Certification CGPC cheat sheet

Three lines model: first line owns and manages risk in operations; second line provides independent oversight, policy, and monitoring; third line (internal audit) reports to the governing body and gives independent assurance.

GRC integration means a single risk taxonomy, one control library, and one reporting cadence shared by governance, risk, and compliance functions, so a control maps to multiple obligations without duplicate testing.

Risk appetite is the amount and type of risk the organization is willing to pursue; risk tolerance is the acceptable variation around that appetite expressed as measurable limits.

Tone at the top is evidenced by board-level risk oversight, documented delegation of authority, and consequences applied consistently at senior levels, not by statements alone.

Segregation of duties requires that no single person can initiate, authorize, record, and reconcile the same transaction; compensating controls apply where headcount prevents full separation.

Governance structure artifact set: board charter, committee terms of reference, risk committee mandate, delegation-of-authority matrix, and escalation thresholds.

Compliance function independence is preserved when the head of compliance has unfettered access to the board or a board committee and is not compensated on business revenue targets.

Risk culture indicators include near-miss reporting rates, speak-up volume, overdue remediation counts, and the ratio of self-identified to externally identified issues.

Obligation inventory fields: regulation name, issuing authority, clause reference, obligation statement, owner, affected processes, control linkage, evidence required, review frequency, and change trigger.

Regulatory change management cycle: horizon scanning, impact assessment, gap analysis, implementation plan, control update, validation, and documented closure.

Extraterritorial reach applies where a law asserts jurisdiction over conduct, entities, or data outside its home territory; assess nexus by entity location, customer location, and data location separately.

Legal privilege over compliance reviews is jurisdiction-dependent and can be lost through wide distribution or inclusion of business advice; scope and distribution must be controlled from the outset.

Records retention: the applicable period is the longest of statutory requirement, litigation hold, and contractual obligation; a litigation hold suspends routine destruction immediately on reasonable anticipation of dispute.

Data protection obligations typically separate controller and processor duties; a processor acts only on documented instructions and bears its own security and breach-notification duties.

Cross-border data transfer requires a lawful transfer mechanism plus a transfer impact assessment where the destination regime offers different protections.

Regulatory examination readiness requires a maintained evidence pack: policies, control descriptions, testing results, issue logs, and remediation evidence current as of the examination date.

Inherent risk is assessed before controls; residual risk is assessed after controls; target risk is the level the organization intends to reach after planned treatment.

Risk score formula in common use: score = likelihood rating x impact rating on a defined scale; document the scale anchors so ratings are reproducible across assessors.

Four treatment options: avoid (exit the activity), reduce (add or strengthen controls), transfer (insurance, outsourcing, contractual allocation), accept (documented with authority at the right level).

Risk register minimum fields: risk ID, description in cause-event-impact form, category, owner, inherent rating, controls, residual rating, treatment plan, target date, status.

Control risk and detection risk drive audit sampling: higher assessed risk requires larger samples or more persuasive evidence; sampling risk is the risk conclusions differ from testing the whole population.

Key risk indicators should be leading, measurable at a defined frequency, and paired with thresholds that trigger escalation before the risk materializes.

Risk aggregation must consider concentration and correlation; individually acceptable exposures can breach appetite when they share a common driver.

Emerging risk identification sources include regulatory consultations, industry loss data, third-party and supplier notifications, and internal near-miss trends.

COSO components: control environment, risk assessment, control activities, information and communication, monitoring activities; the 2013 framework adds 17 principles mapped to these components.

Control types: preventive versus detective; manual versus automated; key versus non-key. Key controls are those relied upon to reduce a significant risk to an acceptable level.

Test design options: inquiry, observation, inspection of evidence, and re-performance. Inquiry alone is never sufficient evidence for operating effectiveness.

Operating effectiveness testing requires a defined population, a sampling approach with documented rationale, and evaluation of deviations against a tolerable rate.

A control deficiency exists when design or operation does not allow management to prevent or detect misstatement or non-compliance timely; severity is judged by likelihood and magnitude of consequence.

Automated control testing depends on IT general controls over change management, access, and operations; without effective ITGCs, automated control reliance is unsupported.

Walkthrough confirms design understanding and identifies control gaps; it does not by itself evidence operating effectiveness across a period.

Remediation validation requires re-testing the specific failed attribute over a sufficient post-fix period, not merely confirming that a new procedure was written.

Program elements commonly assessed: governance and senior commitment, policies and procedures, training, risk assessment, monitoring and testing, third-party due diligence, whistleblowing, investigation, discipline, and continuous improvement.

Monitoring is ongoing, embedded, and owned by the business or second line; testing is periodic, independent, and sample-based; both feed the same issue management process.

Training effectiveness is measured by completion plus comprehension assessment plus role-specific application, not completion rate alone.

Risk-based monitoring plan allocates coverage by risk rating, prior findings, regulatory change, and time since last review; document the rationale for excluded areas.

Third-party due diligence is tiered by risk: higher-risk relationships require enhanced diligence, contractual control commitments, and periodic reassessment.

Metrics should be defined with numerator, denominator, data source, frequency, owner, and threshold; undefined metrics produce unverifiable reporting.

Issue management lifecycle: identification, logging, risk rating, root cause analysis, action plan with owner and date, tracking, validation, and closure approval.

Program effectiveness review should include independent assessment at a defined cycle and after significant regulatory or structural change.

Conflicts of interest are managed by disclose, recuse, or control; disclosure alone does not neutralize a conflict that impairs objectivity.

Gifts and hospitality thresholds are set by value, frequency, and counterparty type; anything above threshold requires pre-approval and recording in a register.

Insider dealing controls rest on identifying inside information, restricting access via information barriers, maintaining a restricted list, and pre-clearing personal account dealings.

Speak-up channels must offer confidentiality and, where permitted, anonymity, plus a documented non-retaliation commitment and a route that bypasses the line manager.

Professional standards for compliance practitioners include integrity, objectivity, confidentiality, competence, and due care; objectivity is compromised when the practitioner owns the business decision being reviewed.

Conduct risk is the risk that behavior of individuals or groups damages customers, markets, or the firm; it is assessed separately from financial and operational risk.

Investigation standards: independence of the investigator, documented scope, evidence chain of custody, consistent interview practice, and findings tested against policy and law.

Sanctions and discipline should be proportionate, consistent, and recorded; inconsistent outcomes are themselves a conduct and culture indicator.

Incident lifecycle: detection, classification and severity assignment, containment, investigation, notification, remediation, and post-incident review with lessons learned.

Severity classification uses defined criteria such as regulatory reportability, customer impact, financial loss, data volume, and duration; classification drives escalation path and timelines.

Regulatory notification clocks start from awareness, not from full investigation; obligations typically require initial notification within a fixed period followed by updates.

Breach notification to affected individuals generally requires assessing risk of harm and is separate from, and additional to, notification to the regulator.

Evidence preservation must begin at detection: logs, system images, communications, and access records retained under legal hold before routine deletion cycles remove them.

Root cause analysis distinguishes immediate cause, contributing factors, and systemic cause; remediation addresses the systemic cause or the incident recurs.

Remediation tracking requires owner, action, due date, dependency, and validation evidence; overdue high-severity actions escalate to the governing body.

Post-incident review should update the risk register, control library, monitoring plan, and training content so the incident produces durable change.