Audit glossary
52 terms that come up again and again on CISA, CIA and AAIA, each with a plain definition and how the exam tests it.
No terms match. Try a different word.
A
- AI governanceThe policies, roles and oversight that keep AI use accountable.
- AI inventoryA register of every AI system in use, with owner and risk rating.
- Assurance and advisory servicesGiving an independent opinion, versus helping management improve.
- Audit evidenceThe information an auditor relies on to support a conclusion.
- Audit riskThe risk of reaching the wrong conclusion about what you audited.
- Audit trailA record that lets you reconstruct who did what, and when.
B
- Bias and fairnessWhether an AI system treats groups of people unfairly.
- Business impact analysis (BIA)Working out which processes matter most and how fast they must recover.
C
- Change managementControlling how changes reach production systems.
- Chief audit executive (CAE)The person who leads the internal audit function.
- Compensating controlA control that reduces a risk when the preferred control isn’t possible.
- COSO ERM frameworkCOSO’s framework linking risk management to strategy and performance.
- COSO Internal Control frameworkFive components and 17 principles of effective internal control.
D
- Data drift and model driftWhen a model gets worse because the world changed, not the code.
- Data lineage and provenanceWhere data came from and what happened to it on the way.
- Data poisoningCorrupting training data to manipulate a model.
- Digital signatureProof of who sent a message and that it wasn’t changed.
E
- Elements of a findingCriteria, condition, cause, effect, and the recommendation.
- EU AI ActThe EU’s risk-based law on AI, in force since August 2024 and applied in phases.
- ExplainabilityBeing able to say why an AI system produced a given output.
F
- Fraud red flagsWarning signs that fraud may be happening.
- Fraud trianglePressure, opportunity and rationalisation.
- Full, incremental and differential backupsThree ways to back up, with different restore effort.
G
- Global Internal Audit StandardsThe IIA’s standards for internal auditing, effective 9 January 2025.
- GovernanceHow an organisation is directed, controlled and held to account.
H
- HallucinationConfident but false output from a generative AI model.
- Hot, warm and cold sitesAlternate processing sites, from ready-to-run to an empty room.
- Human in the loopA person reviews or can override an AI system’s decisions.
I
- Incident and problem managementRestoring service fast, versus fixing the underlying cause.
- Independence and objectivityIndependence is about the function’s position; objectivity is about the auditor’s mindset.
- Internal audit charterThe document that sets internal audit’s mandate, authority and position.
- ISO/IEC 42001The international standard for an AI management system.
L
- Least privilegeGiving each user only the access their job needs.
M
- MaterialityHow significant a matter is to the people relying on the audit.
- Model monitoringWatching a live model’s inputs, outputs and performance.
N
- NIST AI Risk Management FrameworkA voluntary US framework with four functions: Govern, Map, Measure, Manage.
P
- Post-implementation reviewChecking, after go-live, whether a project delivered what it promised.
- Prompt injectionText that tricks a language model into ignoring its instructions.
Q
- Quality assurance and improvement program (QAIP)How internal audit checks and improves the quality of its own work.
R
- Recovery point objective (RPO)The most data, measured in time, the business can afford to lose.
- Recovery time objective (RTO)How quickly a system must be running again after a disruption.
- Risk acceptanceWhen management decides to live with a risk instead of fixing it.
- Risk appetiteHow much risk an organisation is willing to take in pursuing its goals.
- Risk-based internal audit planThe plan of audit work, built from the organisation’s strategy and risks.
- Root cause analysisFinding why a problem happened, not just what happened.
S
- Sampling (statistical and judgemental)Testing part of a population to conclude about the whole.
- Segregation of dutiesSplitting key steps of a process so no one person can both commit and hide an error or fraud.
- Symmetric and asymmetric encryptionOne shared key versus a public/private key pair.
T
- Three lines modelHow governance, management and internal audit share roles in managing risk.
- Training, validation and test dataSeparate datasets to build, tune and fairly measure a model.
U
- User acceptance testing (UAT)Business users confirming a system does what they need before go-live.
- User access reviewA periodic check that everyone’s access is still right.