Operations Dictionary

The structured tracking and remediation of audit, risk, and compliance issues.

Independent assurance over governance, risk and control effectiveness.

The capability to continue delivering products and services at acceptable levels following a disruption.

A structured analysis of the impact a disruption would have on each critical business process.

The maximum acceptable time to restore a process after disruption.

The maximum acceptable data loss measured in time.

Ongoing surveillance to ensure compliance with regulatory and policy obligations.

US legislation requiring public companies to certify the effectiveness of internal controls over financial reporting.

Structured testing of a control's design and operating effectiveness.

Controls over the IT environment that support the reliable operation of application controls.

The most widely used internal control framework — five components and seventeen principles.

A control whose failure would result in a material risk being unmitigated.

The risk of loss from inadequate or failed processes, people, systems, or external events.

A forward-looking metric used to monitor changes in risk exposure.

A structured process where business lines assess their own risks and controls.

A risk governance model separating business ownership, oversight, and independent assurance.

A realised operational risk event that resulted in actual loss.

A documented, repeatable instruction for performing an operational task.

The structured response to operational incidents from detection through resolution and learning.

A contractual commitment between provider and customer on the level of service delivered.

A quantifiable measure of performance against a strategic or operational objective.

A structured method for identifying the underlying cause of an incident or defect.

A visual and structural representation of how a process is performed end-to-end.

The ability of a firm to deliver important business services through disruption.

A service whose disruption could cause intolerable harm to customers or the market.

The maximum tolerable disruption to an Important Business Service before causing intolerable harm.

The risk to an organisation arising from its use of external vendors.

The risk arising from any external party that has access to data, systems, or critical processes.

The risk arising from over-reliance on a single vendor, system, geography or counterparty.