Compliance knowledge explained

GRC & Security Glossary

Navigate the jungle of compliance terms with confidence. We explain the key concepts from A for Audit to Z for Zero Trust, practical and interconnected.

ABCIMR
A

Audit Trail→

An audit trail is a chronological record of activities used to track changes and access within a system. It helps ensure data transparency and supports compliance with regulatory requirements.

Auditor→

An auditor is an independent examiner who assesses whether a company's processes, systems and controls meet the requirements of a specific standard (such as ISO 27001 or SOC 2).

B

Business Continuity Management (BCM)→

Business continuity management (BCM) is a holistic management process that ensures critical business processes can be maintained or restored quickly even during severe disruptions or disasters.

Business Impact Analysis (BIA)→

A method for assessing the time criticality of business processes. The BIA determines the impact of outages and defines recovery objectives (RTO/RPO).

C

Continuous Auditing→

Continuous auditing is a process for continuously assessing financial information and control processes. Its goal is to provide timely audit results that minimize risk and safeguard compliance.

I

Internal Audit Plan→

An internal audit plan is a structured guide for carrying out internal audits within an organization. It describes objectives, scope, methods and schedules to assess risks and review the effectiveness of controls.

ISO Audit→

An ISO audit is a systematic, independent and documented review of whether a management system (for example ISO 27001 for information security or ISO 9001 for quality) meets the requirements of the respective standard. There are three audit types: internal audit, certification audit and surveillance audit.

M

Maximum Tolerable Period of Disruption (MTPD)→

The maximum tolerable period of disruption (MTPD) is the point in time after which the interruption of a business process causes unacceptable or existentially threatening consequences for the organization.

Minimum Business Continuity Objective (MBCO)→

The minimum business continuity objective (MBCO) defines the minimum level of output a business process must deliver in emergency operation after a disruption.

R

Risk-Based Auditing→

Risk-based auditing is an approach that focuses on the risks that could impair the achievement of company objectives. It prioritizes audit processes based on the potential impact of risks.

RTO & RPO→

Central metrics in BCM: the RTO (Recovery Time Objective) defines the maximum time until recovery, the RPO (Recovery Point Objective) the maximum tolerable data loss.