Certification CGPC flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

First line owns and manages risk in the business; second line provides independent oversight, policy, and monitoring; third line, internal audit, gives independent assurance to the governing body.

Risk appetite versus tolerance

Risk appetite is the amount and type of risk the organization is willing to pursue to meet objectives; tolerance is the measurable acceptable variation around that appetite.

Segregation of duties

A control principle requiring that no single individual can initiate, authorize, record, and reconcile the same transaction, preventing unrecorded or unauthorized activity.

Tone at the top

Demonstrated senior and board commitment to integrity and control, evidenced by oversight structures, delegation of authority, and consistent consequences rather than statements alone.

Compliance function independence

The compliance head has unrestricted access to the board or a board committee, sets its own agenda, and is not compensated on business revenue targets it monitors.

Obligation inventory

A structured register of each regulatory obligation with issuing authority, clause reference, obligation statement, owner, linked controls, required evidence, and review frequency.

Regulatory change management

A cycle of horizon scanning, impact assessment, gap analysis, implementation, control update, and validation, with documented closure for each change affecting the organization.

Extraterritorial reach

The assertion of jurisdiction over conduct, entities, or data outside a law's home territory; nexus is assessed separately by entity, customer, and data location.

Legal privilege protection

Privilege over compliance reviews depends on jurisdiction and can be lost by wide distribution or mixed business advice; scope and recipients must be controlled from the outset.

Litigation hold

A directive suspending routine record destruction once litigation or investigation is reasonably anticipated; the retention period becomes the longest of statutory, hold, and contractual requirements.

Data controller versus processor

A controller determines purposes and means of processing; a processor acts only on documented controller instructions and carries its own security and breach-notification duties.

Inherent versus residual risk

Inherent risk is assessed before controls are applied; residual risk is assessed after existing controls, and target risk is the level intended after planned treatment.

Risk score formula

Score equals likelihood rating multiplied by impact rating on a defined scale; scale anchors must be documented so different assessors produce comparable ratings.

Risk treatment options

Four options exist: avoid the activity, reduce risk through controls, transfer risk via insurance or contract, or accept risk with documented approval at the proper authority level.

Risk register minimum fields

Risk ID, cause-event-impact description, category, owner, inherent rating, linked controls, residual rating, treatment plan, target date, and current status.

Key risk indicator design

A leading, measurable metric with defined frequency, thresholds, and escalation triggers that signal rising exposure before the risk event materializes.

Risk aggregation

Combining exposures across the organization while accounting for concentration and correlation, since individually acceptable risks can breach appetite through a shared driver.

COSO five components

Control environment, risk assessment, control activities, information and communication, and monitoring activities; the 2013 framework maps seventeen principles to these components.

Key control definition

A control relied upon to reduce a significant risk to an acceptable level; failure of a key control materially threatens the achievement of related objectives.

Test design methods

Inquiry, observation, inspection of evidence, and re-performance; inquiry alone never provides sufficient evidence of operating effectiveness across a period.

Control deficiency severity

Severity is judged by the likelihood and magnitude of consequence, considering compensating controls, and determines whether the deficiency is reported to the governing body.

IT general controls dependency

Reliance on automated controls requires effective ITGCs over change management, access, and operations; without them, automated control testing results are unsupported.

Walkthrough versus operating test

A walkthrough traces one transaction to confirm design understanding and spot gaps; it does not evidence that a control operated effectively throughout the period.

Remediation validation

Re-testing the specific failed control attribute over a sufficient post-fix period, rather than merely confirming that a revised procedure was documented.

Monitoring versus testing

Monitoring is ongoing, embedded, and owned by the business or second line; testing is periodic, independent, and sample-based; both feed one issue management process.

Risk-based monitoring plan

Coverage is allocated by risk rating, prior findings, regulatory change, and time since last review, with documented rationale for areas excluded from the cycle.

Training effectiveness measurement

Effectiveness requires completion plus comprehension assessment plus role-specific application evidence; completion rate alone does not demonstrate that behavior changed.

Third-party due diligence tiers

Relationships are tiered by risk; higher-risk third parties require enhanced diligence, contractual control commitments, ongoing monitoring, and periodic reassessment.

Issue management lifecycle

Identification, logging, risk rating, root cause analysis, action plan with owner and date, tracking, validation of remediation, and formal closure approval.

Conflict of interest handling

Conflicts are managed by disclosure, recusal, or structural control; disclosure alone does not neutralize a conflict that impairs objectivity in a decision.

Insider dealing controls

Identify inside information, restrict access through information barriers, maintain a restricted list, and pre-clear personal account dealings by in-scope personnel.

Conduct risk

The risk that individual or group behavior damages customers, markets, or the firm; it is assessed separately from financial and operational risk.

Incident severity classification

Defined criteria such as regulatory reportability, customer impact, financial loss, data volume, and duration determine escalation path and notification timelines.

Notification clock start

Regulatory notification periods generally begin when the organization becomes aware of an incident, not when the investigation concludes, with updates following.

Root cause analysis

Analysis distinguishing immediate cause, contributing factors, and systemic cause; remediation must address the systemic cause or the incident is likely to recur.

Post-incident review

A structured review after resolution that updates the risk register, control library, monitoring plan, and training so the incident produces durable change.