GRC glossary
The terms that come up in any risk, security or compliance project, explained in a few lines.
A
- Action plan
A set of tasks with an owner and a due date to treat a risk, close a finding or correct a nonconformity. Following it up shows the organization is improving.
Related: Risk mitigation
- AI governance
The policies, roles and controls to build and use artificial intelligence systems safely, ethically and lawfully. It includes the system inventory, risk classification and oversight.
Related: AI governance
- Audit finding
The result of comparing evidence against a criterion. It can be a nonconformity, an observation or an opportunity for improvement, and usually leads to an action plan.
Related: Audit management
B
- Business continuity plan (BCP)
A document describing how to keep or recover critical processes after a serious disruption: who decides, what is activated and in what order.
Related: Business continuity
- Business impact analysis (BIA)
A study that identifies the critical processes, how long each can be down and what resources it needs to recover. It produces the RTO, the RPO and the priorities of the continuity plan.
Related: Business continuity
C
- Certification audit
A review by an accredited body to confirm that a management system meets a certifiable standard such as ISO 27001 or ISO 22301. Passing it grants the certificate, which is kept through surveillance audits.
Related: Audit management
- COBIT
ISACA’s framework for the governance and management of information technology. It aligns IT objectives with business goals and defines processes, responsibilities and metrics.
Related: COBIT
- Compensating control
An alternative control used when the intended one is not feasible. It must cover the same risk with an equivalent level of protection, and the reason for choosing it should be documented.
Related: Internal controls
- Compliance (Regulatory compliance)
The policies, controls and owners that ensure the organization meets the law, the standards it has adopted and its own ethical commitments. Its aim is to prevent penalties and reputational damage.
Related: Compliance
- Confidentiality, integrity and availability (CIA triad)
The three properties information security protects: only the right people get access, data is not changed without control, and it is available when needed.
Related: Information security
- Control
A measure that reduces the likelihood or impact of a risk. It can be technical (encryption, backups), organizational (a policy, segregation of duties) or physical (building access control).
Related: Internal controls
- Control mapping
Linking one control to the requirements of several standards (for example ISO 27001, NIS2 and DORA) so it is implemented and evidenced only once.
Related: Regulatory compliance
- COSO
Frameworks from the Committee of Sponsoring Organizations of the Treadway Commission. COSO Internal Control defines five components of control; COSO ERM extends that approach to enterprise-wide risk management.
Related: COSO ERM
- Critical infrastructure
Facilities or systems essential to vital services such as energy, water or transport. In the EU, the CER Directive sets the obligations of critical entities.
Related: Critical infrastructure protection
- CSRD
Directive (EU) 2022/2464 on corporate sustainability reporting. Companies in scope must report using the ESRS standards and have that report assured.
Related: CSRD
- Cyber resilience
The ability to keep delivering services during a cyberattack and to recover afterwards. Besides prevention, it covers detection, response, recovery and learning from what happened.
Related: DORA
D
- Data processor
A person or organization that processes personal data on behalf of another, the controller. The relationship between them is governed by the data processing agreement the GDPR requires.
Related: Privacy
- Data protection impact assessment (DPIA)
A prior analysis the GDPR requires when processing is likely to result in a high risk to people, for example large-scale health data or systematic monitoring.
Related: GDPR
- Data protection officer (DPO)
The role that monitors GDPR compliance, advises the organization and acts as the contact point with the supervisory authority. It is mandatory for public bodies and for some large-scale processing.
Related: GDPR
- Disaster recovery plan (DRP)
The technical side of continuity: how to restore systems and data after a disaster within the agreed RTO and RPO.
Related: ISO 27031
- DORA (Digital Operational Resilience Act)
Regulation (EU) 2022/2554, applicable since January 2025 to banks, insurers, asset managers and other financial entities. It covers ICT risk management, incident reporting, resilience testing and ICT third-party risk.
Related: DORA
- Double materiality
A CSRD principle: a sustainability topic is material if the company affects people or the environment (impact materiality) or if it affects the company’s results (financial materiality). Either one is enough.
Related: ESG and sustainability
- Due diligence
The review carried out before and during a relationship with a third party (supplier, partner, customer) to understand its financial, security, compliance or reputational risks.
Related: Third-party risk
E
- Enterprise risk management (ERM)
An approach that manages all of the organization’s risks (strategic, financial, operational, compliance) with one method and a single overall view, instead of department by department.
Related: Risk management
- ESG
Short for environmental, social and governance. The non-financial criteria investors, customers and regulators use to assess a company.
Related: ESG and sustainability
- ESRS
The European Sustainability Reporting Standards. They define what data, and in what format, companies subject to the CSRD must disclose.
Related: CSRD
- EU AI Act
Regulation (EU) 2024/1689, the first general law on artificial intelligence. It classifies systems by risk level: it bans some uses, imposes strict obligations on high-risk systems and requires transparency for others.
Related: EU AI Act
- Evidence
Proof that a control has been performed: a log, a screenshot, minutes or a report. Without evidence, as far as the auditor is concerned, the control does not exist.
Related: Audit management
G
- Gap analysis
A comparison between what the organization does today and what a standard or regulation requires. The result is the list of uncovered requirements and the plan to close them.
Related: Regulatory compliance
- GDPR (General Data Protection Regulation)
Regulation (EU) 2016/679, which governs the processing of personal data in the European Union. It requires a legal basis, transparency, security and demonstrable accountability.
Related: GDPR
- GRC (Governance, risk and compliance)
A way of working that brings corporate governance, risk management and regulatory compliance into one model, with shared data instead of isolated spreadsheets.
Related: GRC platform
I
- ICT third-party service provider
Under DORA, a company that provides digital or data services to a financial entity. The entity must assess it, record it in its register of information and plan an exit strategy.
Related: Third-party risk
- Incident management
The process to detect, log, classify, resolve and learn from incidents. Under DORA, NIS2 and the GDPR it also means notifying the regulator on time.
Related: Incident management
- Information asset
Anything of value to the organization that needs protecting: data, applications, servers, key people or facilities. The asset inventory is the starting point of any risk analysis.
Related: Information security
- Information classification
Assigning each piece of information a level (public, internal, confidential, restricted…) based on the harm its disclosure would cause. Each level has its own rules for access, sharing and disposal.
Related: ISO 27001
- Inherent risk
The level of risk before any control is applied. It shows the real exposure if nothing worked.
Related: Risk management
- Internal audit
An independent function that checks whether controls, risk management and governance work as they should. It reports to the board or the audit committee.
Related: Audit management
- Internal control
A process designed by management to provide reasonable assurance about the reliability of information, the effectiveness of operations and compliance with rules. The most widely used framework is COSO.
Related: Internal controls
- ISMS (Information security management system)
The policies, processes and controls an organization uses to manage the security of its information systematically and with continual improvement. It is what ISO 27001 certifies.
Related: ISO 27001
- ISO 22301
The certifiable international standard for business continuity management systems. It requires analyzing impact, defining recovery strategies and testing the plans.
Related: ISO 22301
- ISO 27001
The certifiable international standard for information security management systems (ISMS). It is built on a risk assessment and an annex of controls that must be applied or justified.
Related: ISO 27001
- ISO 27701
An extension of information security management to privacy. It helps demonstrate compliance with the GDPR and other data protection laws.
Related: ISO 27701
- ISO 31000
International guidelines for risk management in any type of organization. It is not certifiable: it describes principles, a framework and a process.
Related: ISO 31000
- ISO 37001
The certifiable standard for anti-bribery management systems. It requires assessing bribery risk, controlling third parties and providing channels to raise concerns.
Related: ISO 37001
K
- Key risk indicator (KRI)
A metric that warns a risk is growing before it materializes, such as the number of open critical vulnerabilities or turnover in a key role. It is given alert thresholds.
Related: Risk management
M
- MTPD (Maximum tolerable period of disruption)
The time after which a stopped process causes unacceptable harm to the organization. The RTO must always be shorter.
Related: Business continuity
N
- NIS2
Directive (EU) 2022/2555 on cybersecurity. It widens the sectors in scope, requires risk management measures, makes management accountable and sets incident reporting deadlines: an early warning within 24 hours and a notification within 72.
Related: NIS2
- NIST CSF
The US NIST Cybersecurity Framework, used worldwide. It organizes cybersecurity into six functions: govern, identify, protect, detect, respond and recover.
Related: NIST CSF
- Nonconformity
A failure to meet a requirement of the standard or of the management system itself. It is graded major or minor and calls for root cause analysis and a corrective action.
Related: Audit management
O
- Operational resilience
An organization’s ability to keep delivering its important services through any disruption, whether technological, caused by a supplier or physical.
Related: DORA
- Operational risk
Losses caused by failed processes, people or systems, or by external events. It is one of the risks banking and insurance supervisors watch most closely.
Related: Banking
P
- PCI DSS
The payment card industry security standard. Anyone who stores, processes or transmits cardholder data must comply with it.
Related: PCI DSS
- Personal data breach
An incident that leads to the destruction, loss, alteration or unauthorized access to personal data. Under the GDPR, if it poses a risk to people it must be reported to the supervisory authority within 72 hours.
Related: Privacy
- Privacy by design
A GDPR principle that requires data protection to be considered from the moment a product, service or process is conceived, not at the end.
Related: Privacy
Q
- Quantitative risk
Analysis that expresses risk in money rather than color scales, usually by simulating thousands of scenarios with the Monte Carlo method. It answers questions like “how much could we lose in a year?”.
Related: Quantitative Risk
R
- Record of processing activities (RoPA)
The inventory the GDPR requires of each personal data processing operation: purpose, data categories, recipients, retention periods and security measures.
Related: GDPR
- Residual risk
The risk that remains after controls are applied. If it is still above risk appetite, treatment must be strengthened or the risk explicitly accepted.
Related: Risk management
- Risk and control matrix (RCM)
A table that links each risk to the controls that mitigate it, their owner, frequency and expected evidence. It is the basis for reviewing internal control.
Related: Internal controls
- Risk appetite
The level of risk management is willing to take on to achieve its objectives. It is set in writing and used to decide which risks are accepted and which must be treated.
Related: Risk management
- Risk assessment
The process of identifying risks, analyzing them (likelihood and impact) and evaluating them against risk appetite to decide which ones to treat first.
Related: Risk management
- Risk dashboard
A view that brings together risks, their indicators and the status of action plans, so management can see at a glance where exposure sits and how it is evolving.
Related: Reports
- Risk heat map
A likelihood-by-impact matrix where each risk sits in a colored cell. It shows at a glance which risks are critical and lets you compare inherent and residual risk.
Related: Risk management
- Risk owner
The person with the responsibility and authority to manage a specific risk. They decide its treatment and answer for how it evolves.
Related: Risk management
- Risk tolerance
The acceptable deviation from risk appetite for a specific objective. It turns the broader appetite into measurable limits.
Related: Risk management
- Risk treatment
The decision on what to do with a risk: reduce it with controls, transfer it (with insurance, for example), avoid it by stopping the activity, or accept it.
Related: Risk mitigation
- RPO (Recovery point objective)
The maximum amount of data that can be lost, measured in time. A four-hour RPO means backups can be at most four hours older than the incident.
Related: Business continuity
- RTO (Recovery time objective)
The maximum time to restore a process or system after a disruption. It comes from the business impact analysis and must be shorter than the MTPD.
Related: Business continuity
S
- Security policy
A document approved by management that sets the objectives and rules for information security. Everything else (standards, procedures, controls) derives from it.
Related: Information security
- Segregation of duties
Splitting between different people the tasks that, in one person’s hands, would allow them to make and hide an error or fraud, such as approving a payment and recording it.
Related: Internal controls
- SOX (Sarbanes-Oxley Act)
A 2002 US law for companies listed in the United States and their subsidiaries. Section 404 requires assessing and certifying internal control over financial reporting.
Related: SOX
- Statement of Applicability (SoA)
A mandatory ISO 27001 document that lists the Annex A controls, states which ones apply and justifies any exclusions. It is one of the first things the auditor looks at.
Related: ISO 27001
T
- Third-party risk (TPRM)
Risk that comes through suppliers, partners or subcontractors. It is managed by assessing them before signing, monitoring them during the relationship and planning the exit.
Related: Third-party risk
- Threat
A potential cause of an incident that can harm an asset: a ransomware attack, human error, a power cut or a flood. When a threat meets a vulnerability, you have a risk.
Related: Risk management
- Three lines model
How risk management roles are split: the first line (operations) manages risk, the second (risk and compliance) oversees it and the third (internal audit) gives independent assurance.
Related: Audit management
V
- Vulnerability
A weakness in an asset or a control that a threat can exploit, such as unpatched software or a shared password.
Related: Information security
W
- Whistleblowing channel (Internal reporting channel)
A confidential way to report wrongdoing inside the organization. The EU Whistleblower Directive (2019/1937) makes it mandatory for the public sector and for companies with 50 or more employees.
Related: Whistleblowing channel