CPA ISC flashcards
CPA ISC · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Residual risk
- The risk remaining after management implements controls; it equals inherent risk adjusted for the mitigating effect of existing controls and is compared against risk tolerance.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, established by the board and expressed in qualitative and quantitative terms.
- COSO ERM framework
- A risk management framework with five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.
- COBIT
- ISACA's IT governance framework that separates governance (evaluate, direct, monitor) from management and defines processes, control objectives, and maturity levels for enterprise IT.
- SOC 2 Type 2 report
- An attestation covering the design and operating effectiveness of controls relevant to the trust services criteria over a period, typically six to twelve months.
- Three lines model
- A governance structure in which operational management owns risk, a risk and compliance function oversees it, and internal audit provides independent assurance to the board.
- Key risk indicator
- A forward-looking metric that signals increasing exposure to a risk, allowing management to act before the risk event occurs and losses are realized.
- SOC 1 report
- An attestation on controls at a service organization relevant to user entities' internal control over financial reporting, relied on by user auditors in a financial statement audit.
- ACID properties
- Four database transaction guarantees: atomicity (all or nothing), consistency (valid states), isolation (concurrent transactions do not interfere), and durability (committed changes persist).
- Third normal form
- A table is in 3NF when it is in 2NF and contains no transitive dependencies, meaning every non-key attribute depends only on the primary key.
- Data warehouse
- A centralized repository consolidating cleansed, subject-oriented historical data from multiple sources, structured for query and analysis rather than transaction processing.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time; it determines the required frequency of backups and data replication.
- Recovery time objective
- The maximum acceptable duration of downtime before a system or process must be restored, driving selection of recovery site and resources.
- Data lake
- A storage repository holding large volumes of raw structured and unstructured data in native format, with schema applied at read time rather than at write.
- Primary key
- A column or combination of columns that uniquely identifies each row in a relational table and cannot contain null values.
- Differential backup
- A backup that copies all files changed since the last full backup, so restoration requires the last full backup plus the most recent differential only.
- Digital signature
- A hash of a message encrypted with the sender's private key; it provides integrity, sender authentication, and nonrepudiation but not confidentiality.
- Role-based access control
- An access model that assigns permissions to roles rather than to individuals, with users obtaining permissions by being assigned to one or more roles.
- Multi-factor authentication
- Authentication requiring two or more credentials from different categories, such as something you know, something you have, or something you are.
- Symmetric encryption
- Encryption using a single shared key for both encryption and decryption; it is computationally fast but requires secure distribution and custody of the key.
- Intrusion detection system
- A monitoring tool that identifies suspicious network or host activity and alerts staff, but does not itself block the traffic because it is not inline.
- Least privilege
- The principle that users and processes receive only the access rights necessary for their assigned tasks, reducing the impact of error or compromise.
- Incident response phases
- Preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, forming the lifecycle for handling security incidents.
- Data minimization
- A privacy principle limiting the collection, use, and retention of personal data to what is necessary for a specified and legitimate purpose.
- Parallel conversion
- An implementation approach in which the old and new systems run simultaneously until the new system is validated, at high cost but low risk.
- User acceptance testing
- Testing performed by end users to confirm that a system meets business requirements and is fit for purpose before go-live approval.
- Environment separation
- Keeping development, test, and production environments distinct with separate credentials and data so untested or unauthorized code cannot affect live processing.
- Regression testing
- Retesting previously working functions after a modification to confirm the change did not introduce new errors elsewhere in the system.
- Emergency change
- An urgently required modification to a production system processed under abbreviated but documented approval and testing, followed by retrospective review.
- Full interruption test
- A disaster recovery test that actually shuts down the primary site and shifts processing to the alternate site, the most realistic and most disruptive method.
- Source code escrow
- An arrangement placing software source code with a neutral third party for release to the licensee if the vendor fails to support the product.
- Post-implementation review
- A structured assessment after go-live comparing actual benefits, costs, and performance against the approved business case and identifying lessons learned.