CA ANZ Core 2: Risk, Technology and AI key terms

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by the board.

The acceptable variation around a risk appetite - the practical boundary within which a specific risk can move before managers must escalate or act.

The level of risk that exists before any controls or mitigation are applied, used as a starting point to judge how much protection existing controls actually provide.

The risk that remains after controls and mitigation have been applied; it is compared with risk appetite to decide whether further treatment is needed.

A structured record of identified risks, each with an owner, likelihood and impact rating, existing controls and planned responses, reviewed and updated periodically.

A forward-looking metric that signals whether a risk is increasing or decreasing, chosen because it moves before the loss event occurs.

The process of selecting and implementing options to address risk - avoid, reduce, transfer or accept - and recording the decision with an accountable owner.

A governance structure separating management (first line), an independent risk and compliance function (second line) and internal audit (third line), so that oversight is not performed by those it oversees.

An attitude of questioning and suspending judgement, verifying evidence rather than accepting assertions, particularly important when reliance is placed on systems, models or management-generated reports.

The state of being free from relationships or interests that could compromise objectivity, required of assurance providers so their conclusions are credible.

The professional obligation to protect information obtained during work, using it only for the purpose for which it was provided and disclosing it only where authorised or required by law.

The reporting of suspected wrongdoing, such as fraud, unsafe practices or control failures, through internal or protected external channels, with legal protection for good-faith reporters.

Controls over the technology environment as a whole - access, change, operations and program development - that support reliable functioning of the applications and reports built on it.

Controls embedded in a specific business application that address the completeness, accuracy, validity and authorisation of transactions processed through that application, such as edit checks, matching routines and approval workflows.

Splitting incompatible tasks - such as initiating, approving, recording and reconciling a transaction - among different people so one person cannot both cause and conceal an error or fraud.

Rules and mechanisms that determine who can view, create or change data, including authentication, authorisation, role design and periodic review of user entitlements.

Procedures ensuring that modifications to systems, code or configuration are authorised, tested, approved and documented before release, and can be reversed if they fail.

Layering independent security controls - technical, procedural and physical - so that a single failure or bypass does not expose critical systems or data.

Malicious software that encrypts or locks data and demands payment, often after stealing it; response depends on backups, segmentation and tested recovery rather than payment.

A documented set of roles and steps for detecting, containing, eradicating and recovering from a security incident, including communication and evidence-preservation requirements.

The decision rights, policies, standards and accountabilities that determine how data is defined, owned, accessed, protected and used across an organisation, including who may change it.

Attributes used to judge data fitness for purpose, typically completeness, accuracy, validity, consistency, timeliness and uniqueness, each measured against defined thresholds.

The documented path data follows from source through transformations to report, showing where each value originated and what changes were applied.

Extract, transform and load: the process of pulling data from source systems, cleaning and standardising it, then loading it into a warehouse or analytics platform.

An expected distribution of leading digits in naturally occurring numeric data; significant deviation in a population can indicate fabrication, duplication or unusual transactions worth investigating.

The presentation of data in charts, dashboards or maps so that patterns, outliers and trends become apparent and support decisions; poorly designed visuals can also mislead.

Techniques where algorithms learn patterns from data rather than following explicitly programmed rules, producing models that classify, predict or generate outputs.

The risk of loss or wrong decisions from errors in a model's design, data, assumptions or use, managed through validation, documentation and ongoing monitoring.

The degree to which a person can understand why a model produced a particular output, which affects its acceptability in regulated or high-stakes decisions.

Systematic unfairness in model outputs arising from unrepresentative training data, flawed labelling or proxy variables, leading to unequal treatment of groups.

A generative model output that is fluent and plausible but factually wrong or unsupported, often including invented citations or figures; requires verification against source evidence.

Software that mimics user actions to execute repetitive, rule-based tasks across systems; fast but brittle when interfaces or underlying processes change.

The examples used to fit a model's parameters; its representativeness, labelling quality and provenance largely determine how well the model behaves on new data.

The policies, procedures and system features designed to provide reasonable assurance that objectives are met, reporting is reliable and assets are safeguarded.

Gathering evidence on whether a control operated as designed throughout the period, through inquiry, observation, inspection or re-performance, and evaluating the results.

A structured process where process owners evaluate and attest to the effectiveness of their own controls, often using standard questionnaires and facilitated workshops.

A chronological record of who did what and when within a system, enabling reconstruction of transactions and supporting investigation and assurance work.