Certification CGPC key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in broad qualitative or quantitative terms and approved at the top of the organization.

The acceptable variation around a specific objective or risk limit, translating broad appetite statements into measurable thresholds that business units and control owners can apply day to day.

The maximum level of risk an organization can absorb before suffering unacceptable harm, typically constrained by capital, liquidity, and operational resilience rather than by preference.

A structured, organization-wide approach to identifying, assessing, treating, and monitoring risks across all functions so that risk decisions align with strategy and appetite.

A governance framework in which operational management owns risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance to the governing body.

The system of rules, practices, and accountability through which a board and executives direct an organization, balancing stakeholder interests and overseeing risk and compliance obligations.

A legal obligation to act in another party's best interest with loyalty and care, commonly owed by directors and officers to the company and its shareholders.

The signals senior leaders send through their words, decisions, and conduct about the importance of ethics and compliance, which strongly shape employee behavior throughout the organization.

A maintained inventory mapping each applicable law, rule, and regulatory requirement to the business processes, controls, and accountable owners responsible for meeting it.

The process for tracking new and amended requirements, assessing their impact on policies and controls, and implementing updates before deadlines take effect.

Due diligence procedures that verify a client's identity, understand the nature of the relationship, and assess money-laundering or other financial crime risk before and during onboarding.

Identification of the natural persons who ultimately own or control a legal entity or arrangement, required to prevent concealment of true ownership in financial and commercial relationships.

A confidential filing made to a financial intelligence unit when an institution detects transactions or behavior that may indicate money laundering, fraud, or other unlawful activity.

A structured review of a proposed processing activity that evaluates privacy risks to individuals and documents safeguards before the activity begins.

Information relating to an identified or identifiable natural person, whose collection, use, and transfer are subject to privacy and data protection law.

A living record of identified risks, each with an owner, likelihood and impact ratings, existing controls, treatment plans, and review dates.

The level of risk that exists before any controls or mitigations are applied, used as a baseline for judging how much protection controls actually provide.

The risk remaining after existing controls are taken into account, which is compared against tolerance to decide whether further treatment is required.

The selection and application of options to modify risk, such as avoiding an activity, reducing likelihood or impact, transferring exposure, or consciously accepting the level.

A visual grid plotting risks by likelihood and impact so that leadership can compare exposures and prioritize where attention and resources should go.

A forward-looking metric that signals whether a risk is increasing or decreasing, giving management early warning before losses or breaches occur.

Any policy, procedure, system, or action designed to prevent, detect, or correct errors and irregularities that could prevent objectives from being achieved.

A safeguard applied before or during a process to stop an error, unauthorized action, or non-compliance event from occurring in the first place.

A mechanism that identifies problems after they have occurred, such as reconciliations, exception reports, or monitoring reviews, enabling timely correction.

Structured examination of whether a control is designed appropriately and operates consistently, using inquiry, observation, inspection, or reperformance of samples.

An assessment of whether a control, as documented, is capable of preventing or detecting the relevant risk when performed as intended.

Evidence that a control actually functioned as designed throughout the review period, tested through samples and examination of exceptions.

The overall conclusion about how well a control mitigates its target risk, combining judgments about design and consistent operation over time.

Splitting incompatible tasks, such as authorization, custody, and recordkeeping, among different people so no single individual can both commit and conceal an error or fraud.

The named individual accountable for a control's design, performance, and evidence, including remediating deficiencies found through testing.

A periodic, risk-based evaluation of where regulatory and conduct failures are most likely and most harmful, used to prioritize monitoring and program resources.

Ongoing surveillance and testing of business activities against policies and requirements, distinct from independent audit, to detect and correct issues promptly.

The integrated set of policies, training, monitoring, reporting, and governance arrangements an organization maintains to prevent and detect violations of law and internal standards.

The shared norms and behaviors that determine whether employees raise concerns, follow rules under pressure, and treat compliance as part of their job.

Reporting suspected wrongdoing through internal or protected external channels, which is effective only when retaliation is prohibited and concerns are investigated.

A situation where personal, financial, or other interests could improperly influence professional judgment, requiring disclosure, recusal, or other mitigation.

Rules setting thresholds, approval requirements, and prohibitions for giving or receiving hospitality so that decisions are not improperly influenced.

The exposure to improper offers, payments, or advantages to obtain business or influence decisions, including through intermediaries and third parties.

Risk-based vetting of vendors, agents, and partners before engagement and during the relationship to confirm integrity and detect ownership or sanctions concerns.

An actual or suspected event that breaches or may breach legal, regulatory, policy, or contractual obligations, triggering notification, containment, and remediation obligations.

A documented set of roles, escalation paths, and steps for detecting, containing, investigating, and recovering from incidents, tested through exercises.

A required report to a supervisor or authority within a defined timeframe after a qualifying event, such as a data breach or control failure.

A structured investigation that moves beyond immediate symptoms to identify the underlying process, design, or cultural failures that allowed an incident to occur.

A time-bound set of actions, owners, and evidence requirements to correct a deficiency and prevent recurrence, tracked to verified completion.

Rules defining how long different categories of records must be kept and how they are stored or destroyed, supporting legal, audit, and regulatory needs.