GIP Professional Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides independent oversight, and internal audit provides independent assurance to the governing body.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as statements or thresholds that guide decisions.

Residual risk

The risk that remains after controls have been applied, calculated from likelihood and impact; it is compared to risk appetite to decide whether further treatment is needed.

Segregation of duties

A preventive control that separates authorization, custody of assets, and record-keeping among different individuals so no single person can both commit and conceal an error or fraud.

Key risk indicator

A leading metric with defined thresholds that signals rising risk exposure, enabling management to act before the risk materializes into a loss event.

CIA triad

The three core information security objectives: confidentiality, ensuring only authorized parties access data; integrity, ensuring accuracy and completeness; and availability, ensuring timely access.

Multi-factor authentication

Authentication using two or more different factor types, such as a password plus a hardware token, so that compromise of one factor does not grant access.

Digital signature

A cryptographic mechanism where a hash of a message is encrypted with the sender's private key, providing integrity, authenticity, and non-repudiation when verified with the public key.

Defense in depth

A layered control strategy in which multiple independent safeguards protect an asset, so failure or bypass of one layer does not expose the asset to full compromise.

Least privilege

The principle that users and systems receive only the minimum access rights needed for their tasks, reducing the attack surface and the impact of a compromised account.

Data controller

The entity that determines the purposes and means of processing personal data and bears primary accountability for compliance with data protection obligations.

Data processor

An entity that processes personal data on behalf of and on the documented instructions of a controller, typically bound by a data processing agreement.

Purpose limitation

A data protection principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not further processed in incompatible ways.

Data minimization

The principle that only personal data adequate, relevant, and necessary for the stated purpose should be collected and retained, limiting exposure if a breach occurs.

72-hour breach notification

Under GDPR, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware.

Standard contractual clauses

Pre-approved contractual terms used to lawfully transfer personal data to jurisdictions without an adequacy decision, imposing data protection obligations on the importer.

Recovery time objective

The maximum acceptable time a business process may be unavailable after disruption before the impact becomes unacceptable; it drives recovery strategy design.

Recovery point objective

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for a critical system.

Business impact analysis

A structured assessment identifying critical processes, their dependencies, and maximum tolerable downtime, which sets recovery priorities and targets for continuity planning.

Incident containment

The response phase that limits the spread of an incident, for example by isolating hosts or disabling accounts, while balancing evidence preservation against operational impact.

Tabletop exercise

A discussion-based simulation in which participants walk through a scenario to test plans, decision-making, and roles without disrupting live systems.

Attribute sampling

An audit sampling method that tests whether a control deviation occurred, estimating the deviation rate in a population against a tolerable rate.

Walkthrough

An audit procedure that traces a transaction through a process to confirm the auditor's understanding of control design and identify where controls are applied.

Materiality

The threshold above which an omission or misstatement could influence the decisions of users, guiding audit scope, sampling, and the significance of findings.

Audit finding structure

A finding states the condition observed, the criteria it violates, the cause, the effect or risk, and a recommendation, then is rated by impact and likelihood.

Self-review threat

An independence threat arising when an auditor evaluates work they previously performed or designed, impairing objectivity and the credibility of the assurance.

Cloud shared responsibility

The division of security duties between cloud provider and customer; the provider secures the cloud infrastructure while the customer secures data, identities, and configuration.

Zero trust

A security model that assumes no implicit trust based on network location, verifying every request explicitly and enforcing least privilege continuously.

Model drift

Degradation of an AI model's accuracy as real-world data diverges from training data, requiring ongoing monitoring, retraining, and version control.

Prompt injection

An attack in which crafted input manipulates a generative AI system into ignoring its instructions or leaking data, mitigated by input validation and output review.

Objectivity

An ethical principle requiring professionals to avoid conflicts of interest and disclose relationships that could impair, or appear to impair, their professional judgment.

Audit committee reporting line

Internal audit reports functionally to the audit committee and administratively to senior management, preserving independence from the functions it audits.