CLRE key terms

A law that creates an agency and grants it authority to regulate a subject, including powers to issue rules, investigate, and enforce. It sets the outer boundary of lawful agency action.

A process under the Administrative Procedure Act where an agency publishes a proposed rule, accepts public comments, and issues a final rule with a reasoned response to significant comments.

An agency statement explaining how it understands a statute or regulation, without creating new legal obligations. It generally does not require notice-and-comment but receives less deference than a legislative rule.

An official within an agency who presides over adversarial administrative proceedings, takes evidence, and issues an initial decision subject to agency review and later judicial review.

The requirement that a party pursue available agency review or appeal procedures before seeking court intervention. Courts may dismiss claims filed prematurely while agency processes remain unfinished.

The legal principle that federal law displaces conflicting state law, either expressly, by occupying an entire field, or when compliance with both is impossible. It limits state regulation of the same conduct.

A statutory interpretation approach that gives effect to the ordinary meaning of the enacted text unless the result is absurd or ambiguous. Courts look to dictionary definitions and context rather than speculation.

The record of a law's development, including committee reports, floor debates, and drafts. It can clarify ambiguous statutory text but typically cannot override clear language.

A legal provision that shields specified conduct from liability or penalty if prescribed conditions are met. It provides certainty by defining a compliance path instead of relying on general standards.

A canon of construction holding that general words following a list of specific items are limited to things of the same kind. It prevents broad readings that would swallow the specific examples.

A canon meaning that mentioning one thing implies exclusion of others. It is used cautiously because it can produce unintended results when a statute is not exhaustive.

A doctrine allowing a court to strike an invalid portion of a law while preserving the remainder, if the legislature would have enacted the valid parts alone. It limits the impact of partial invalidity.

A governance framework separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line). It clarifies accountability and reduces gaps in risk management.

The signals senior leaders send through words and actions about ethics, compliance, and risk. It shapes whether employees perceive rules as genuine priorities or mere formalities.

A formal document defining a compliance function's mandate, authority, independence, and reporting lines. It establishes the scope of responsibilities and the resources expected to fulfill them.

The set of governance, ethical values, and management practices that set the tone for internal control. It includes integrity, commitment to competence, board oversight, and organizational structure.

An internal control principle assigning conflicting tasks, such as authorization, custody, and recordkeeping, to different people. It reduces the risk of error or fraud going undetected.

A control designed to stop an error, fraud, or policy violation before it happens. Examples include approvals, access restrictions, training, and system edits that block invalid transactions.

A control intended to identify problems after they occur so management can correct them. Examples include reconciliations, exception reports, audits, and monitoring reviews.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It guides decisions about which risks to avoid, mitigate, transfer, or retain.

The level of risk before considering any controls or mitigation. It reflects the nature and context of an activity and helps prioritize where controls are most needed.

The risk remaining after existing controls and mitigation have been applied and assessed. It is compared with risk appetite to decide whether additional action is necessary.

A measure that provides early warning of increasing risk exposure or weakening controls. Effective KRIs are tied to specific risks, have thresholds, and trigger management action.

A procedure to evaluate whether a control is designed appropriately and operates as intended. It may involve inquiry, observation, inspection, or re-performance and supports conclusions about control effectiveness.

A process of tracing a transaction or activity from start to finish to understand the workflow and confirm which controls exist. It is often used to design testing or assess control gaps.

A structured method to determine the underlying reason a problem occurred, not just its symptoms. It helps design remediation that prevents recurrence rather than treating the immediate instance.

A structured inquiry by an organization into alleged misconduct, policy violations, or legal risk. It aims to establish facts, preserve evidence, and support appropriate corrective or disciplinary action.

A notification given by counsel to employees during a corporate investigation explaining that the lawyer represents the company, not the employee, and that conversations may be shared with the company.

A directive to preserve documents and electronically stored information relevant to reasonably anticipated litigation, investigation, or regulatory proceeding. It suspends routine destruction until the matter is resolved.

A documented record of who collected, handled, and transferred evidence, and when. It preserves integrity and helps authenticate evidence in investigations or proceedings.

A company's decision to report its own misconduct to authorities before an investigation is initiated. It may reduce penalties, but eligibility and credit depend on specific program requirements.

A documented set of actions to fix a compliance deficiency, including owners, deadlines, and evidence of completion. It addresses root causes and aims to prevent recurrence.

A legal protection for confidential communications between a lawyer and client made to obtain legal advice. It can be waived by disclosure and does not cover business advice or underlying facts.

A protection for materials a lawyer prepares in anticipation of litigation, including witness interviews and legal analyses. It is broader than privilege but can be overcome by substantial need.

Information that could affect an investor's decision and is not generally available to the market. Trading or tipping on it can violate insider trading laws and firm policies.

A policy listing record types, retention periods, and destruction methods. It ensures legal, regulatory, and operational needs are met while supporting consistent lifecycle management.

Nonpublic information created or obtained by a financial supervisory agency during examination or supervision. Its disclosure is restricted by regulation and typically requires agency approval.

An attitude of questioning and critical assessment of evidence, assumptions, and representations. It helps compliance and audit professionals avoid overreliance on management assertions.

Legal safeguards that prohibit retaliation against individuals who report suspected wrongdoing in good faith. They encourage reporting but may not shield knowingly false or malicious allegations.