Appearance
Terminology & Glossary
Terms most often confused
Read these first. Each pair is a distinction OrviQ enforces structurally.
| These are not the same | The difference |
|---|---|
| Asset and Scope | An asset is what exists. A scope is where something applies. Different registers, different questions |
| Applicability and Implementation | Applicability is a scoping decision. It creates an expectation, not a capability |
| Mapping and Compliance | A mapping states design intention. It asserts nothing about operation |
| Evidence availability and Evidence coverage | Availability is "an artefact exists". Coverage is "what proportion of the population does it speak to" |
| Coverage and Effectiveness | You can have complete coverage of a comprehensively failing population |
| Effectiveness and Satisfaction | Effectiveness is about the control. Satisfaction is about the obligation |
| Satisfaction and Disposition | Satisfaction is the objective verdict. Disposition is the organisation's formal position |
| Risk acceptance and Risk elimination | Acceptance is a decision to carry a risk knowingly. The exposure is unchanged |
| Plan approval and Tested resilience | A signed plan is a document. Recovery capability is a demonstrated fact |
| Event, Notification and Task | Something happened; someone may need to know; OrviQ is waiting for a specific person |
| Not assessed and Not satisfied | We do not know, versus we know and the answer is no |
| Criticality and Regulatory classification | Your business dependency test, versus the regulator's materiality test |
| Action completion and Finding closure | Completing remediation is not confirming it worked |
A
Action Plan — A governed remediation commitment (ACT-YYYY-NNNN) with an owner, an approver, a verifier and a due date.
Applicability Determination — A governed decision (APP-YYYY-NNNN) recording whether an obligation applies within a declared scope, with its justification, maker and approver.
Applicability state — Applicable, Not Applicable or Under Review. Independent of governance state.
Assertion — See Evidence Assertion.
Asset — A technology or infrastructure inventory item (AST-YYYY-NNNN): applications, servers, databases, network security devices, cloud workloads, SaaS platforms, identity systems. Business services, third parties and departments are not assets.
Assurance — The degree of confidence, evidenced and reproducible, that controls operate and obligations are met.
Attestation — A person stating that a fact is true, recorded as a first-class evidence assertion with a subject, a state, a timestamp and an attester.
B
BIA — Business Impact Analysis (BIA-YYYY-NNNN). Establishes what happens if a business service stops, and the recovery objectives.
Business Reference — An immutable, human-facing identifier formatted PREFIX-YYYY-NNNN, tenant-scoped, entity-type-scoped, year-scoped and strictly sequential. Never a UUID and never derived from one.
Business Service — The canonical record of a service the organisation provides. The primary subject of operational resilience.
C
Collector — A definition (COL-YYYY-NNNN) of what evidence to gather from a connection, about which subjects, how often.
Collector Run — One execution of a collector (CRN-YYYY-NNNN), producing evidence assertions.
Compensating Control — An alternative mechanism mitigating the same underlying risk where the prescribed control is infeasible. A mapping relationship, not a waiver.
Connection — A configured, credentialed link to an external evidence source (CON-YYYY-NNNN).
Continuous Assurance — The deterministic layer that turns evidence assertions into indicator results and control effectiveness.
Control — A described, owned mechanism that reduces risk or discharges an obligation (CTL-YYYY-NNNN).
Control Element — A single clause within a control, individually mappable, with its own kind and evidence expectation.
Control Origin — Whether a control is organization, reference_external, reference_curated or reference_scf.
Coverage — The proportion of a declared scope population with fresh, evaluated evidence. Always reported with its numerator and denominator.
Crosswalk Mapping — A governed assertion that a control bears a specific semantic relationship to an obligation.
D
Design Adequacy — A governed assessment of whether an approved mapping is adequate by design: if the control operated perfectly, would the obligation be discharged?
Determination — See Compliance Determination under the Requirement Pipeline.
E
Effective applicability — The authoritative applicability of an obligation in a scope at an instant: Applicable, Not Applicable or Under Review.
Engagement — A specific arrangement with a third party (ENG-YYYY-NNNN). The only TPRM object that carries risk.
Evidence Assertion — One observation, about one subject, at one moment, from one source (ASN-YYYY-NNNN). The atomic unit assurance evaluates.
Evidence Fabric — The connected model of registers, connections, collectors, runs, assertions, indicators and results.
Exception — A formal, time-bound, approved decision to deviate from a requirement or control (EXC-YYYY-NNNN).
F
Finding — An identified deficiency (FND-YYYY-NNNN). Canonical across compliance, RCSA, third-party, audit, inspection, incident and resilience sources.
Four-eye — Maker then checker: one person acts, a second independent person approves.
Framework Adoption — The formal statement (FAD-YYYY-NNNN) that a framework is governed within a declared scope for a stated purpose.
Freshness window — How long an evidence assertion remains current.
G
Governance disposition — The organisation's formal position on an obligation: compliant, accepted_deviation, remediation_required or unassessed.
Governance state — How far a decision has progressed: draft, pending_review, approved, rejected.
GRC Calendar — The canonical calendar of meaningful future governance obligations. Technical schedules are deliberately excluded.
I
Indicator — A deterministic rule (IND-YYYY-NNNN) evaluating evidence assertions against a control and a scope.
Indicator Result — One immutable evaluation outcome (INR-YYYY-NNNN) with full counts, the rule applied and a plain-language explanation.
Inherent Risk — Risk before mitigating controls.
Inspection — A supervisory interaction with an external authority (INS-YYYY-NNNN). Distinct from an internal audit engagement.
M
Maker-checker — The rule that the person who does something cannot be the person who approves it.
Mandatory indicator — An indicator whose failure drives control effectiveness to ineffective, regardless of other passing indicators.
MBCO — Minimum Business Continuity Objective. The minimum acceptable capability on resumption.
MTD / MTPD — Maximum Tolerable Disruption. The outage duration causing intolerable harm.
O
Obligation — A single ownable, assignable duty decomposed from a requirement.
Operating Effectiveness — Whether a control actually operated as designed over a period.
P
Population scope — A scope whose denominator is the count of effective-dated members.
Provenance — The record of what produced an artefact: provider, model, prompt version, subject, run and confidence for AI; engine and version for deterministic computation.
Q
Qualitative scope — A scope with a denominator of 1, used for governance facts that have no population.
R
RCSA — Risk and Control Self-Assessment. A campaign running control assessment at scale.
Requirement — A single rule, clause or statutory mandate from a framework.
Requirement Assurance — The five-dimension evaluation producing requirement satisfaction and governance disposition.
Requirement satisfaction — The objective verdict on an obligation: satisfied, partially_satisfied, not_satisfied, not_assessed, not_applicable.
Residual Risk — Risk remaining after mitigating controls.
Resolver — A workflow assignee type that derives the actor from the record, such as owner or owner_department_head.
RPO — Recovery Point Objective. Maximum acceptable data loss window.
RTO — Recovery Time Objective. Maximum acceptable service downtime.
S
Scope — A declared boundary (SCP-YYYY-NNNN) stating what an assurance conclusion applies to. Membership is effective-dated.
Scope Registry — The register of assets and declared scopes, and their effective-dated membership. Core infrastructure, not separately licensed.
Segregation of Duties — See Maker-checker. Enforced at the service layer on every governed decision.
Six-eye — Maker, reviewer, approver: three distinct people.
SoA — Statement of Applicability. Derived live from applicability records, mappings and controls, with historical reconstruction.
Superseded — Replaced by a newer record while remaining available for historical reconstruction. Never deleted.
T
Task family — The normalised grouping an AI interaction belongs to, for provenance.
Third Party — The record of an external organisation (TP-YYYY-NNNN). Carries entity facts, never a risk rating.
Tier — A routing tier determining SLA days and, optionally, workflow template selection.
W
Workbench — The personal queue of governed work, organised into buckets.
Workflow template — The definition of stages, transitions, assignees and segregation points for a governed object type.