Glossary

Sanctions are legal restrictions imposed by governments or international bodies on countries, sectors, organisations or individuals, to pursue foreign policy or security aims by limiting their access to funds, trade or travel.

A sanctions compliance officer is the senior person who owns a firm’s sanctions controls: setting policy, advising the business, deciding on escalated cases and acting as the contact for regulators.

Scenario analysis studies what could happen to an organisation under a specific set of plausible events, to measure the damage and test whether its plans and resources are enough.

Scope 1 emissions are greenhouse gases released directly from sources that an organisation owns or controls, such as boilers, furnaces, company vehicles and process leaks.

A security operations centre is a team, often with dedicated tools and premises, that monitors an organisation's systems around the clock, detects security events and starts the response.

Segregation of duties is the control principle of splitting the steps of a process among different people, so that no single person can both carry out and conceal an error or fraud.

Self-certification is a signed statement by an account holder, given to a financial institution, declaring where they are tax resident and giving their tax identification number for CRS and FATCA reporting.

Sensitivity analysis tests how much a result changes when one input or assumption is varied, showing which inputs matter most to the outcome.

Shadow IT is the use of apps, cloud services, devices or software by employees or teams without the knowledge or approval of the organisation's IT and security functions.

The shared responsibility model divides security and compliance duties between a cloud provider and its customer, with the split depending on the service type, so that each knows what it must secure.

A single point of failure is any one component, person, supplier or process whose breakdown would stop an entire service or system because no backup or alternative route exists.

Social engineering is the manipulation of people, through deception, pressure or trust, into handing over information, access or money that they would not otherwise give to an attacker.

Social washing is when a company overstates or misrepresents its record on social matters, such as diversity, fair pay, workers’ rights or community benefit, to look more responsible than the evidence supports.

Source of funds is the origin of the specific money used in a transaction or placed into an account, such as a salary payment, a property sale or an inheritance, and the evidence that supports it.

Source of wealth is how a customer accumulated their overall assets over time, for example through employment, a business, investments, inheritance or property, and the evidence that the story is credible.

Stranded assets are assets that lose value early, or become unusable, because of changes such as climate policy, new technology or shifting demand, leaving owners and lenders with write-downs.

Strategic risk is the risk that an organisation fails to meet its goals because of poor strategic choices, weak execution of its plan, or a failure to adapt to changes in its market or environment.

Stress testing measures how an organisation, portfolio or system would cope under severe but plausible shocks, such as a deep recession or a market crash, to see whether it stays sound.

Succession planning is the process by which a board prepares for planned and sudden changes in its top leadership, by identifying and developing candidates and having an emergency plan for abrupt departures.

A supplier code of conduct is a document that sets out the ethical, labour, environmental and legal standards a buyer expects its suppliers to meet as a condition of doing business.

Supply chain risk is the chance that disruption, failure or misconduct at any point in the network that makes and delivers goods and services interrupts supply, raises cost or harms the buyer's reputation.

SupTech is the use of technology by financial and other supervisors to collect, process and analyse data, so they can monitor firms and markets faster and more accurately than manual review allows.

Sustainability governance is the set of structures, roles and decision rights through which a board and management oversee sustainability risks, targets and reporting, and are held accountable for them.

Sustainability reporting is the practice of disclosing an organisation’s environmental, social and governance performance, risks and impacts to stakeholders, increasingly following common standards and subject to assurance.

The SDGs are seventeen goals adopted by all UN member states in 2015, setting shared targets to 2030 on poverty, health, equality, climate and other global problems, which companies and governments use as a common reference.

The Swiss cheese model explains accidents by treating every safeguard as having weak spots. Harm follows only when the weak spots in several safeguards happen to coincide.