ICSAN Admin Risk flashcards
ICSAN Admin Risk · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Risk appetite
- The amount and type of risk an organisation is willing to pursue or retain in order to achieve its objectives, approved by the board and expressed in qualitative and quantitative terms.
- Three lines model
- A governance structure where management owns risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance to the governing body.
- Residual risk
- The level of risk remaining after existing controls and mitigations have been applied. It is compared against risk appetite and target risk to decide whether further treatment is needed.
- Risk owner
- The accountable individual, usually a senior manager, responsible for managing a specific risk, implementing its treatment plan, and reporting its status to the risk committee.
- Risk register
- A structured record listing each identified risk with its cause, consequence, owner, inherent and residual ratings, controls, treatment actions, due dates and current status.
- Likelihood-impact matrix
- A tool that plots risks on two axes, likelihood and impact, each scored on a defined scale, producing a heat map that ranks risks as low, medium, high or extreme.
- Inherent risk
- The level of risk assessed before considering the effect of any existing controls. It shows the gross exposure and highlights where controls are most needed.
- PESTLE analysis
- A structured technique for identifying external risk drivers across political, economic, social, technological, legal and environmental factors that may affect organisational objectives.
- Segregation of duties
- A preventive control that separates incompatible functions such as authorisation, custody of assets, recording and reconciliation, so that no one person can complete a transaction end to end.
- Control environment
- The tone at the top of an organisation: its ethics, governance structure, assignment of authority, human resource policies and management commitment to competence and integrity.
- Preventive control
- A control designed to stop an error or fraud from occurring in the first place, such as approval limits, access restrictions, segregation of duties or mandatory data validation.
- Key control
- A control whose failure would materially increase the risk it addresses. Key controls are prioritised for testing and monitoring because they are critical to achieving objectives.
- Key risk indicator
- A leading metric with defined thresholds that provides early warning that a risk is increasing, enabling management to act before losses or incidents occur.
- Four-eyes principle
- A control requiring a second authorised person to review and approve a transaction or decision before it is finalised, reducing error and fraud risk in administrative processes.
- Maker-checker workflow
- An automated control that separates the person who enters or initiates a transaction from the person who reviews and approves it, typically used in payments and master data changes.
- Loss data
- Records of actual and near-miss operational risk events capturing frequency, severity, root cause and recovery, used for trend analysis, quantification and control improvement.
- Compliance universe
- A catalogue of all applicable laws, regulations, codes and standards, each mapped to an owner, relevant control, monitoring activity and evidence of compliance.
- Compliance risk
- The risk of legal or regulatory sanctions, financial loss or reputational damage arising from an organisation's failure to comply with applicable laws, regulations and standards.
- Regulatory horizon scanning
- A process for monitoring emerging and changing regulations, assessing their impact on the organisation, and updating policies and controls before they take effect.
- Fraud triangle
- A model explaining fraud as the combination of pressure or incentive, opportunity and rationalisation. Controls primarily reduce opportunity by strengthening processes and oversight.
- Fictitious vendor fraud
- A scheme where an employee creates a fake supplier in the vendor master file and approves payments to it. Controls include vendor master change approval and independent reconciliation.
- Mandatory leave
- A control requiring staff in sensitive roles to take periodic leave so that any concealment of fraud requiring continuous control of records is disrupted and detected.
- Whistleblowing hotline
- An independent, confidential channel allowing employees and third parties to report suspected wrongdoing without fear of retaliation. It is a leading source of fraud detection.
- Business impact analysis
- A process identifying critical business processes, their dependencies and the maximum tolerable period of disruption, which sets recovery priorities and objectives.
- Recovery time objective
- The target time within which a business process or system must be restored after a disruption. It must be shorter than or equal to the maximum tolerable period of disruption.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time, determining the required backup frequency and replication strategy for a critical system.
- Tabletop exercise
- A discussion-based continuity exercise where participants walk through a simulated disruption scenario to test plans, decision-making, roles and communications without actually activating systems.
- Risk dashboard
- A concise periodic report showing top risks, movement since the last period, key risk indicator status, incidents, overdue actions and control test results for management and board oversight.
- Assurance mapping
- A technique overlaying all sources of assurance, such as management testing, compliance monitoring, internal audit and external audit, against key risks to identify gaps and duplication.
- Internal audit independence
- The principle that internal audit reports to the audit committee, has no operational responsibility for audited areas, and is free from management influence over its scope and findings.
- Conflict of interest
- A situation where a person's private interests could improperly influence their professional decisions. It must be declared and the person excluded from the relevant decision.
- Tone at the top
- The ethical culture set by senior leadership and the board through their behaviour, policies and communications, which shapes whether controls and conduct standards are respected throughout the organisation.