Terminology & Glossary

Authoritative glossary of compliance and platform terms used in OrviQ.

---

• Assurance: The degree of confidence that internal controls are operating effectively and meeting regulatory obligations over time.
• Business Reference: An immutable, human-facing identifier formatted as PREFIX-YYYY-NNNN.
• Compensating Control: An alternative control measure implemented to mitigate risk when standard compliance controls are technically or operationally infeasible.
• Continuous Assurance: The automated, ongoing evaluation of evidence freshness, control health, and testing cadences.
• Crosswalk Mapping: A documented semantic relationship linking a regulatory obligation to an internal control.
• Design Adequacy: The assessment of whether a control's design, if executed as specified, would satisfy an obligation.
• Evidence Fabric: The integrated data repository holding verified proof artifacts linked across controls, requirements, and audits.
• Governed Exception: A time-bound, approved waiver permitting temporary non-compliance with a policy or control under strict compensating controls.
• Inherent Risk: The level of risk present before the application of mitigating controls.
• Operating Effectiveness: The assessment of whether a control actually functioned properly throughout the audit period.
• RCSA (Risk & Control Self-Assessment): A periodic campaign where business units evaluate their own risk exposure and control health.
• Residual Risk: The remaining risk exposure after accounting for the mitigating effect of active controls.
• Scope Registry: The governance registry recording which regulatory requirements apply to the organization and why.
• Segregation of Duties (SoD): The principle preventing a single individual from possessing conflicting permissions across critical workflows (e.g., Maker-Checker).