Glossary

Identity and access management is the set of processes and tools that establish who a user is, give them the right level of access to systems and data, and review and remove that access over time.

Identity theft is the use of another person's identifying details, such as name, account numbers, documents or login credentials, without consent to commit fraud or obtain money, credit or services.

Illicit financial flows are movements of money across borders that are illegal in their source, in their transfer or in their use, including proceeds of crime, corruption and tax evasion.

The ILO Core Labour Standards are a set of basic workplace rights accepted worldwide: freedom of association, no forced labour, no child labour, no discrimination, and a safe and healthy working environment.

Impact investing puts capital into companies, projects or funds chosen because they are expected to deliver a measurable social or environmental result, while still earning a financial return.

Impact tolerance is the point beyond which disruption to an important business service, usually measured as time offline, would cause unacceptable harm to customers or to the stability of markets.

An important business service is something a firm delivers to people outside it, such as paying out claims, where a lengthy failure would seriously harm customers, markets or the firm's own soundness.

Incident response is the organised process of detecting, assessing, containing and recovering from a security incident or operational disruption, and learning from it afterwards.

The grey list names countries that the FATF is monitoring closely because they have strategic weaknesses in fighting money laundering and terrorist financing, but have promised an action plan to fix them within agreed deadlines.

An indemnity is a promise by one party to compensate another for specified losses or claims, so that the risk moves from the party who would suffer it to the party who agreed to bear it.

An independent director is a board member with no significant ties to the company, its management or its major shareholders that could colour their view, so they can oversee and challenge impartially.

Independent testing is an objective check, carried out by someone outside the team being reviewed, of whether a firm's anti-money laundering and related controls are designed well and work in practice.

Individual accountability is the principle that named people, especially senior managers and directors, answer personally for failures in the areas they run, and can face penalties, bans or prosecution.

An informal value transfer system is any network that moves money or value from one place to another outside regulated banks, usually through trusted brokers and settlement by balancing accounts, goods or services.

Information barriers are controls that stop confidential information passing between parts of a firm, for example from advisory teams to trading desks, to prevent misuse of inside information and manage conflicts of interest.

Information security governance is the system by which a board and senior management direct, oversee and hold accountable the protection of information, usually through a management system such as an ISMS based on ISO/IEC 27001.

An ISMS is an organisation's documented set of policies, processes, roles and controls for managing information security risk in a repeating cycle of planning, operating, checking and improving.

An information security policy is the management-approved document that states how an organisation protects its information and systems, who is responsible, and the rules every employee and supplier must follow.

An information security risk assessment is a structured exercise that identifies what information assets matter, what threats and weaknesses could harm them, and how likely and costly the harm would be.

Clinical informed consent is a person's voluntary, documented agreement to join research or accept treatment, given after being told the purpose, procedures, risks, benefits, alternatives and the right to withdraw.

Inherent risk is the exposure an activity carries by its very nature, judged as if no safeguards were in place. It is the starting point before any control is credited.

An injunction is a court order, often sought by a regulator, that requires a person or firm to stop certain conduct or to take a specified step, with penalties for contempt if it is ignored.

Inside information is precise, non-public information about a company or financial instrument that, if it became known, would be likely to move the price. Using or passing it on can breach market abuse law.

Insider lending abuse is the granting of loans to a bank's directors, managers, major shareholders or their connected parties on favourable terms or without proper assessment, for their benefit.

An insider list is a record, kept by an issuer or its advisers, of the people who have access to inside information, with the time they received it, so that regulators can trace any leak.

An insider threat is the risk that someone with authorised access, such as an employee, contractor or partner, harms the organisation by misusing data, systems or premises, on purpose or by mistake.

Insider trading is buying or selling securities while holding inside information, or passing that information on so that others can trade. In many countries it is a criminal and regulatory offence.

Institutional corruption is corruption built into how an organisation or public body operates, so that improper payments, favours or influence are expected, tolerated or rewarded as a normal way of working.

An institutional review board is an independent panel that reviews research involving people before it starts and while it runs, to protect participants' rights, safety and wellbeing.

Insurance fraud is any dishonest act to obtain an insurance benefit, premium advantage or payment that is not deserved, committed by policyholders, claimants, intermediaries, insiders or organised groups.

The Integrated Reporting Framework is a principles-based approach that helps a company explain in one concise report how its strategy, governance and performance create value over time using several kinds of capital.

Integration is the final stage of money laundering, in which cleaned funds re-enter the legitimate economy as apparently lawful wealth, such as property, business assets, investments or luxury goods.

Integrity is the quality of acting in an honest way and consistently with stated values and rules, including when nobody is watching or when doing otherwise would be easier or more profitable.

Intellectual property risk is the chance of losing value or facing liability through patents, copyrights, trademarks, trade secrets and designs, by infringing others’ rights, failing to protect your own, or having them stolen or leaked.

Interest rate risk in the banking book is the risk to a bank's earnings and economic value from changes in interest rates on the assets and liabilities it holds for the long term, outside its trading book.

An IGA is a treaty-style agreement between the United States and another country that sets how that country's financial institutions apply FATCA, usually by reporting to their own tax authority.

In bribery risk, an intermediary is an outside party, such as an agent, consultant, distributor or broker, that acts for a company in dealing with officials or customers and so can pay bribes on its behalf.

Internal audit is an independent function inside an organisation that examines risk management, controls and governance, and reports to the board on whether they work, with advice on how to improve them.

The internal audit charter is a formal document, approved by the board, that states the purpose, authority, responsibilities and independence of the internal audit function and the reporting lines it works within.

The ICAAP is a bank's own regular process for working out how much capital it needs for the risks it runs, and for planning to hold that capital now and under stress. Supervisors review the result.

An internal carbon price is a cost per tonne of carbon dioxide that a company sets for itself, and applies in its own decisions, to reflect the present or future cost of emissions.

Internal control is everything an organisation does day to day, from approvals to automated checks, to keep its activities on course and its information trustworthy, giving reasonable though never absolute comfort.

ICFR is the set of controls a company runs to give reasonable confidence that its published financial statements are reliable and prepared in line with the accounting rules that apply to it.

Internal fraud is fraud committed by an organisation's own employees, managers or directors, who use their position, access or knowledge to take assets or manipulate records for personal gain.

An internal investigation is an organisation's own structured inquiry into suspected misconduct or a control failure, run to establish the facts, decide what action to take and prepare for any regulator.

The ILAAP is a bank's own regular assessment of whether it holds enough liquidity and stable funding to meet its obligations, in normal conditions and under stress. Supervisors review and challenge it.

The internal ratings-based approach lets approved banks use their own estimates of borrower default and loss to work out the capital they must hold against credit risk, within rules set by the regulator.

International Financial Reporting Standards are accounting standards issued by the International Accounting Standards Board and used by companies in many countries, so that financial statements can be compared across borders.

International Standards on Auditing are the professional standards issued by the IAASB that set out how auditors plan and perform an audit of financial statements and report on the result.

The ISSB is the body within the IFRS Foundation that sets global sustainability disclosure standards, giving investors consistent information about sustainability-related risks and opportunities, including climate, that could affect a company’s prospects.

Investment fraud is deceiving investors with false or misleading claims about an investment, so they hand over money on the basis of promised returns, safety or opportunities that do not exist.

Investor stewardship is the responsible use of an investor's ownership rights, through engagement with companies, voting and monitoring, to protect and grow the long-term value of the money entrusted to it.

ISO 14001 is an international standard that sets requirements for an organisation's environmental management system, which can be assessed and certified by an independent body.

ISO 31000 is an international guidance document that sets out principles, a framework and a process for managing risk in any organisation, of any size or sector. Firms cannot be certified against it.

ISO 37001 is an international standard that sets out requirements for a management system to prevent, detect and respond to bribery, against which an organisation can be independently certified.

ISO 37301 is the international standard for compliance management systems. It sets requirements that any organisation can follow, and can be independently certified against, to manage its compliance obligations.

ISO 45001 is an international standard setting requirements for an occupational health and safety management system, helping organisations prevent work-related injury and ill health. Independent bodies can certify against it.

ISO/IEC 27001 is the international standard that sets requirements for building, running and continually improving an information security management system, against which organisations can be independently certified.

ISO/IEC 42001 is an international standard setting requirements for an AI management system, the policies, roles and processes an organisation uses to govern its AI responsibly. Organisations can be certified against it.

An issuer is a company, government or other body that creates and sells securities such as shares or bonds to raise money, and takes on legal duties towards the investors who buy them.

An IT audit is an independent review of an entity's information systems, infrastructure and related processes, to judge whether technology risks are controlled and systems support accurate, secure and reliable operations.

IT change management is the controlled process for requesting, assessing, approving, testing, scheduling and recording changes to systems, so that updates do not cause outages, security gaps or unauthorised alterations.

IT general controls are the basic controls over the technology environment, covering access, change, operations and development, that make applications and the reports they produce dependable.

IT governance is the structure of decision rights, policies and oversight through which leaders direct technology so that it supports business strategy, delivers value, and keeps its risks within acceptable limits.