CA ANZ Core 2: Risk, Technology and AI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Inherent risk

The level of risk before considering the effect of controls; used to identify exposures that may need treatment and to compare with residual risk.

Residual risk

The risk remaining after controls and treatments have been applied; compared with risk appetite to decide whether further action is required.

Risk appetite

The amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives, expressed through statements, limits, or thresholds.

Risk tolerance

The acceptable variation around the risk appetite; operational boundaries that trigger escalation when exceeded, often expressed as quantitative limits or thresholds.

Risk register

A structured record of identified risks, including causes, consequences, owners, inherent and residual ratings, controls, treatments, and review dates.

Three lines model

A governance model where management owns and manages risk, risk and compliance functions provide oversight, and internal audit provides independent assurance to the board.

Tone at the top

The ethical and risk-management example set by senior leadership and the board, shaping culture, behaviour, and the effectiveness of governance and controls.

Segregation of duties

A control that separates incompatible tasks such as authorising, recording, and custody, so no single person can both perpetrate and conceal an error or fraud.

Professional scepticism

A questioning mindset that challenges assumptions, seeks corroborating evidence, and considers bias or error before accepting information or management explanations.

Purpose limitation

A privacy principle requiring personal data to be collected for specified, legitimate purposes and not used or disclosed for incompatible purposes without a proper basis.

Cloud accountability

The principle that an organisation remains responsible for data and controls even when services are outsourced; due diligence, contracts, monitoring, and exit plans are required.

CIA triad

A security model comprising confidentiality, integrity, and availability; used to classify information security objectives and evaluate the adequacy of controls.

IT general controls

Controls over the IT environment that support reliable application controls, including access management, change management, operations, backup, and program development.

Least privilege

An access principle granting users only the minimum permissions needed for their roles, reducing the risk of unauthorised changes, data exposure, and misuse.

Incident response phases

A structured process typically covering preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned to improve future response.

Defence in depth

A layered control strategy using preventive, detective, and corrective measures across people, process, and technology so a single failure does not cause a breach.

Backup 3-2-1 rule

A backup practice keeping at least three copies of data on two different media types, with one copy stored offsite or offline to support recovery.

Data quality dimensions

Attributes such as accuracy, completeness, consistency, timeliness, validity, and uniqueness used to define and measure whether data is fit for purpose.

Descriptive analytics

Analytics that summarises historical data to explain what happened, often using reports, dashboards, and aggregations to support monitoring and decision-making.

Predictive analytics

Analytics that uses historical data and statistical or machine-learning models to estimate future outcomes, with uncertainty and model risk requiring validation.

Data lineage

Documentation tracing data from origin through transformations to use, supporting quality, auditability, impact analysis, and trust in reports and models.

Sampling risk

The risk that conclusions from a sample differ from conclusions that would be reached by testing the entire population, reduced by appropriate sample design and size.

Model risk

The risk of adverse consequences from decisions based on incorrect or misused model outputs, including errors, overfitting, bias, and inappropriate use.

Data drift

A change in input data distributions or relationships over time that can degrade model performance, requiring monitoring, retraining, or model replacement.

Human-in-the-loop

A control design where a person reviews or approves AI outputs before consequential action, supporting accountability, judgement, and exception handling.

AI governance

Policies, roles, inventories, risk assessments, documentation, and monitoring that ensure AI systems are developed and used responsibly and within risk appetite.

Generative AI hallucination

A confident but incorrect or fabricated output from a generative model, often caused by pattern completion rather than verified knowledge; requires verification controls.

Internal control

A process effected by people and designed to provide reasonable assurance about achieving objectives relating to operations, reporting, and compliance.

COSO control environment

The set of standards, processes, and structures that provide the foundation for internal control, including integrity, ethical values, governance, and tone at the top.

Preventive control

A control that stops an error or fraud before it occurs, such as authorisation, segregation of duties, access restriction, or input validation.

Detective control

A control that identifies errors or irregularities after they occur, such as reconciliations, exception reports, reviews, and monitoring alerts.

Assurance mapping

A technique linking objectives and risks to controls and sources of assurance across the first, second, and third lines, highlighting gaps and duplication.