INMT 341: Business Process Analysis Glossary

Complete set of vocabulary flashcards covering key terms and concepts in business process analysis, risk management, internal controls, and technology governance from INMT 341.

Business objective

A result an organization, process, or activity is intended to accomplish.

Risk

Uncertainty that can affect achievement of an objective.

Risk factor

A condition or circumstance that contributes to the possibility or significance of a risk.

Risk event

A specific event or circumstance that could affect achievement of an objective.

Impact

The consequence to an organization if a risk event occurs.

Likelihood

The possibility or probability that a risk event will occur.

Risk assessment

The process of identifying and evaluating risks so they can be prioritized and managed.

Inherent risk

The level of risk that exists before considering the effects of controls or other risk responses.

Risk response

Management's decision about how to address an identified risk.

Accept

A risk response in which management retains a risk without taking additional action because the exposure is considered acceptable under the circumstances.

Reduce

A risk response in which management takes action to decrease the likelihood of a risk event, its impact, or both.

Share or transfer

A risk response in which part of the consequences of risk is distributed or shifted to another party.

Avoid

A risk response in which the organization stops or changes an activity so that a particular exposure no longer exists or is substantially eliminated.

Risk appetite

The broad amount and type of risk an organization is willing to pursue or retain while pursuing its objectives.

Risk tolerance

The acceptable degree of variation around a particular objective or performance target.

Control

An action, process, policy, procedure, or technology used to help manage risk and support achievement of objectives.

Control objective

The result a control or group of controls is intended to help achieve.

Preventive control

A control intended to stop or reduce the likelihood of an undesirable event before it occurs.

Detective control

A control intended to identify an undesirable event or condition that has occurred.

Corrective control

A control intended to correct a problem, limit its effects, or restore appropriate operations after an undesirable event has occurred.

Segregation of duties

Separation of incompatible responsibilities so that one person does not control enough aspects of a transaction to both create and conceal an inappropriate action easily.

Authorization

Approval by an appropriate individual or system permitting an activity or transaction to proceed.

Control design

Whether a control, if performed as intended, is capable of addressing the identified risk.

Operating effectiveness

Whether a control operates as intended in practice.

Control deficiency

A weakness in the design or operation of a control that reduces the control's ability to address the relevant risk.

Reasonable assurance

A high, but not absolute, level of confidence that objectives will be achieved or risks appropriately managed.

Residual risk

The risk remaining after management considers controls and other risk responses.

Reconciliation

The comparison of information from different sources to identify and investigate differences.

Three-way match

A comparison of purchase-order, receiving, and vendor-invoice information before payment is approved or processed.

Exception

A transaction, event, or condition that falls outside established criteria or expectations and may require additional attention.

Exception report

A report identifying transactions or conditions that fall outside established criteria and require review.

Internal control

A process carried out by people throughout an organization and designed to provide reasonable assurance regarding achievement of objectives.

Entity-level control

A control that operates broadly across an organization or substantial parts of it rather than within only one transaction process.

Process-level control

A control that operates within a particular business process or activity.

Control environment

The standards, structures, expectations, and accountability that provide the foundation for internal control throughout an organization.

Control activities

Actions established through policies and procedures that help carry out management's responses to risk.

Information and communication

The processes used to obtain, use, and share information needed to carry out responsibilities and support achievement of objectives.

Monitoring activities

Ongoing or periodic evaluations used to determine whether components of internal control are present and functioning.

Enterprise risk management (ERM)

An organization-wide approach for considering risk in relation to governance, strategy, objectives, and performance.

Governance

The structures and processes through which direction, oversight, accountability, and significant organizational decisions are established.

COSO Internal Control - Integrated Framework

A framework that organizes internal control around five integrated components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COSO Enterprise Risk Management

A framework that integrates risk with governance, strategy, objective- setting, performance, review, and reporting.

Technology risk / IT risk

Uncertainty arising from an organization's use of and dependence on information and technology that can affect business objectives.

Third-party risk

Risk arising from dependence on suppliers, vendors, service providers, or other external organizations.

Information security

Protection of information and information systems with particular attention to confidentiality, integrity, and availability.

Confidentiality

Protection of information from access or disclosure to unauthorized people or systems.

Integrity

Protection of the accuracy, completeness, and appropriate modification of information.

Availability

The ability to access and use information and systems when they are needed.

Business continuity

The organization's ability to continue critical business activities during and after a disruption.

Disaster recovery

The processes used to restore technology infrastructure, systems, applications, and data after a significant disruption.

Resilience

The ability to prepare for disruption, withstand it, adapt while it occurs, and recover afterward.

Application control

A control built into or closely associated with a particular application or business process to support authorized, complete, accurate, and valid processing.

IT general controls (ITGCs)

Controls that operate broadly across the technology environment and support the reliable operation of systems, applications, and automated controls.

Authentication

The process of verifying the identity of a user, device, or system.

Least privilege

The principle of limiting access to the permissions reasonably necessary to perform assigned responsibilities.

Privileged access

Elevated system authority that permits sensitive administrative or configuration activities.

Change management

A controlled process for requesting, assessing, testing, approving, implementing, and documenting changes to technology.

Backup

A separate copy of information that can be used if original data are lost, corrupted, or unavailable.

NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)

A cybersecurity risk-management framework organized around six concurrent and continuous Functions: Govern, Identify, Protect, Detect, Respond, and Recover.

COBIT 2019

A framework developed by ISACA for the governance and management of enterprise information and technology.

ISO 31000:2018

An international standard that provides principles, a framework, and a process for managing risk across organizations and types of risk.

ISO/IEC 27001:2022

An international standard that defines requirements for an information security management system.

Information security management system (ISMS)

A structured management system for establishing, implementing, maintaining, and continually improving information security and managing related risks.

Strategic risk

Risk that can affect the organization's strategy, competitive direction, or ability to achieve long -term objectives.

Operational risk

Risk arising from people, processes, systems, or external events involved in day-to-day operations.

Financial risk

Risk involving cash flows, financing, credit, markets, or other financial resources.

Compliance and legal risk

Risk of failing to meet laws, regulations, contracts, policies, or other obligations.

Reputational risk

Risk that stakeholder trust or confidence may be damaged.

Cybersecurity risk

Potential adverse effects arising from threats to information, systems, networks, or technology-enabled operations.

Manual control

A control performed primarily through human action or judgment.

Automated control

A control performed by technology according to programmed rules or configurations.

Risk owner

The person or group with responsibility and authority for managing a particular risk.

Decomposition

Taking the processes on data flow diagram and dividing each into more detailed subprocesses

Primitive DFDs

resulting DFD when you have decomposed processes into most detailed (lowest level) DFDs

Balancing

The process of ensuring that input and output flows remain consistent between different levels of data flow diagrams (DFDs) after decomposition

Black hole

A process that only has inputs

Business Process Modeling Notation (BPMN)

a method of illustrating business processes in the form of a diagram similar to flowcharts and UML activity diagrams

Context diagram

least detailed level of data flow diagramming; one process labelled with 0; shows only major info flows btwn systems and external parties (sources/sinks)

Data flows

lines w/ directional arrows that display the route of data inflow and outflow

Data sources and sinks

source = origin of data inflow (sinks = destination of info outflow)

Data flow diagrams (DFDs)

graphically display the movement of data thru a process; disregard physical attributes

Document flowcharts

focus on creation, flow, and destinations of documents and info within a system

System flowcharts

show the entire system configuration, including data inputs, data outputs, and processes of a system, and the relationship between system inputs, processes, and outputs

Program flowcharts

show the logic and processing steps of a computer program or code

Flowcharts

method of documenting processes and systems; focus on physical aspects

Information Process

collecting and using data

Data store

data at rest; collection of data (physical or online files)

Level zero DFDs

the single process is broken down into major process steps that use the input and output from the sources and sinks shown on the context diagram and data stores are added to the details shown (should show same sources and sinks as context level)

Level 1, 2, etc.

more detail; only time processes can have only inputs or outputs

Unified modeling language

standardized notation for modeling real-world objects (business modeling, system development, etc.)