CETP-AUD flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual risk

The risk remaining after existing controls are applied. Auditors compare residual risk to the risk appetite to decide whether additional testing or a finding is warranted.

Walkthrough

Tracing one transaction end to end through a process to confirm the control as designed actually exists and is understood by staff. It tests design, not operating effectiveness.

Scope limitation

A constraint that prevents the auditor from obtaining sufficient appropriate evidence on an in-scope area. It must be documented and disclosed in the report rather than silently accepted.

Materiality threshold

The error or deviation rate above which the auditor concludes a control is not operating effectively. It is set during planning and applied consistently across the engagement.

Three lines model

A governance structure where operations owns and manages risk, a compliance or privacy function monitors and advises, and internal audit provides independent assurance to the board.

Policy exception

A documented, time-bound approval allowing departure from a policy, with a named approver, expiry date, and compensating control. Open-ended exceptions are audit findings.

Accountability principle

The obligation to demonstrate compliance, not merely to intend it. Auditors test for evidence such as records, logs, assessments, and decisions that show controls operated.

Segregation of duties

Splitting approval, execution, and logging of a sensitive action among different people so no single individual can both authorize and conceal a violation.

Consent record elements

Evidence of who consented, for which purpose, when, through which channel, and which notice version was shown. These fields let the auditor reconstruct validity.

Withdrawal propagation

Confirmation that a consent withdrawal reaches downstream processors, marketing lists, and derived datasets. Auditors test propagation evidence, not just the intake log entry.

Access request clock

The statutory response deadline, usually starting at receipt of the request rather than at completion of identity verification. Verification time must still be tracked and proportionate.

Erasure exception

A legal ground permitting refusal of deletion, such as a statutory retention duty or legal claims. Each refusal must cite and document the specific ground.

Crypto-erase

Disposal by destroying the encryption key so data becomes unrecoverable. Valid only where key management proves the key cannot be restored from any backup or escrow.

Retention trigger

The event that starts the retention clock, such as collection, last use, or contract end. Ambiguity in the trigger is itself a reportable control weakness.

Legal hold

A flag suspending scheduled disposal because of litigation or investigation. Auditors test that the hold overrides automated deletion jobs and that release is authorized.

Destruction certificate

Vendor-issued evidence of disposal showing method, date, asset identifiers, and approver. It is the primary evidence for third-party physical or logical destruction.

Access recertification

Periodic manager review confirming each user's access remains necessary. Auditors test completeness against the HR roster and timeliness of removal decisions.

Orphaned account

An active system account belonging to a departed or reassigned worker. Detected by reconciling the HR termination list against directory and application user lists.

Key rotation evidence

Records showing encryption keys were rotated at the defined interval and old keys revoked. Configuration alone does not prove rotation occurred in practice.

Privileged access review

Testing that administrative accounts have MFA, logged sessions, and periodic justification. Review evidence must cover the full population of privileged accounts.

Vendor tiering

Classifying vendors by data sensitivity, volume, and system access. Tier determines due-diligence depth and reassessment frequency in the third-party risk program.

Bridge letter

A vendor statement covering the gap between an assurance report's period end and the current date, confirming no material control changes occurred.

Fourth-party risk

Risk arising from a vendor's own subprocessors. The primary vendor remains accountable, so subprocessor inventory and contractual flow-down must be verified.

Audit rights clause

Contract language granting the customer the right to audit or obtain assurance evidence from the vendor. Its absence limits future verification options.

Awareness timestamp

The moment an organization first has reasonable grounds to believe a breach occurred. Notification deadlines are measured from this point, not from incident resolution.

Breach register reconciliation

Comparing incident tickets flagged as involving personal data against the formal breach log to detect unrecorded or misclassified incidents.

Tabletop exercise

A simulated incident scenario used to test the response playbook, decision authority, and notification timing. Documented decisions serve as control evidence.

Transfer impact assessment

An evaluation of the destination country's laws and practices to determine whether the chosen transfer mechanism provides essentially equivalent protection. It must be dated and refreshed.

Standard contractual clauses

Pre-approved contract terms used to legitimize transfers to jurisdictions lacking an adequacy decision. Execution and subprocessor flow-down must both be evidenced.

Attribute sampling

A statistical method testing whether a defined characteristic exists in a sample to conclude on the population's deviation rate. Population and tolerable rate are set before testing.

Finding structure

A finding states condition, criteria, cause, effect, and recommendation. Without stated criteria, the observation is an opinion rather than an audit finding.