SIDC Module 18 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Unverified domain scope

A domain whose published content outline was not available in the retrieved source. Topic mappings to it are provisional and must be flagged for review rather than treated as authoritative.

Authoritative syllabus

The exam body's own published objectives and weighting table. It outranks third-party summaries, course notes, and forum discussion when deciding what a module covers.

In-scope classification

A triage label for candidate topics: in-scope if named in the syllabus, adjacent if implied by a named topic, out-of-scope if neither. Revision effort follows that order.

Source anchor

The document title and section that supports a recorded fact. It allows the fact to be re-checked when an official outline or corrected source is published.

Null knowledge record

A field left empty because the fact was not confirmed with confidence. It signals that review is needed and never asserts that the fact is false.

Review trigger

An event that forces re-validation of study material, such as publication of the official outline, a weighting change, or a corrected source contradicting a recorded fact.

Three lines model

A governance structure: the first line owns and manages risk, the second sets frameworks and monitors, and the third provides independent assurance. It separates ownership from assurance.

Likelihood-times-impact scoring

A risk score produced by multiplying likelihood by impact, often on a five-by-five matrix giving scores from one to twenty-five, compared against tolerance thresholds.

Inherent versus residual risk

Inherent risk is exposure before controls; residual risk is exposure after controls. Control effectiveness is the difference between them, not the residual score on its own.

Preventive control

A control that stops an unwanted event before it occurs, such as an approval gate, an access restriction, or an input validation rule applied at entry.

Detective control

A control that identifies an event after it has occurred, such as a reconciliation, an exception report, or a log review performed on a defined cycle.

Corrective control

A control that restores normal service or limits damage after an event, such as a restore from backup, a failover, or a remediation plan with an owner.

Directive control

A control that specifies required behaviour rather than enforcing it mechanically, such as a policy, a standard, or a mandatory procedure that staff must follow.

Segregation of duties

A preventive control requiring that no single person initiates, approves, records, and reconciles the same transaction. Compensating controls apply where headcount prevents full separation.

Key risk indicator

A leading metric with a defined threshold, an owner, and an escalation path. Without those three elements it is a data point, not an actionable indicator.

Audit finding structure

A finding states criteria, condition, cause, effect, and recommendation. A finding without a testable criterion is an opinion rather than an auditable observation.

Exception and waiver record

A documented acceptance of a deviation stating the risk accepted, the approver, the expiry date, and any compensating control. Undocumented exceptions become permanent exposures.

Evidence hierarchy

A ranking of evidential weight: system-generated records outrank screenshots, screenshots outrank verbal confirmation, and verbal confirmation should be corroborated before reliance.

Attribute sampling

A sampling approach that tests whether a control operated on each selected item, producing a yes-or-no result per item and a deviation rate for the population.

Variables sampling

A sampling approach that estimates a numeric value or total for a population, in contrast to attribute sampling, which tests only whether a control operated.

Tolerable deviation rate

The maximum rate of control failures that can be accepted while still relying on the control. A higher tolerable rate permits a smaller sample for the same confidence.

Chain of custody

A record of who collected evidence, when, from which system, by what method, and where it is stored. A break in the chain reduces evidential weight.

Data minimisation

Collecting only the fields needed for the stated purpose, recording the lawful basis, and setting a retention period with a deletion trigger at collection time.

Reproducibility test

A check that a second person using the same inputs and documented method reaches the same result. Failure indicates the method is underspecified rather than the person is wrong.

Document version control

A unique identifier, author, reviewer, approval date, and change log attached to a document. An undated document cannot be shown to be the current version.

Register entry completeness

A register entry is complete when it names an owner, a due date, a status, and a linked piece of evidence. Missing any element makes follow-up untestable.

BEST and FIRST stems

Question wording that tests prioritisation. Options that are true but not the highest-priority action in the stated sequence are distractors, not answers.

Scope discriminator

The tiebreaker when two options are both generally correct: ask which one addresses the risk or objective actually stated in the question stem.

Sequence discriminator

The tiebreaker when two options are both valid actions: ask which must occur earlier, since an exam item asking for the first step rewards the preceding action.

Formula-first method

Writing the formula before substituting numbers in a quantitative item, so that unit errors and order-of-magnitude mistakes become visible before an answer is selected.

Common distractor patterns

Recurring traps: a detective control described as preventive, transfer described as avoidance, and a lagging metric described as leading. Checking these eliminates wrong options quickly.

Weighted time allocation

Splitting revision and in-exam time in roughly the proportion of each domain's stated exam weighting, rather than equally across all domains.

Flag-and-return

Marking an item that depends on an unverified fact and returning to it later, so that time is first spent on items that verified knowledge can answer.