IIBF Certified Information System Banker flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Core Banking Solution

Centralised system holding customer information file, deposits, loans and general ledger, shared across all branches, with channels connecting as front-end interfaces rather than local data stores.

Straight-Through Processing rate

Percentage of transactions completed end-to-end without manual intervention, calculated as transactions processed untouched divided by total transactions, multiplied by one hundred.

End-of-Day batch

Scheduled nightly process that posts interest accrual, general ledger entries and regulatory reports, closes the business date and must complete before beginning-of-day opens the next date.

Data centre tiers

Uptime Institute classification from Tier I to Tier IV, where Tier III is concurrently maintainable and Tier IV fault tolerant, guiding redundancy design and disaster recovery placement.

CIA triad

Confidentiality protects data from disclosure, integrity ensures data is accurate and unaltered, availability ensures timely access; every control maps to at least one of these three properties.

Defence in depth

Layering independent controls across perimeter, network, host, application and data so that failure of one control does not expose the asset, including segmentation and monitoring.

Maker-checker principle

Control requiring one user to initiate a transaction and a different authorised user to approve it, preventing unilateral action and enforcing segregation of duties in banking systems.

Incident response lifecycle

Six phases: preparation, identification, containment, eradication, recovery and lessons learned, with regulatory notification triggered when severity crosses defined thresholds within mandated timelines.

COBIT 2019

ISACA governance framework defining governance and management objectives across EDM, APO, BAI, DSS and MEA domains, used to tailor an enterprise governance system for information and technology.

Three lines model

First line owns and manages risk in operations, second line provides risk and compliance oversight, third line internal audit gives independent assurance to the Board and audit committee.

IT risk appetite

Board-approved statement of how much IT and cyber risk the bank accepts, expressed in measurable thresholds such as maximum downtime hours or maximum loss per incident.

IT steering committee

Management committee that prioritises IT projects, allocates resources, monitors delivery against plan and escalates strategic IT issues to the Board IT committee.

Audit risk model

Audit risk equals inherent risk multiplied by control risk multiplied by detection risk; the auditor lowers detection risk by expanding substantive testing and data analytics coverage.

IT general controls

Controls over access to programs and data, program changes, program development and computer operations that underpin reliable functioning of all application controls across the organisation.

Computer-assisted audit techniques

Tools such as SQL scripts, ACL and analytics that test full transaction populations rather than samples, improving coverage and enabling continuous auditing of banking systems.

Audit finding closure tracking

Register recording each finding with risk rating, accountable owner and due date, reviewed periodically, with overdue high-risk items escalated to the audit committee of the Board.

Recovery time objective

Maximum acceptable duration to restore a business function or system after disruption; it drives disaster recovery architecture choice, from cold standby to active-active configuration.

Recovery point objective

Maximum acceptable data loss measured in time before disruption; it determines replication frequency, from nightly backup to synchronous mirroring for near-zero data loss.

Business impact analysis

Study identifying critical business functions, their dependencies, maximum tolerable downtime and recovery priorities, forming the evidence base for continuity strategy and plan design.

Backup 3-2-1 rule

Keep three copies of data, on two different media types, with one copy stored off-site; backups must be encrypted and restore-tested periodically to prove recoverability.

Incident versus problem

An incident is an unplanned service interruption restored through a workaround; a problem is the underlying root cause investigated through root cause analysis and eliminated permanently.

Service level agreement

Contract with the customer defining measurable service targets, measurement windows, reporting obligations and remedies such as service credits when targets are missed.

Availability percentage formula

Agreed service time minus downtime, divided by agreed service time, multiplied by one hundred, measured over a defined window and reported against the service level target.

Vendor risk lifecycle

Due diligence, risk rating, contract negotiation with audit and security clauses, onboarding, ongoing monitoring, periodic independent review and documented exit strategy.

Outsourcing concentration risk

Over-reliance on one vendor, technology or geography that could disrupt multiple services simultaneously; tracked in the outsourcing register and reported to the Board.

KYC and re-KYC

Customer due diligence at onboarding using identity and address verification, repeated periodically at intervals set by the customer's risk category, with enhanced checks for high-risk customers.

Multi-factor authentication

Authentication combining at least two independent factors from knowledge, possession and inherence, mandatory for internet banking login, high-value transactions and privileged administrative access.

API gateway security

Controls at the interface between external consumers and core systems: OAuth token validation, mutual TLS, rate limiting, schema validation, logging and throttling of anomalous traffic.

SWIFT messaging network

Cross-border cooperative messaging service carrying payment instructions between financial institutions; it transmits messages but does not itself settle funds between parties.

Real Time Gross Settlement

High-value payment system settling each transaction individually and irrevocably in central bank money in real time, used for interbank and large corporate transfers.

Card tokenisation

Replacing the primary account number with a surrogate token valid only for a defined domain, reducing exposure of card data in merchants and mobile wallets.

Permissioned distributed ledger

Blockchain restricted to identified, authorised participants with consensus such as PBFT, preferred by banking consortia over public proof-of-work networks for privacy and throughput.