GRCP flashcards
GRCP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- GRC capability
- A repeatable, documented and measurable organizational ability that combines people, process, technology and information to reliably achieve objectives, address uncertainty and act with integrity.
- Principled performance
- The ability to reliably achieve objectives while addressing uncertainty and acting with integrity; it is the overall outcome the GRC capability is designed to deliver.
- Obligation
- A requirement the organization must meet, arising from laws, regulations, contracts, standards, or voluntary commitments, or from internal policies and objectives set by the board.
- Control
- Any measure, policy, device, practice or action that modifies risk by preventing, detecting or correcting events, thereby helping the organization stay within its stated risk appetite.
- Assurance
- Independent, objective confidence that controls are designed and operating effectively, typically provided by internal audit, external audit or an independent second-line testing function.
- Three lines model
- An accountability structure where the first line owns and manages risk, the second line provides oversight and challenge, and the third line gives independent assurance to the board.
- GRC capability maturity
- A progression from ad hoc and reactive practice, through defined and documented processes, to integrated cross-functional capability, and finally to optimized continuous improvement driven by metrics.
- Learn component purpose
- To establish what the organization must know, including its external and internal context, its stakeholders and their expectations, and its obligations and objectives, before direction is set.
- External context
- The outside environment affecting objectives, including legal and regulatory conditions, market and competitive forces, technology change, and social, cultural and geographic factors.
- Internal context
- The organization's internal environment, including governance structure, strategy, resources and capabilities, information systems, culture, and relationships with internal stakeholders.
- Stakeholder expectations
- The needs, demands and tolerance levels of parties affected by or affecting the organization, identified in Learn and used to shape alignment decisions and obligations.
- Risk universe
- A structured inventory of risk categories covering the organization's activities, built in Learn to ensure complete coverage and consistent naming for later assessment and reporting.
- Obligation catalogue
- A consolidated register of external and internal requirements, each with source, owner and criticality, produced in Learn and used to design controls and compliance activities.
- Learn feedback loop
- The continuous re-scanning of context, stakeholders and obligations triggered by changes in law, strategy or environment, which updates inputs used by Align and Perform.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed through qualitative boundaries and quantitative limits set during Align.
- Risk tolerance
- The acceptable variation or deviation from the stated risk appetite for a specific risk category, expressed as thresholds or limits that can be monitored during Perform.
- Align component purpose
- To convert knowledge from Learn into decisions: defining outcomes and strategy, setting appetite and tolerance, assigning accountability, and allocating resources before execution begins.
- Risk owner
- The accountable individual assigned in Align to manage a specific risk, including selecting treatment and ensuring it stays within approved appetite and tolerance levels.
- Control owner
- The person accountable for designing, operating and evidencing a specific control, assigned during Align and responsible for reporting its performance during Perform.
- Policy framework
- A structured hierarchy of policies and standards expressing requirements and boundaries, designed in Align to direct behavior and support the controls executed in Perform.
- Appetite statement
- A formal declaration combining narrative boundaries with measurable limits and thresholds, approved during Align so that breaches can be detected and escalated in Perform.
- Resource allocation
- The Align decision that assigns budget, people and technology to GRC activities and treatments, prioritized by obligation criticality and risk impact on objectives.
- Perform component purpose
- To execute the aligned plan by operating controls, managing risk and compliance events, communicating information, and monitoring performance against the approved appetite and objectives.
- Preventive control
- A control that stops an undesirable event before it occurs, such as an approval gate, segregation of duties, or an access restriction applied during Perform.
- Detective control
- A control that identifies an undesirable event after it has occurred, such as reconciliation, exception report review, or monitoring alert, enabling timely response.
- Risk treatment options
- The four responses available during Perform: avoid the activity, reduce or mitigate the risk, transfer or share it, or accept it with documented rationale and residual risk.
- Residual risk
- The risk remaining after controls and treatments have been applied, recorded during Perform and compared against the approved tolerance to decide whether escalation is required.
- Key risk indicator
- A metric that signals changes in risk exposure during Perform; when it crosses a defined threshold it indicates a possible appetite breach and triggers escalation.
- Incident management
- The Perform process of intake, triage, escalation, root-cause analysis and remediation tracking for compliance breaches and risk events until they are closed.
- Review component purpose
- To evaluate whether the GRC capability is designed and operating effectively, assess performance against objectives and appetite, and drive improvement back into Learn and Align.
- Design effectiveness
- An assessment of whether a control, as designed, would achieve its intended objective if operated properly; it is evaluated during Review before operating effectiveness is tested.
- Operating effectiveness
- An assessment of whether a control actually operated as designed throughout the period under review, supported by evidence captured during Perform.