III IC-28 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance structure where operational management owns and manages risk, an independent risk or compliance function monitors it, and internal audit provides independent assurance to the governing body.

Compliance program charter

A governing document naming the program owner, reporting line, scope, review cadence, and escalation path; it must be approved, dated, and version-controlled.

Segregation of duties

A preventive control separating the authority to perform, approve, and record a transaction so that no single person can complete a process without independent review.

Materiality threshold

A pre-defined quantitative or qualitative limit above which a finding must be escalated; it is documented before fieldwork so escalation decisions are not made after the fact.

Legal hold

A directive suspending routine destruction of records once litigation, investigation, or a regulatory request is reasonably anticipated, overriding the normal retention schedule.

Corrective action plan elements

A CAP states root cause, the specific remediation action, a named responsible owner, a due date, and the objective evidence that will be used to close the finding.

Risk appetite statement

A governing body document defining how much risk the organization accepts and which authority level may accept residual risk when remediation is declined.

Records retention schedule

A documented list mapping record categories to minimum retention periods and destruction methods, applied consistently and suspended by any active legal hold.

Risk-based sampling

Selecting sample items after stratifying the population by risk attribute, with the population definition, method, and sample size rationale documented before testing begins.

Four elements of a finding

Condition (what was observed), criterion (what was required), cause (why the gap occurred), and effect (the risk or consequence) together constitute a complete audit finding.

Sufficient appropriate evidence

Enough evidence in quantity (sufficiency) and evidence that is relevant and reliable in quality (appropriateness); both are needed before a conclusion is issued.

Evidence reliability hierarchy

Original records and direct observation are most reliable; system-generated summaries are intermediate; interviews and management representations are least reliable and require corroboration.

Chain of custody

A documented record of who collected evidence, when, from where, its unique identifier or hash, and every subsequent transfer or access event.

Working paper reperformance standard

Working papers must let an experienced reviewer who did not perform the work reperform the steps and independently reach the same conclusion.

Opening and closing meetings

The opening meeting confirms scope, criteria, and logistics; the closing meeting presents preliminary findings and exceptions so management can respond before the draft report.

Exception versus finding

An exception is a single tested item that failed an attribute; a finding results only after evaluating whether the failure is isolated or evidence of systemic control failure.

Inherent versus residual risk

Inherent risk is assessed before controls are applied; residual risk is assessed after controls; the difference represents risk reduction attributable to the control environment.

Preventive detective corrective controls

Preventive controls stop an event before it occurs, detective controls identify it afterward, and corrective controls remediate the effect once detected.

Key control definition

A control whose failure would materially increase residual risk; key controls are tested each period while non-key controls may be tested on rotation.

Control gap types

A gap arises when a risk has no control at all, when the control is designed inadequately to address the risk, or when it is designed well but not operated consistently.

Design versus operating effectiveness

Design effectiveness asks whether the control would meet its objective if performed as described; operating effectiveness asks whether it was actually performed consistently over the period.

Risk rating calculation

Likelihood multiplied by impact, each commonly scored one to five, yields a one-to-twenty-five score mapped to defined low, medium, high, and critical bands.

Compensating control criteria

A compensating control must address the same risk as the missing primary control and be independently testable; undocumented or untested compensating controls do not reduce assessed risk.

COSO control components

Control environment, risk assessment, control activities, information and communication, and monitoring activities form the five components of the internal control framework.

Directive controls limitation

Directive controls such as policies and training guide behavior but do not by themselves provide assurance; they require detective or monitoring controls to confirm compliance.

Control matrix

A document mapping each identified risk to its controls, control type, owner, frequency, evidence source, and whether the control is classified as key.

Report rating definitions

Rating scales such as critical, high, medium, and low must be defined in advance, including escalation timeframes and the authority each rating reaches.

Finding closure validation

A finding closes only when the compliance or audit function validates objective evidence; management assertion alone is insufficient and the finding owner cannot self-validate.

Repeat finding significance

A finding recurring across periods indicates ineffective root-cause analysis or failed remediation design, not an isolated lapse, and warrants escalation to the governing body.

Inspector independence impairment

An inspector who previously managed or was accountable for the area under review has a self-review threat and must be recused or the impairment disclosed and mitigated.

Confidentiality obligation

Information obtained during an inspection is used only for the stated purpose and disclosed only through authorized channels or under legal compulsion.

Program health metrics

Finding closure rate within due date, repeat finding rate, average days to remediate, and percentage of key controls tested in the period indicate compliance program health.