Glossary

CISA and CISM glossary: key audit, risk and security terms with plain-English definitions, real-world examples and how each is tested.

• Audit charter — CISA
• Engagement letter — CISA
• Audit risk — CISA
• Inherent risk — CISA & CISM
• Control risk — CISA
• Detection risk — CISA
• Residual risk — CISA & CISM
• Materiality — CISA
• Compliance testing — CISA
• Substantive testing — CISA
• Attribute sampling — CISA
• Variable sampling — CISA
• Discovery sampling — CISA
• Stratified sampling — CISA
• Integrated test facility (ITF) — CISA
• Parallel simulation — CISA
• Embedded audit module — CISA
• Control self-assessment (CSA) — CISA
• Compensating control — CISA & CISM
• Segregation of duties — CISA & CISM
• Least privilege — CISA & CISM
• Data owner — CISA & CISM
• Data custodian — CISA & CISM
• Risk appetite — CISA & CISM
• Risk tolerance — CISM
• Key risk indicator (KRI) — CISA & CISM
• Key performance indicator (KPI) — CISA & CISM
• Annualized loss expectancy (ALE) — CISM
• Risk transfer — CISA & CISM
• Risk avoidance — CISA & CISM
• Business impact analysis (BIA) — CISA & CISM
• Recovery time objective (RTO) — CISA & CISM
• Recovery point objective (RPO) — CISA & CISM
• Maximum tolerable downtime (MTD) — CISA & CISM
• Hot site — CISA & CISM
• Warm site — CISA & CISM
• Cold site — CISA & CISM
• Reciprocal agreement — CISA
• Full interruption test — CISA
• Parallel test — CISA
• Tabletop exercise — CISA & CISM
• Change management — CISA & CISM
• Emergency change — CISA
• Problem management — CISA & CISM
• Known error — CISA
• Service level agreement (SLA) — CISA & CISM
• SOC 2 Type 2 report — CISA & CISM
• Complementary user entity controls — CISA & CISM
• Right to audit — CISA & CISM
• Source code escrow — CISA

Next page