Plain definitions for finance integrity terms
Terms from controls, fraud, governance, grants, reporting and AI, each defined in two or three plain sentences.
- Agentic AI
AI systems that take actions toward a goal, such as coding invoices, sending emails or posting entries, rather than only producing text for a person to use. In a finance process an agent is a user: it needs its own credentials, limited permissions, segregation of duties and a log of everything it did.
- AI governance
The policies, roles and controls that decide which AI tools an organization uses, for what, and under whose oversight. In finance it includes an inventory of tools and agents, amounts above which a person must approve, activity logs, and due diligence on vendors and models.
- Beneficial owner
The individual who ultimately owns or controls a company, as opposed to the entity named on paper. Under the bank customer due diligence rule, it means each person who owns 25 percent or more of a legal entity customer, plus one person with significant control over it. Banks still collect this information even though companies formed in the United States no longer report it to FinCEN.
- Benford's law
The observation that in many naturally occurring sets of numbers, the leading digit is 1 about 30 percent of the time and 9 less than 5 percent of the time. A departure from that pattern in invoices or expense claims can point to invented amounts. It tells you where to look, never that fraud happened.
- Business email compromise (BEC)
A fraud in which a criminal impersonates an executive, vendor or adviser by email to get a payment sent or redirected. The message often comes from a lookalike domain or a hijacked real mailbox, so it reads as routine. The AFP's 2026 payments fraud survey found it to be the most common vector.
- Callback verification
Confirming a payment instruction or a change of bank details by phoning the requester on a number already on file, never one given in the request. It defeats email and deepfake impersonation because the attacker does not control the known number.
Related: Vendor bank-change fraud: five controls that stop it
- Compensating control
A control that reduces a risk another control cannot address, usually because duties cannot be split. A typical example is an owner reviewing a monthly report of every manual journal entry and every vendor bank change. It only works if the reviewer is independent of the activity and leaves evidence of the review.
- Conflict of interest
A situation in which a person's private interest could influence, or appear to influence, a decision they make for the organization. Owning part of a vendor or hiring a relative are common examples. Most conflicts can be managed once they are disclosed and the person steps out of the decision.
- Continuous controls monitoring
Automated tests that run on a schedule over ledger, bank and access data and send each exception to a named owner. It replaces a once-a-year look with weekly or monthly evidence that controls are working.
- Control environment
The first of the five COSO components: the standards, structure and conduct that decide how seriously an organization takes control. It covers integrity and ethical values, board oversight, reporting lines and authority, competence and accountability. A weak control environment undermines every control built on top of it.
- Corporate Transparency Act (CTA)
A 2021 federal law that required many companies to report their beneficial owners to FinCEN. A FinCEN final rule effective 14 August 2026 permanently exempts companies formed in the United States and US persons, so only foreign entities registered to do business in the US still report, and they do not report US-person owners. State laws such as New York's LLC Transparency Act are separate.
- COSO
The Committee of Sponsoring Organizations of the Treadway Commission, a joint initiative of five US professional bodies. Its Internal Control: Integrated Framework (2013) sets out five components and 17 principles, and it is the framework US public companies most often use to assess internal control over financial reporting.
- Deepfake
Audio, video or images generated or altered by AI to imitate a real person. In finance, deepfaked executives on video calls or voice messages are used to instruct urgent payments. FinCEN issued an alert on fraud schemes involving deepfake media in November 2024.
Related: Deepfake CFO scams: a payment-verification protocol
A written matrix stating who may approve which decisions, such as payments, contracts, hires and journal entries, and up to what amount. It makes approvals checkable: a payment approved above someone's limit becomes an exception you can find in the data.
- DOJ Evaluation of Corporate Compliance Programs (ECCP)
The US Department of Justice guidance prosecutors use to judge a company's compliance program when deciding how to resolve a case. It asks whether the program is well designed, whether it is adequately resourced and given the authority to function, and whether it works in practice. The current version is dated September 2024.
- Failure to prevent fraud
A UK corporate offence created by the Economic Crime and Corporate Transparency Act 2023, in force since 1 September 2025. A large organization can be liable when an employee, agent or other associated person commits a fraud intended to benefit it, unless it had reasonable fraud prevention procedures. US groups can be in scope when the fraud has a UK connection.
Related: Does the UK failure-to-prevent-fraud offence reach US companies?
- Form 990 Schedule L
The schedule of IRS Form 990 on which tax-exempt organizations report transactions with interested persons, such as loans, grants and business dealings with officers, directors, key employees and their family members. Form 990 is public, so donors, funders and journalists can read the answers.
- Full-population testing
Testing every transaction in a period instead of a sample. Once ledger and bank data are exported in full, rules for duplicate payments, self-approved entries or weekend postings can run over every record. Each hit still needs a person to decide whether it is a real exception.
- Indirect cost rate
The percentage used to recover shared costs such as rent, finance and IT that cannot be tied to a single award. An organization either negotiates a rate with its cognizant federal agency or, without a negotiated rate, may charge a de minimis rate of up to 15 percent of modified total direct costs.
- Internal control over financial reporting (ICFR)
The processes that give reasonable assurance that financial statements are reliable and prepared in line with GAAP. For SEC registrants the term is defined in Exchange Act Rule 13a-15(f), and management must assess it every year. Private companies meet the same idea when lenders, buyers or auditors ask how their numbers are controlled.
- ISO/IEC 42001
The international standard for an AI management system, published in December 2023. It sets requirements for AI policy, roles, risk and impact assessment, and controls across the AI lifecycle, and organizations can be certified against it.
- ISSB
The International Sustainability Standards Board, set up by the IFRS Foundation in 2021. In June 2023 it issued IFRS S1 on general sustainability-related disclosures and IFRS S2 on climate. Each jurisdiction decides whether to adopt them; in the United States they are voluntary.
- IT general controls (ITGC)
The controls over systems that every automated control and system report depends on. They usually cover user access, change management and IT operations such as backups and scheduled jobs. If they fail, an auditor cannot rely on the reports or automated controls that system produces.
- Journal entry testing
Examining manual and unusual journal entries for signs of error or management override. Auditing standards require auditors to test journal entries as part of their response to fraud risk. The tests look at who posted an entry, when, to which accounts, and whether someone else approved it.
- Material weakness
A deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Public companies must disclose material weaknesses. Auditors of private companies communicate them in writing to management and those charged with governance.
- NIST AI RMF
The voluntary AI Risk Management Framework from the US National Institute of Standards and Technology, version 1.0 published in January 2023 and under revision since the July 2025 AI Action Plan. It organizes AI risk work into four functions: govern, map, measure and manage. Its Generative AI Profile (NIST AI 600-1) applies the framework to generative AI.
- Occupational fraud
Fraud committed by people against the organization that employs them, using their position to misuse its resources. The ACFE groups it into asset misappropriation, corruption and financial statement fraud. Its 2026 report estimates that organizations lose about 5 percent of revenue to it each year.
- Positive pay
A bank service that matches checks presented for payment against the list of checks the company actually issued. Items that do not match are held until the company approves or rejects them. ACH positive pay applies similar rules to electronic debits.
A transaction between an organization and its owners, directors, officers, their family members or entities they control. Such deals are legal, but they need independent approval and disclosure because the terms may not be at arm's length. US GAAP requires disclosure of material related-party transactions under ASC 850.
Related: Related-party transactions: policy, approval and disclosure
- Scope 3 emissions
Indirect greenhouse gas emissions in a company's value chain, outside its own operations and purchased energy, as defined by the GHG Protocol. They span 15 categories, from purchased goods to the use of sold products. Large reporters need supplier data to estimate them, which is why suppliers receive carbon questionnaires.
- Segregation of duties
Splitting the steps of a transaction so that no one person can start, approve, record and reconcile it alone. The classic split separates authorizing a transaction, holding the asset, recording it and reviewing it. Where a team is too small to split duties, a compensating control covers the gap.
- Shadow AI
AI tools used for work without the organization's knowledge or approval, such as staff pasting ledger exports into a public chatbot. It creates data exposure and control gaps that nobody has assessed. COSO's February 2026 guidance on generative AI gives it particular attention.
- Significant deficiency
A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit the attention of those who oversee financial reporting. Auditors report significant deficiencies to the audit committee or board, and they often become next year's priorities.
- Single audit
An audit of a non-federal entity's financial statements and its compliance with federal award requirements, conducted under 2 CFR 200 Subpart F. It is required when the entity expends $1,000,000 or more in federal awards in a fiscal year beginning on or after 1 October 2024, or $750,000 or more in an earlier fiscal year.
- SOX 302
Section 302 of the Sarbanes-Oxley Act requires the CEO and CFO of a public company to certify each quarterly and annual report. They certify that the report is accurate and that they are responsible for disclosure controls and internal control over financial reporting. Because the certification is personal, many CFOs ask for sub-certifications from the people who report to them.
- SOX 404(a) and 404(b)
Section 404(a) of the Sarbanes-Oxley Act requires management of a public company to assess and report on internal control over financial reporting in each annual report. Section 404(b) requires the external auditor to attest to that assessment, and applies to accelerated and large accelerated filers. An SEC proposal of May 2026 would narrow who needs 404(b); it was not final as of November 2026.
- Speak-up program
The reporting channels, triage process and protections that let employees and others raise concerns about misconduct. A working program offers more than one route, including an anonymous option, and tells reporters what happened next. The ACFE finds that tips detect more occupational fraud than any other method.
- Subrecipient monitoring
The duties a pass-through entity owes when it passes federal funds to another organization, set out in 2 CFR 200.332. They include assessing each subrecipient's risk, stating the federal requirements in the subaward, reviewing financial and performance reports, and following up on audit findings.
- Three-way match
A purchase-to-pay control that releases an invoice for payment only when it agrees with the purchase order and the receiving record. A difference in quantity or price beyond a set tolerance holds the invoice until someone resolves it.
Related: An internal controls checklist for growing companies
- Tone at the top
The ethical climate leaders set through what they say, what they reward and what they tolerate. Employees judge it by behavior, such as whether a high performer who breaks a rule faces the same consequences as anyone else.
- Uniform Guidance
The common name for 2 CFR 200, the federal rules for grants and cooperative agreements covering administration, cost principles and audit. Its 2024 revision took effect on 1 October 2024. OMB proposed a further rewrite in May 2026, which was not final as of November 2026.
- Vendor master file
The system record of every vendor a company can pay, including legal name, tax ID, address and bank details. Unreviewed changes to it, especially to bank details, are a common route for payment fraud. Good practice limits who can edit it and logs every change for independent review.
Related: Vendor bank-change fraud: five controls that stop it
- VSME
The EU's voluntary sustainability reporting standard for smaller companies, first developed by EFRAG and adopted by the European Commission as a delegated act on 3 July 2026. After the 2026 Omnibus, companies reporting under the CSRD may not ask value-chain companies with up to 1,000 employees for more than this standard covers.
- Whistleblower retaliation
Adverse action against someone because they reported suspected misconduct, such as dismissal, demotion or being shut out of work. US laws including the Sarbanes-Oxley and Dodd-Frank Acts prohibit it in many settings. The DOJ asks whether a company protects reporters in practice, not only on paper.
Definitions current as of November 2026
These definitions are written for a controller, executive director or board member who needs the meaning quickly, not the full legal text. Where a term depends on a law or standard that changed recently, such as the Corporate Transparency Act or the single audit threshold, the definition gives the position as of November 2026.
A definition is not advice. Before you rely on one for a filing or a contract, check the primary source or ask your auditor or counsel. The frameworks page lists the standards behind many of these terms and their current status. For the controls vocabulary in practice, the Controls Health Self-Check and the Financial Process & Controls service use the same terms.
Tell us what you are seeing
A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.