Glossary

Occupational health and safety is the field and body of rules that protect the physical and mental wellbeing of people at work by finding hazards, controlling them and preventing injury and illness.

The OECD Anti-Bribery Convention is a 1997 treaty requiring its signatory countries to make bribing foreign public officials in international business a crime and to enforce that law against individuals and companies.

The OECD Guidelines for Multinational Enterprises are government-backed recommendations on responsible business conduct, covering areas such as human rights, labour, environment and bribery, and they include a complaints process through national contact points.

The OECD Principles of Corporate Governance are an international, non-binding benchmark of good practice on shareholder rights, board responsibilities, disclosure and treatment of stakeholders, used by governments to shape their laws and codes.

Off-balance-sheet arrangements are transactions or structures, such as special purpose entities, guarantees or unconsolidated ventures, whose assets, debts or risks do not appear in full on the sponsoring company’s balance sheet.

OFAC is the office of the US Department of the Treasury that administers and enforces American economic and trade sanctions against targeted countries, entities and individuals, and publishes the lists that firms worldwide screen against.

An offshore account is a bank or investment account held in a country other than the one where the account holder lives or is based, often in a place chosen for its tax or privacy rules.

Ongoing monitoring is the continuing work of scrutinising a customer's transactions and keeping their information current, to confirm activity fits what the firm knows and to update the risk assessment when it does not.

Operational resilience is the capacity of an organisation to carry on delivering its important services when disrupted, then recover and learn from the event, whatever caused it.

Operational risk is the chance of loss when a firm's processes, people or systems fail, or when outside events strike. Basel counts legal risk within it but leaves out strategic and reputational risk.

An operational risk event is an incident in which a failure of process, people, systems or external circumstances causes or could have caused a loss. It can produce a financial loss, a near miss or a gain.

Organisational culture is the shared set of values, beliefs, habits and unwritten rules that shape how people in an organisation behave and decide, especially when nobody is checking.

Outsourcing risk is the risk of loss, disruption or regulatory breach that arises when an organisation hands a function or service to an outside provider but stays responsible for the result.

Over-compliance is going further than sanctions law requires, for example by refusing all business linked to a country or blocking permitted payments, because the firm fears penalties more than it values the business.

The ownership and control rule extends sanctions to entities that a listed person owns above a set share, or in some regimes controls, even when the entity itself is not named on any list.