmentation, endpoint protection, identity and access management, data encryption and monitoring.

Multi-factor authentication and least-privilege access reduce credential compromise risk; privileged access management is a priority control.

Phishing and social engineering remain leading initial access vectors; security awareness training and simulated phishing are standard mitigations.

Incident response lifecycle: preparation, detection, containment, eradication, recovery and lessons learned; regulatory notification timelines may apply.

Operational resilience focuses on important business services, impact tolerances and severe-but-plausible scenarios, not just asset recovery.

Third-party and supply chain risk: vendor due diligence, contractual security requirements, concentration risk and exit planning.

Business continuity requires tested recovery time objectives (RTO) and recovery point objectives (RPO); untested plans are not evidence of resilience.

Delivery models: waterfall (sequential, document-heavy), agile (iterative sprints) and hybrid; regulated change often requires documented evidence at each stage.

Requirements traceability links business requirements to design, test cases and sign-off; gaps are a common audit finding.

Testing layers: unit, system integration, user acceptance (UAT), regression, performance and disaster recovery; parallel runs de-risk core replacements.

Data migration requires profiling, mapping, cleansing, reconciliation and cutover planning; migration defects are a leading cause of post-go-live incidents.

Outsourcing models include application management, business process outsourcing and cloud/SaaS; accountability for regulated activities remains with the firm.

Vendor due diligence covers financial stability, security posture, sub-outsourcing, data residency, service levels and exit/termination assistance.

Service level agreements (SLAs) define measurable performance targets; key performance indicators and service credits support enforcement.

Change governance includes change advisory board review, segregation of development and production duties, and rollback plans for high-risk releases.