CBCA key terms

A systematic, independent, and documented process for obtaining objective evidence and evaluating it against agreed criteria to determine the extent to which those criteria are met.

The policies, standards, procedures, contractual requirements, or regulatory obligations against which an auditor evaluates evidence and forms conclusions about the subject matter.

Information collected during an audit that is sufficient and appropriate to support audit findings and conclusions; it may include records, interviews, observations, or test results.

The stated boundaries of an audit, including the activities, locations, systems, time period, and criteria to be examined, and any explicit exclusions.

A clear statement of what a specific audit is intended to determine, such as whether continuity arrangements conform to criteria or operate effectively.

A document that describes the audit objectives, scope, criteria, schedule, resources, methods, and communication arrangements for a specific audit engagement.

An approach that prioritizes audit effort according to the likelihood and impact of failures in the audited processes, systems, or continuity arrangements.

A coordinated set of audit activities, often covering multiple engagements over a period, designed to achieve broader audit objectives and coverage.

The threshold or significance level at which an omission, misstatement, or control weakness could influence decisions or the conclusions of audit users.

An auditor's questioning attitude and critical assessment of information, avoiding automatic acceptance of assertions without sufficient supporting evidence.

The freedom from conditions that threaten an auditor's ability to make impartial judgments, including freedom from personal, financial, or operational conflicts of interest.

A state of mind in which an auditor evaluates evidence and reaches conclusions without bias, prejudice, or undue influence from others.

The duty to protect information obtained during an audit from unauthorized disclosure or use, consistent with legal, ethical, and organizational requirements.

The knowledge, skills, and experience needed to perform audit tasks effectively and to apply professional standards appropriate to the engagement.

The diligence, judgment, and thoroughness expected of an auditor in planning work, gathering evidence, and reporting results, commensurate with the engagement's complexity.

Records that allow an auditor to trace how evidence was obtained, how tests were performed, and how conclusions were reached from source information to reported results.

Selecting a subset of items from a population so that conclusions about the population can be drawn, using a method appropriate to the audit objective and risk.

The process of strengthening evidence by confirming it through independent or additional sources, such as documents, observations, or interviews with different parties.

The degree to which audit evidence can be trusted, considering its source, independence, timeliness, and whether it is original or derived.

A step-by-step review of a process or transaction from start to finish, used to understand controls and confirm how activities actually operate.

An audit procedure that evaluates whether a control is designed and operating effectively to prevent, detect, or correct problems in the audited process.

Audit procedures that examine actual transactions, records, or outcomes to detect errors or weaknesses rather than relying primarily on the effectiveness of controls.

A documented audit result that identifies a condition, the criteria it fails to meet, the evidence supporting it, and the effect or risk arising from the gap.

The underlying reason a deficiency or nonconformity occurred, identified through analysis so that corrective action addresses the source rather than only the symptom.

Action taken to eliminate the cause of a detected nonconformity or weakness, prevent recurrence, and restore conformity with audit criteria.

The auditee's documented commitment describing how it will address a finding, including planned actions, responsible owners, and target completion dates.

A review performed after corrective actions are implemented to determine whether the actions were completed and whether they effectively resolved the original finding.

A formal record of an audit's objectives, scope, methods, findings, conclusions, and recommendations, communicated clearly and accurately to appropriate stakeholders.

The auditor's judgment about the overall significance of findings and whether the subject matter conforms to the audit criteria, often presented as an opinion or rating.

A failure to meet a specified requirement from an audit criterion, such as a standard, procedure, contract term, or regulatory obligation.

A management system that establishes, implements, operates, monitors, maintains, and improves business continuity arrangements through a structured lifecycle of policies, planning, and review.

A process that identifies time-sensitive activities and assesses the operational, financial, legal, and reputational impacts of their disruption over time.

A process for identifying threats and vulnerabilities, estimating likelihood and impact, and determining which risks to treat to protect continuity objectives.

Documented procedures and arrangements that describe how an organization will respond to and recover from a disruption to its prioritized activities and resources.

The target time within which a prioritized activity, system, or resource must be restored after a disruption to avoid unacceptable impacts.

The maximum acceptable amount of data loss, expressed as the time between the last recoverable data copy and the point of disruption.

The longest period a prioritized activity can be unavailable before its disruption causes unacceptable organizational, legal, financial, or reputational harm.

Planned activities that validate continuity arrangements, reveal gaps, and build competence by simulating disruptions or executing recovery procedures under controlled conditions.

The coordinated activities an organization uses to detect, assess, respond to, and communicate during a severe incident that threatens its strategic objectives or reputation.

A repeated cycle of analyzing, designing, implementing, validating, and improving continuity capabilities, often used as an audit criterion for management maturity.