GIP Professional Exam key terms

A governance structure separating management's risk ownership (first line), independent risk and compliance oversight (second line), and internal audit's independent assurance (third line), clarifying who owns, oversees, and independently verifies risk.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as a statement or set of thresholds that guides decisions and constrains risk-taking.

The acceptable variation in outcomes around a stated risk appetite, often expressed as quantitative limits or thresholds that trigger escalation when breached.

A structured record of identified risks, their owners, likelihood and impact ratings, existing controls, and planned treatments, maintained as a living tool for monitoring and reporting.

The risk that remains after existing controls have been applied, as distinct from the raw exposure before controls; it is the basis for deciding whether further treatment is required.

The level of risk that exists before any controls are considered, used as a baseline to judge how much risk reduction controls actually deliver.

A forward-looking metric that signals rising or falling exposure to a specific risk, chosen so management can act before the risk materializes as a loss or incident.

The named individual accountable for designing, operating, and maintaining a specific control, including evidence collection and remediation of deficiencies found in testing.

The degree to which a control, as designed and as actually operated, achieves its intended objective; testing distinguishes design effectiveness from operating effectiveness.

An assessment of whether a control, as documented and structured, is capable of preventing or detecting the risk it targets, evaluated before testing whether it actually ran correctly.

Evidence that a control operated consistently and correctly throughout the period under review, typically established through samples, reperformance, or observation rather than documentation alone.

Testing a single instance of a control to confirm it operates as described, useful for automated or configuration controls but insufficient to conclude on consistent manual performance over time.

The possibility that conclusions drawn from a sample differ from what would be found by examining the entire population, influenced by sample size, population variability, and selection method.

Information used to support audit conclusions, judged on sufficiency (quantity) and appropriateness (relevance and reliability); evidence obtained directly by the auditor is generally stronger than indirect evidence.

The threshold at which an omission or misstatement could influence decisions of report users, shaping what auditors test, how deeply, and which findings must be reported.

The freedom of the audit function from operational responsibilities and reporting lines that could bias its judgment, typically preserved by reporting to the audit committee rather than management.

A board subcommittee of independent directors overseeing financial reporting, external audit, internal audit, and risk management, serving as the escalation point for significant control and integrity issues.

A communication from auditors to those charged with governance describing control deficiencies, observations, and improvement recommendations that fall outside the formal audit opinion.

A documented schedule assigning ownership, actions, and target dates to close a control gap or audit finding, tracked until evidence confirms the fix is effective.

Splitting incompatible tasks, such as authorizing, recording, and reviewing a transaction, among different people so no single individual can both cause and conceal an error or fraud.

Granting users and systems only the access necessary for their defined tasks, for only as long as needed, reducing the blast radius of compromised accounts and insider misuse.

Layering independent preventive, detective, and corrective safeguards so that failure of one control does not leave an asset fully exposed.

A specific action, such as an approval, reconciliation, review, or system configuration, that helps ensure management directives are carried out and risk responses are applied.

A safeguard that stops an unwanted event before it occurs, such as access restrictions, input validation, or required approvals; it reduces likelihood rather than detecting problems after the fact.

A safeguard that identifies an unwanted event after it has occurred, such as log monitoring, reconciliations, or anomaly alerts, enabling timely response and limiting damage.

Accounts with elevated rights to change systems, data, or security settings; these require stronger authentication, tighter monitoring, and periodic review because compromise yields disproportionate harm.

Continuous collection and analysis of logs and alerts to detect suspicious activity, supporting investigation and providing evidence that detective controls are operating.

The three core properties of information security: information is disclosed only to authorized parties, remains accurate and unaltered, and is accessible when needed.

Assigning information to tiers such as public, internal, confidential, and restricted so that handling, access, retention, and protection requirements scale with sensitivity.

Collecting and retaining only the personal data necessary for a stated purpose, reducing exposure, storage cost, and legal liability if a breach occurs.

A principle requiring personal data to be used only for the purposes disclosed and legitimized at collection, unless a new lawful basis is established for further use.

Entitlements of individuals over their personal data, commonly including access, correction, deletion, portability, and objection, each with defined response timelines and exceptions.

A rule set defining how long each data category is kept and how it is disposed of, balancing legal, contractual, and operational needs against the risk of indefinite storage.

Moving personal data between jurisdictions, which may require a lawful transfer mechanism, adequacy assessment, or contractual safeguards depending on the laws involved.

A documented set of roles, escalation paths, and phases for detecting, containing, eradicating, and recovering from security incidents, tested through exercises and updated after each event.

A structured assessment identifying critical processes, their dependencies, and the operational and financial consequences of disruption over time, used to set recovery objectives.

The maximum acceptable duration a process may be unavailable after a disruption before consequences become unacceptable; it drives recovery strategy and resource decisions.

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for each system.

Documented procedures and alternate arrangements that allow critical operations to continue during and after a disruption, aligned with recovery objectives from the impact analysis.

A blameless examination after an incident or exercise of what happened, why controls failed, and which changes will reduce recurrence, producing tracked improvement actions.

A structured review of a new process or system that identifies personal data flows, privacy risks, and mitigations before deployment, often required for high-risk processing.

Technology adopted by business units without security or IT approval, creating unmanaged data stores, unpatched systems, and gaps in the organization's asset and risk inventories.

Exposure arising from vendors, suppliers, and service providers whose failures, breaches, or noncompliance affect the organization; managed through due diligence, contracts, and ongoing monitoring.

A contract clause or document setting how a processor may handle personal data on a controller's behalf, covering purpose, security measures, subprocessors, breach notice, and deletion.

Systematically unfair outcomes produced by automated models because of flawed data, proxy variables, or objective design, creating legal, reputational, and ethical exposure.

The ability to describe how a model or automated decision reaches its output in terms understandable to auditors, regulators, and affected individuals, supporting challenge and accountability.

The potential for adverse consequences from decisions based on incorrect or misused model outputs, managed through validation, monitoring, documentation, and defined ownership.

A situation where personal, financial, or other interests could improperly influence professional judgment; it must be disclosed and managed even when no wrongdoing has occurred.

An attitude of questioning assumptions and corroborating representations rather than accepting them at face value, especially where incentives or pressure could distort information.

The duty not to disclose information learned through professional work except with authorization or legal requirement, extending to former clients and to accidental disclosures.

A confidential route for staff and others to report suspected misconduct or control failures without retaliation, providing a key source of detection evidence for governance bodies.