Glossary

A carbon footprint is the total greenhouse gas emissions caused by a person, organisation, event or product, usually stated in tonnes of carbon dioxide equivalent over a set period.

Carbon pricing puts a cost on greenhouse gas emissions, through a tax or a tradable permit scheme, so that polluters bear the damage they cause and have a reason to cut it.

Card-not-present fraud is the use of stolen card details to buy goods or services where the card is not physically shown, such as online, by phone or by mail order.

Catastrophic risk is the chance of an event so severe that it causes losses far beyond normal experience and threatens the survival of an organisation, a market or a community.

Chain of custody is the documented trail showing who collected, held, moved and examined a piece of evidence, so that it can be shown to be unaltered and authentic.

The chair of the board leads the board, sets its agenda, runs its meetings and makes sure directors get the information and time they need to decide well. The role is separate from running the business.

Cheque fraud is the use of forged, altered, stolen or counterfeit cheques to obtain money or goods dishonestly, including paying in a cheque that the payer will not honour.

The CISO is the senior executive accountable for an organisation's information security strategy, policies and programme, who reports on cyber risk to executives and the board.

Climate adaptation means adjusting people, assets and systems to cope with climate impacts that are already happening or expected, so that harm is reduced and opportunities are taken.

Climate mitigation means cutting greenhouse gas emissions or removing them from the atmosphere, so that global warming is slowed and limited.

Cloud governance is the set of policies, roles and checks that decide who may buy and use cloud services, how data and costs are controlled, and how security and legal duties are met.

A code of conduct is a written set of rules telling staff and others who work for an organisation what behaviour is expected and prohibited, and what follows if the rules are broken.

A code of ethics is a document stating the values and principles an organisation or profession commits to, such as honesty, fairness and respect, to guide decisions where no specific rule applies.

Combating the financing of terrorism covers the laws and controls that prevent funds being raised, moved or used to support terrorists, terrorist acts or terrorist organisations, whether the money is legal or criminal in origin.

Complaints handling is the process by which an organisation receives, records, investigates and resolves expressions of dissatisfaction from customers, and uses the findings to correct underlying problems.

Compliance means meeting the laws, regulations, standards and internal policies that apply to an organisation. It also names the function that advises on these duties and checks they are being met.

A compliance attestation is a signed statement, usually made each year by staff or managers, confirming that they have read and followed company policies and have reported any breaches or conflicts they know of.

A compliance breach is any failure to follow a law, regulation, licence condition or internal policy, whether deliberate or accidental and whether or not anyone has yet been harmed.

Compliance by design is the practice of building legal and regulatory requirements into products, systems and processes from the start, so the compliant route is the normal one, not a later fix.

Compliance culture is the set of shared attitudes and habits that decide whether people in an organisation follow rules and raise concerns when nobody is checking, rather than looking for ways around them.

Compliance monitoring and testing are the routine checks and sample-based tests, run by the compliance function, that show whether rules and controls are being followed and working as intended.

A compliance officer is a professional who helps an organisation follow laws, regulations and internal policies by advising staff, monitoring activity, running training and handling breaches and regulator contact.

A compliance risk assessment is a structured exercise that identifies the obligations an organisation faces, estimates the likelihood and impact of breaching each, and judges how well existing controls reduce that exposure.

Compliance training and awareness cover the courses, briefings and reminders that teach staff which rules apply to their work, how to apply them and how to report concerns.

Country-wide sanctions are broad restrictions on nearly all dealings with an entire country, territory or regime, rather than with named people or companies.

Concentration risk is the chance of heavy loss because exposure is bunched in one borrower, sector, region, product, funding source or supplier, so one adverse event hits a large share of the business.

A conflict of interest arises when someone's personal interests, relationships or duties to another party could affect, or appear to affect, how they carry out their duties for their organisation or client.

Contagion risk is the risk that distress at one firm, market or country spreads to others through links such as shared exposures, funding ties, confidence or common assets.

A contingency funding plan sets out how a financial institution would raise cash and manage outflows during a liquidity stress, naming the triggers, the funding sources, the actions and who decides.

Continuous monitoring is the regular, often automated, checking of risks and controls through the year, so problems show up soon after they arise instead of at a yearly review or audit.

Contractual compliance obligations are the duties an organisation has promised to meet in its contracts, such as loan covenants, service levels and reporting deadlines, together with the work of tracking that they are met.

Control effectiveness testing is the evaluation of whether a control is well designed and operates as intended over a period, using evidence such as samples, re-performance and system checks.

A corporate governance code is a set of recommended board and company practices, issued by a regulator, exchange or professional body, usually applied on a comply or explain basis.

Country risk is the chance of loss from political, economic or legal conditions in a country, such as default by its government, currency controls, nationalisation or unrest, which can stop borrowers from paying.

A credit rating is an opinion, usually expressed as a letter grade, on how likely a borrower or a bond is to pay interest and principal as promised.

Credit risk is the risk of loss because a borrower or counterparty does not pay what it owes, or pays late, or because its ability to pay worsens.

Cryptocurrency fraud is any deception that takes money or digital assets from victims through crypto, including fake token sales, giveaway scams, bogus mining services and fake investment platforms that use AI-generated content.

Customer detriment is the financial loss or other harm a customer suffers because a firm sold them the wrong product, charged unfairly, gave poor service or otherwise failed to treat them properly.

Customer redress is the remedy a firm gives to customers it has wronged, usually refunds with interest, compensation or correction of the product, often together with an apology or explanation.

Customs compliance is a business's practice of meeting the rules that apply when goods cross borders, including correct declarations, product classification, valuation, origin claims, duty payment and record keeping.

A cyber incident response plan is a documented set of roles, steps and contacts that tells an organisation how to detect, contain, remove and recover from a cyber incident.

Cyber supply chain risk management is the practice of identifying and reducing the security risks that come from suppliers, software components, hardware and service providers an organisation depends on.

Cyber-enabled fraud is fraud carried out through computers, phones or online channels, where technology helps the offender deceive victims or reach accounts that would be harder to attack in person.

Cybersecurity risk is the potential for loss from attacks on, or failures of, information systems, including damage to data, operations, finances and reputation.