IFMP Compliance Officer Certification (COC), Pakistan flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Compliance definition

Conforming to applicable laws, regulations, rules, codes and internal standards, evidenced through documented controls and records rather than through stated intent or informal practice.

Compliance risk

The risk of legal or regulatory sanctions, material financial loss or reputational damage arising from an institution's failure to comply with applicable laws, regulations, rules and standards.

Three lines model

A governance structure where business units own and manage risk, compliance and risk functions provide oversight and advice, and internal audit gives independent assurance to the board.

Proportionality principle

The rule that the intensity and sophistication of compliance controls should match the institution's size, complexity, products, customer base and geographic footprint, rather than follow a uniform template.

Record retention obligation

A compliance duty to keep customer due diligence and transaction records for the period set by the applicable regulator, commonly five years after the business relationship ends.

Board compliance responsibilities

The board approves the compliance policy and risk appetite, oversees the programme, and receives periodic reports on breaches, trends and remediation, without performing day-to-day compliance tasks.

Compliance function independence

The compliance function must have no profit-and-loss responsibility for the business it monitors, must not design the products it reviews, and must have direct access to the board.

Segregation of duties

A control principle requiring that the person who approves a transaction or relationship is not the same person who monitors, reconciles or tests it.

First-line compliance duties

Business staff apply policies, complete customer due diligence, identify and escalate red flags, and complete mandatory training, owning the risk their activities create.

Monitoring versus testing

Monitoring is ongoing process-embedded surveillance such as exception reports; testing is periodic independent sample-based review of whether controls are designed and operating effectively.

Key risk indicator

A measurable metric with a defined threshold and escalation trigger, such as overdue CDD percentage or training completion rate, used to signal rising compliance risk.

Findings management

A documented process assigning each finding an owner, action plan, due date and closure evidence, with compliance validating closure before the item is closed.

Compliance risk assessment

A structured exercise rating inherent risk by likelihood and impact, then adjusting for control effectiveness to determine residual risk against the approved risk appetite.

Residual risk formula

Residual risk equals inherent risk adjusted for the effectiveness of existing controls; residual risk above the approved appetite must be escalated and remediated.

Enhanced due diligence

Additional scrutiny applied to politically exposed persons, high-risk jurisdictions, complex ownership structures and unusual transaction patterns, including source of funds verification.

Risk appetite statement

A board-approved statement defining the types and levels of risk the institution is willing to accept, translated into measurable compliance tolerances and limits.

Risk register

A living record of each risk's description, owner, inherent and residual rating, related controls and review date, reviewed at least annually by the risk function.

Cost of non-compliance

Costs including regulatory fines, remediation, legal defence, licence conditions, customer restitution and reputational loss that may exceed the cost of the controls avoided.

Control cost-benefit test

A comparison of expected loss avoided, calculated as probability times impact times risk reduction, against the total cost of owning and operating the control.

De-risking risk

Exiting entire customer segments to avoid compliance cost can create concentration and reputational risk while leaving the underlying control weakness unaddressed.

Regulatory instrument hierarchy

The order of authority running from primary legislation to regulations and rules, then directives and circulars, then guidance that explains regulatory expectations without creating new legal duties.

Policy exception process

A procedure requiring exceptions to be documented, time-bound, risk-assessed and approved at the level stated in policy, never by the requester alone.

Whistleblowing channel requirements

The channel must be independent and confidential, protect the reporter from retaliation, and have its case logs reviewed periodically for trends and unresolved issues.

COSO components

Five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Preventive versus detective controls

Preventive controls stop an error or breach before it occurs, such as dual authorisation; detective controls identify it afterwards, such as reconciliations and exception reports.

Control effectiveness

A control is well designed if it addresses the identified risk and effective if it operates as designed consistently throughout the review period, evidenced by testing.

Internal audit independence

Internal audit reports directly to the audit committee, has unrestricted access to records and people, and holds no operational responsibility for the activities it audits.

Audit finding rating

Findings are graded by impact and likelihood, with high-rated findings escalated promptly to the audit committee and tracked until management action is validated.

Audit report structure

A report stating scope, criteria, condition, cause, effect and recommendation, so each finding is evidenced, actionable and traceable to a management response.

Objectivity principle

A professional obligation to avoid conflicts of interest and refuse gifts or hospitality capable of influencing judgement, supported by disclosure and a gifts register.

Professional scepticism

An attitude of challenging information and assumptions, questioning explanations and seeking corroborating evidence rather than accepting assertions at face value.

Comply-or-explain governance

A regulatory approach permitting departure from a governance code provision only where the company publishes a reasoned explanation for the departure.