ETiCPA ATQE Exam key terms

The system of structures, processes, and relationships through which an organization directs and controls its IT resources, aligning technology decisions with business objectives and accountability for risk.

The amount and type of technology-related risk an organization is willing to accept in pursuit of its objectives, expressed in measurable thresholds that guide decisions about controls and remediation.

A governance structure in which operational management owns risk, an independent risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

A structured reference model of control objectives and components used to design, assess, and communicate the state of internal controls across an organization's technology environment.

A widely used framework describing five components of internal control over financial reporting and operations, including control environment, risk assessment, control activities, information and communication, and monitoring.

A specific, measurable statement of what a control is intended to achieve, such as ensuring only authorized users can modify production data or that changes are approved before deployment.

A safeguard designed to stop an error, fraud, or security event before it occurs, for example access approval workflows, input validation rules, or segregation of duties in transaction processing.

A mechanism that identifies problems after they occur, such as log monitoring, exception reports, or reconciliation reviews, enabling timely correction rather than blocking the event itself.

Controls over the technology environment that support reliable application controls, spanning access management, change management, operations, backup, and program development across systems.

A control embedded in a business application or its configuration, such as edit checks, automated matching, or authorization limits, that helps ensure complete and accurate transaction processing.

The complete inventory of auditable entities, systems, processes, and third parties within scope for an audit function, used to plan coverage over a multi-year cycle.

A schedule of audit work that allocates limited resources to areas of highest assessed risk and significance, balancing coverage expectations with capacity and timing constraints.

The defined boundaries of an audit engagement, specifying the systems, locations, periods, processes, and control objectives the auditor will examine and those explicitly excluded.

A clear statement of what a specific engagement intends to determine, such as whether access to a payment platform is appropriately restricted and reviewed.

The standards, policies, regulations, or frameworks against which the auditor measures the subject matter, forming the basis for conclusions and findings.

The evaluation of risk exposure before considering the effect of existing controls, used to prioritize audit attention and to frame conclusions about residual risk.

Information gathered through inspection, observation, inquiry, or re-performance that supports audit conclusions and must be sufficient, appropriate, and relevant to the objective.

A technique in which the auditor traces a single transaction or process end to end, confirming understanding of how controls operate and whether they are designed as described.

An evidence-gathering method in which the auditor independently executes a control or calculation to verify that it produces the expected result, providing stronger evidence than inquiry alone.

The act of obtaining information from knowledgeable people through interviews or questions; useful for understanding processes but insufficient on its own as audit evidence.

The possibility that conclusions drawn from a sample differ from conclusions that would be reached by testing the entire population, influenced by sample size and population variability.

A statistical technique that estimates the rate at which a defined characteristic, such as an approval signature, occurs in a population, commonly used for tests of controls.

Confirmation that the set of items from which a sample is drawn includes all relevant transactions or records for the period, preventing biased or incomplete testing.

A documented commitment between a service provider and its customer specifying expected service levels, responsibilities, performance metrics, and remedies for shortfalls.

A study identifying critical business processes, their dependencies on technology, and the operational and financial consequences of disruption over time, informing recovery priorities.

The maximum acceptable duration of downtime for a process or system before the impact becomes intolerable, driving the design of resilience and recovery arrangements.

Documented procedures and technical arrangements for restoring critical systems and data after a major disruption, including roles, alternate sites, and communication steps.

Exercising continuity and recovery arrangements, through tabletop or full simulation, to verify that plans work in practice and that staff know their responsibilities.

Dividing responsibilities so that no single person can initiate, authorize, record, and review a transaction, reducing the opportunity for error or fraud.

The principle that users and systems receive only the minimum access rights needed to perform their assigned duties, and only for as long as those duties require.

Access rights that allow administrative control over systems, data, or security settings, requiring stronger authentication, monitoring, and periodic review than ordinary user access.

The periodic examination of system and security logs for anomalies, unauthorized activity, or control failures, providing detective evidence that monitoring operates effectively.

The controlled process by which modifications to systems, configurations, or infrastructure are requested, assessed, approved, tested, and implemented with appropriate authorization and rollback plans.

Structured testing in which business users confirm that a new or changed system meets agreed requirements and is fit for purpose before it is released to production.

Keeping development, test, and production environments separate so that unapproved or untested code cannot reach live systems and developers cannot freely alter production data.

The accuracy, completeness, and consistency of data throughout its lifecycle, maintained through validation rules, reconciliation, and controls over processing and storage.

Assigning data to defined sensitivity categories, such as public, internal, confidential, or restricted, so that handling, access, and protection requirements are applied consistently.

The rules and schedules governing how long records are kept and how they are disposed of, balancing legal, regulatory, and operational needs against privacy and storage risk.

A documented audit conclusion describing a condition that differs from criteria, supported by evidence, with its cause, effect, and significance clearly stated.

The auditee's formal reply to a finding, stating agreement or disagreement, planned corrective actions, accountable owners, and target completion dates.

Verification performed after remediation to confirm that agreed actions were implemented and that the underlying risk has been adequately reduced.

The risk that remains after existing controls and mitigations are applied, which determines whether further action is needed to reach an acceptable level.

An assessment of whether a control, as documented and configured, is capable of preventing or detecting the relevant risk if it operates as intended.

An assessment of whether a control actually functioned consistently throughout the period under review, typically supported by samples of evidence from multiple points in time.

The freedom of the audit function from conditions that threaten objectivity, including reporting lines to the governing body and restrictions on operational responsibilities.