Glossary

Risk, compliance and governance terms, explained.

Plain-language definitions of the terms that shape model risk management, internal control and governance in banking.

A

Audit trail: An audit trail is a chronological, tamper-evident record of who did what, when and why in a system or process, so that a knowledgeable third party can reconstruct decisions.

Compliance by design: Compliance by design means building regulatory and policy requirements into products, processes and systems when they are designed or changed, rather than checking afterwards.
Control testing: Control testing is the evidence-based check of whether a control is designed to address its risk and whether it actually operated as intended during a period.
Critical functions: Critical functions are the activities, processes and services, with their underlying resources, whose disruption would threaten a bank’s continuation or its role in the financial market.

Governance body: A governance body is a board, committee or other formally mandated forum that takes or oversees decisions within defined competences, membership and reporting lines.

Internal control system ICS: The internal control system (ICS) is the totality of control structures and processes that, at all levels of a bank, support achieving business objectives and orderly operations.

Model inventory: A model inventory is the complete, firm-wide register of all models in use, in development or retired, with their purpose, owner, tier, validation status and limitations.
Model risk management MRM: Model risk management is the framework a bank uses to identify, govern, validate and monitor its models so that decisions based on model outputs remain sound.
Model tiering: Model tiering assigns each model a risk rating based on its materiality and complexity, which then sets the depth and frequency of validation and other controls.
Model validation: Model validation is the independent assessment of whether a model is conceptually sound, correctly implemented and performing as intended for its specific use.

Operational resilience: Operational resilience is a bank’s ability to restore its critical functions within defined tolerances for disruption when severe but plausible events occur.

Policy attestation: Policy attestation is the documented confirmation by employees that they have received, read and understood a policy that applies to them, tracked per campaign and deadline.
Policy framework: A policy framework is the governed hierarchy of a bank’s internal rules, from board-level policies to procedures, with owners, approval levels, versions and review cycles.

RACI matrix: A RACI matrix records for each task or decision who is Responsible for doing it, who is Accountable, who must be Consulted and who must be Informed.
Regulatory change management: Regulatory change management identifies new or changed regulation, assesses its impact on the bank and tracks implementation in policies, processes and controls.
Risk appetite: Risk appetite is the aggregate level and types of risk a bank is willing to take within its risk capacity to achieve its strategic objectives.

Three Lines Model: The Three Lines Model distinguishes the roles of management (first line), specialised risk and compliance functions (second line) and internal audit (third line) under board oversight.

Written rules (schriftlich fixierte Ordnung): Written rules are the documented organisational rules on which MaRisk requires a German institution to base all its business, known in practice as the schriftlich fixierte Ordnung.

What each regulation requires, what it means for the board and executive management, and where to find the official text.

30 minutes. Your use case, maximum impact.