EXIN Lean IT Foundation key terms

The relevant end-to-end work and information path from demand to delivered outcome, including queues and necessary handoffs rather than only one team’s processing.

A demand/capacity condition authorizing relevant upstream work under an explicit operating policy, not simply the presence of a visual board.

The available production or service time divided by relevant customer demand under stated units and boundaries, distinct from measured processing duration.

The explicitly defined active processing time divided by total lead time under consistent units and scope, without automatically classifying all other time as avoidable waste.

The items within a defined started-but-not-finished boundary, whose effect on flow must be interpreted with throughput and lead-time conditions.

A proposed explanation for a process condition that requires supporting evidence, distinct from a diagram label or a fixed number of why questions.

A proposed intervention addressing a supported cause, requiring an appropriate bounded test and outcome verification rather than adoption because it appears on a diagram.

An agreed arrangement defining ongoing measures, ownership, response conditions and review needed to sustain and verify a process improvement in daily operation.

A boundary expressing the actual customer or other requirement, distinct from a statistical control limit describing observed process behavior.

A clear statement of what is counted or measured, the relevant unit and population, and how collection is performed so results are interpretable.

A defined relevant chance for nonconformance per unit, whose count and consistency affect the interpretation of defects-per-million-opportunities calculations.

A model of the proportion passing an entire specified sequence without rework, calculated from appropriately conditioned step yields rather than their simple average.

Variation arising from the current process system under the stated stability model, distinguished from an identified unusual influence without treating all fluctuations as special causes.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.

A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.

A weakness in a process, system, or control that could be exploited by a threat to cause harm.

The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.

The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.