Acronyms & Definitions: Difference between revisions
| (3 intermediate revisions by the same user not shown) | |||
| Line 2: | Line 2: | ||
{| class="wikitable" | {| class="wikitable" | ||
! Acronym !! Full Term !! Description | ! Acronym !! Full Term !! Description | ||
|- | |||
|'''ARS''' | |||
|Arizona Revised Statute | |||
|Documents all Arizona state laws | |||
|- | |||
|'''CAP''' | |||
|Corrective Action Plan | |||
|Process for identifying and resolving issues | |||
|- | |||
|'''FMFIA''' | |||
|Federal Managers' Financial Integrity Act | |||
|Law requiring internal controls | |||
|- | |||
|'''GAO''' | |||
|Government Accountability Office | |||
|Federal audit and evaluation agency | |||
|- | |- | ||
| '''MC''' || Maricopa County || Arizona's most populous county | | '''MC''' || Maricopa County || Arizona's most populous county | ||
| Line 13: | Line 29: | ||
| '''PRR''' || Public Records Request || Request for government documents | | '''PRR''' || Public Records Request || Request for government documents | ||
|- | |- | ||
| ''' | | '''SOS'''|| Secretary of State||Responsible for statewide elections | ||
|- | |- | ||
| '''SOX''' || Sarbanes-Oxley Act || Federal law requiring internal controls | | '''SOX''' || Sarbanes-Oxley Act || Federal law requiring internal controls | ||
|- | |- | ||
| | | || || | ||
|- | |- | ||
| | | || || | ||
|} | |} | ||
=== Definitions === | === Definitions === | ||
==== Green Book Definitions ==== | |||
'''application control activities''': Automated control activities that are incorporated directly into application software to achieve the completeness, accuracy, and validity of transactions and data; application controls include control activities over input, processing, and output of data (paragraph 10.07) | |||
'''attributes''': Provide further explanation of the principles and may also contain minimum documentation requirements. Management considers attributes when designing, implementing, and operating the associated principles (paragraph OV2.08) | |||
'''baseline''': The current state of the internal control system compared against management's design of the internal control system; it represents the difference between the criteria for the design of the internal control system and the condition of the internal control system at a specific point in time (paragraph 16.02) | |||
'''business processes''': Processes established across the entity to enable organizations to achieve their objectives and transform inputs into outputs through a series of transactions or activities (paragraph OV2.14) | |||
'''competence''': The capability to carry out assigned responsibilities (paragraph 4.02) | |||
'''complementary user entity controls''': Controls that a service organization identifies as being necessary for the entity to implement to achieve the control objectives specified by the service organization (paragraph OV4.04) | |||
'''component''': One of the five required elements of internal control; the internal control components are Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring (paragraph OV2.04) | |||
'''configuration management''': Control activities to develop and maintain the operating and security features of information technology and control changes to their configuration (paragraph 11.09) | |||
'''contingency plans/planning''': The processes defined to address an entity's need to respond to sudden changes or unexpected events that could compromise the internal control system (paragraphs 4.06 and 11.17) | |||
'''controls''': Policies and procedures management establishes to effect relevant principles within each component of internal control (paragraph OV1.04) | |||
'''control activities''': Actions management establishes through policies and procedures as part of the control activities component to specifically mitigate risks to achieving the entity's objectives to acceptable levels (paragraphs OV1.04 and 10.02) | |||
'''control objective''': The aim or purpose of specified controls to effect relevant principles within each component of internal control (paragraph OV3.05) | |||
'''deficiency''': When the design, implementation, or operation of a control does not allow management or other personnel, in the normal course of performing their assigned responsibilities, to achieve the entity's objectives (paragraph OV3.07) | |||
'''detective control activity''': A control activity that is designed to discover and timely correct an unintended event or result after it occurs (paragraph 10.10) | |||
'''entity objective''': What an entity wants to achieve; entity objectives are intended to meet the entity's mission, strategic plan, and goals; objectives are also set to meet requirements for the entity that are established in applicable laws and regulations (paragraph OV2.22) | |||
'''entity-level control activities''': Controls designed to mitigate risks that have a pervasive effect on an entity's internal control system; entity-level control activities may include controls related to the entity's risk assessment process, control environment, service organizations, management override, and performance or analytical reviews (paragraph 10.16) | |||
'''fraud''': Involves obtaining something of value through willful misrepresentation (paragraph 8.06) | |||
'''general control activities''': Actions established through policies and procedures that apply to all or a large segment of an entity's information technology designed to mitigate information security risks; general control activities include security management, logical and physical access, configuration management, segregation of duties, and contingency planning (paragraphs 11.07 and 11.09) | |||
'''Green Book''': The commonly used name for ''Standards for Internal Control in the Federal Government'' (Overview: How to Use the Green Book) | |||
'''improper payment''': Any payment that should not have been made or that was made in an incorrect amount (e.g., overpayments and underpayments); payments are also considered improper when there is insufficient or lack of documentation (paragraph 8.11) | |||
'''information security''': The protection of information or information technology from unauthorized access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and availability (paragraph 11.02) | |||
'''information system''': The people, processes, data, and information technology that management uses to obtain, generate, communicate, or dispose of information to support the entity's business processes (paragraph 13.05) | |||
'''information technology''': The infrastructure, platforms, and software used to automate processes (paragraph 11.05) | |||
'''information technology infrastructure''': The physical information technology resources necessary to run software, including the hardware and devices used for information processing, data storage, and network communication (paragraph 11.05) | |||
'''inherent risk''': The risk to an entity in the absence of management's response to the risk (paragraph 7.03) | |||
'''internal control''': A process effected by an entity's oversight body, management, and other personnel, designed to provide reasonable assurance that the objectives of an entity will be achieved (paragraph OV1.01) | |||
'''internal control system''': Consists of integrated and continuous processes, effected by people, that are collectively designed to provide reasonable assurance, not absolute assurance, that an entity's objectives will be achieved (paragraph OV1.05) | |||
'''key role''': A position in an organizational structure that is assigned an overall responsibility of an entity (paragraph 3.06) | |||
'''likelihood of occurrence''': The level of possibility that an unintended event or result will occur (paragraph 7.08) | |||
'''logical and physical access''': Control activities that restrict access to information technology to authorized users (paragraph 11.09) | |||
'''magnitude of impact''': The likely magnitude of the effect of the risk on the entity's ability to achieve its objectives; it is affected by factors such as the size, pace, and duration of the risk's impact (paragraph 7.08) | |||
'''management''': Personnel who are directly responsible for all activities of an entity, including the design, implementation, and operating effectiveness of an entity's internal control system (paragraph OV2.19) | |||
'''monitoring activities''': Activities that evaluate whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning or if change is needed (paragraph 16.02) | |||
'''must''': Denotes a requirement that management must comply with in all cases; these requirements are the components of internal control (paragraph OV2.04) | |||
'''organizational structure''': The overall entity, divisions, operating units, functions, and other structures management uses to achieve the objectives (paragraph OV2.14) | |||
'''oversight body''': Those responsible for overseeing management's design, implementation, and operation of an internal control system (paragraph OV2.19) | |||
'''performance measure''': A means of evaluating the entity's performance in achieving objectives (paragraph 6.07) | |||
'''platforms''': The logical information technology resources necessary to run application software, including operating systems and related computer programs, tools, and utilities (paragraph 11.05) | |||
'''policies''': Reflect management or oversight body statements of what is expected to be done to effect internal control (OV1.04) | |||
'''preventive control activity''': A control activity that is designed to avoid an unintended event or result before it occurs (paragraph 10.10) | |||
'''principle''': Fundamental concept that is integral to supporting the effective design, implementation, and operation of the associated components of internal control and represents requirements necessary to establish an effective internal control system (paragraph OV2.05) | |||
'''procedures''': Actions that implement policies (paragraph OV1.04) | |||
'''qualitative objectives''': Objectives where management may need to design performance measures that indicate a level or degree of performance, such as milestones (paragraph 6.07) | |||
'''quality information''': Information that supports the internal control system, using relevant data from reliable sources that are appropriate, current, complete, accurate, accessible, verifiable, retained as appropriate, and provided on a timely basis (paragraph 13.07) | |||
'''quantitative objectives''': Objectives where performance measures may be a targeted percentage or numerical value (paragraph 6.07) | |||
'''reasonable assurance''': A high degree of confidence, but not absolute confidence (paragraph OV1.05) | |||
'''reporting lines''': Communication lines, both internal and external, at all levels of the organization that provide methods of communication that can flow down, across, up, and around the organizational structure (paragraph 3.04) | |||
'''residual risk''': The risk that remains after management's response to inherent risk (paragraph 7.03) | |||
'''risk''': The possibility that an event will occur and adversely affect the achievement of objectives (paragraph 7.02) | |||
'''risk tolerance''': The acceptable level of variation in performance relative to the achievement of objectives (paragraph 6.08) | |||
'''security management''': A separate process, addressing all components of internal control, for responding to risks related to information security (paragraph 11.09) | |||
'''segregation of duties''': The separation of responsibilities for performing control activities related to the authority, custody, and accounting of operations so that incompatible duties are segregated (paragraphs 10.21 and 10.22) | |||
'''service organization''': An external party that performs business processes or provides services in support of business processes for an entity (paragraph OV4.03) | |||
'''should''': Denotes a principle requirement management should comply with except in rare circumstances where the requirement is not relevant for the entity (paragraphs OV2.06 and OV2.07) | |||
'''software''': The application software, access control software, and other software used to perform specific functions of the entity's business processes (paragraph 11.05) | |||
'''succession plans''': The processes that address an entity's need to replace competent personnel over the long term (paragraph 4.06) | |||
'''transaction control activities''': Controls that directly mitigate information processing risks in the entity's business processes (paragraph 10.17) | |||
'''user control activities''': Partially automated control activities that individuals perform by using information technology or by relying on the information processed through technology (paragraph 10.07) | |||
==== Assessment Definitions ==== | |||
Governance - | Governance - | ||
Latest revision as of 03:50, 19 August 2026
Acronyms
| Acronym | Full Term | Description |
|---|---|---|
| ARS | Arizona Revised Statute | Documents all Arizona state laws |
| CAP | Corrective Action Plan | Process for identifying and resolving issues |
| FMFIA | Federal Managers' Financial Integrity Act | Law requiring internal controls |
| GAO | Government Accountability Office | Federal audit and evaluation agency |
| MC | Maricopa County | Arizona's most populous county |
| MCBOS | Maricopa County Board Of Supervisors | County governing body |
| MCRO | Maricopa County Recorders Office | Office handling public records |
| MOU | Memorandum of Understanding | Formal agreement between entities |
| PRR | Public Records Request | Request for government documents |
| SOS | Secretary of State | Responsible for statewide elections |
| SOX | Sarbanes-Oxley Act | Federal law requiring internal controls |
Definitions
Green Book Definitions
application control activities: Automated control activities that are incorporated directly into application software to achieve the completeness, accuracy, and validity of transactions and data; application controls include control activities over input, processing, and output of data (paragraph 10.07)
attributes: Provide further explanation of the principles and may also contain minimum documentation requirements. Management considers attributes when designing, implementing, and operating the associated principles (paragraph OV2.08)
baseline: The current state of the internal control system compared against management's design of the internal control system; it represents the difference between the criteria for the design of the internal control system and the condition of the internal control system at a specific point in time (paragraph 16.02)
business processes: Processes established across the entity to enable organizations to achieve their objectives and transform inputs into outputs through a series of transactions or activities (paragraph OV2.14)
competence: The capability to carry out assigned responsibilities (paragraph 4.02)
complementary user entity controls: Controls that a service organization identifies as being necessary for the entity to implement to achieve the control objectives specified by the service organization (paragraph OV4.04)
component: One of the five required elements of internal control; the internal control components are Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring (paragraph OV2.04)
configuration management: Control activities to develop and maintain the operating and security features of information technology and control changes to their configuration (paragraph 11.09)
contingency plans/planning: The processes defined to address an entity's need to respond to sudden changes or unexpected events that could compromise the internal control system (paragraphs 4.06 and 11.17)
controls: Policies and procedures management establishes to effect relevant principles within each component of internal control (paragraph OV1.04)
control activities: Actions management establishes through policies and procedures as part of the control activities component to specifically mitigate risks to achieving the entity's objectives to acceptable levels (paragraphs OV1.04 and 10.02)
control objective: The aim or purpose of specified controls to effect relevant principles within each component of internal control (paragraph OV3.05)
deficiency: When the design, implementation, or operation of a control does not allow management or other personnel, in the normal course of performing their assigned responsibilities, to achieve the entity's objectives (paragraph OV3.07)
detective control activity: A control activity that is designed to discover and timely correct an unintended event or result after it occurs (paragraph 10.10)
entity objective: What an entity wants to achieve; entity objectives are intended to meet the entity's mission, strategic plan, and goals; objectives are also set to meet requirements for the entity that are established in applicable laws and regulations (paragraph OV2.22)
entity-level control activities: Controls designed to mitigate risks that have a pervasive effect on an entity's internal control system; entity-level control activities may include controls related to the entity's risk assessment process, control environment, service organizations, management override, and performance or analytical reviews (paragraph 10.16)
fraud: Involves obtaining something of value through willful misrepresentation (paragraph 8.06)
general control activities: Actions established through policies and procedures that apply to all or a large segment of an entity's information technology designed to mitigate information security risks; general control activities include security management, logical and physical access, configuration management, segregation of duties, and contingency planning (paragraphs 11.07 and 11.09)
Green Book: The commonly used name for Standards for Internal Control in the Federal Government (Overview: How to Use the Green Book)
improper payment: Any payment that should not have been made or that was made in an incorrect amount (e.g., overpayments and underpayments); payments are also considered improper when there is insufficient or lack of documentation (paragraph 8.11)
information security: The protection of information or information technology from unauthorized access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and availability (paragraph 11.02)
information system: The people, processes, data, and information technology that management uses to obtain, generate, communicate, or dispose of information to support the entity's business processes (paragraph 13.05)
information technology: The infrastructure, platforms, and software used to automate processes (paragraph 11.05)
information technology infrastructure: The physical information technology resources necessary to run software, including the hardware and devices used for information processing, data storage, and network communication (paragraph 11.05)
inherent risk: The risk to an entity in the absence of management's response to the risk (paragraph 7.03)
internal control: A process effected by an entity's oversight body, management, and other personnel, designed to provide reasonable assurance that the objectives of an entity will be achieved (paragraph OV1.01)
internal control system: Consists of integrated and continuous processes, effected by people, that are collectively designed to provide reasonable assurance, not absolute assurance, that an entity's objectives will be achieved (paragraph OV1.05)
key role: A position in an organizational structure that is assigned an overall responsibility of an entity (paragraph 3.06)
likelihood of occurrence: The level of possibility that an unintended event or result will occur (paragraph 7.08)
logical and physical access: Control activities that restrict access to information technology to authorized users (paragraph 11.09)
magnitude of impact: The likely magnitude of the effect of the risk on the entity's ability to achieve its objectives; it is affected by factors such as the size, pace, and duration of the risk's impact (paragraph 7.08)
management: Personnel who are directly responsible for all activities of an entity, including the design, implementation, and operating effectiveness of an entity's internal control system (paragraph OV2.19)
monitoring activities: Activities that evaluate whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning or if change is needed (paragraph 16.02)
must: Denotes a requirement that management must comply with in all cases; these requirements are the components of internal control (paragraph OV2.04)
organizational structure: The overall entity, divisions, operating units, functions, and other structures management uses to achieve the objectives (paragraph OV2.14)
oversight body: Those responsible for overseeing management's design, implementation, and operation of an internal control system (paragraph OV2.19)
performance measure: A means of evaluating the entity's performance in achieving objectives (paragraph 6.07)
platforms: The logical information technology resources necessary to run application software, including operating systems and related computer programs, tools, and utilities (paragraph 11.05)
policies: Reflect management or oversight body statements of what is expected to be done to effect internal control (OV1.04)
preventive control activity: A control activity that is designed to avoid an unintended event or result before it occurs (paragraph 10.10)
principle: Fundamental concept that is integral to supporting the effective design, implementation, and operation of the associated components of internal control and represents requirements necessary to establish an effective internal control system (paragraph OV2.05)
procedures: Actions that implement policies (paragraph OV1.04)
qualitative objectives: Objectives where management may need to design performance measures that indicate a level or degree of performance, such as milestones (paragraph 6.07)
quality information: Information that supports the internal control system, using relevant data from reliable sources that are appropriate, current, complete, accurate, accessible, verifiable, retained as appropriate, and provided on a timely basis (paragraph 13.07)
quantitative objectives: Objectives where performance measures may be a targeted percentage or numerical value (paragraph 6.07)
reasonable assurance: A high degree of confidence, but not absolute confidence (paragraph OV1.05)
reporting lines: Communication lines, both internal and external, at all levels of the organization that provide methods of communication that can flow down, across, up, and around the organizational structure (paragraph 3.04)
residual risk: The risk that remains after management's response to inherent risk (paragraph 7.03)
risk: The possibility that an event will occur and adversely affect the achievement of objectives (paragraph 7.02)
risk tolerance: The acceptable level of variation in performance relative to the achievement of objectives (paragraph 6.08)
security management: A separate process, addressing all components of internal control, for responding to risks related to information security (paragraph 11.09)
segregation of duties: The separation of responsibilities for performing control activities related to the authority, custody, and accounting of operations so that incompatible duties are segregated (paragraphs 10.21 and 10.22)
service organization: An external party that performs business processes or provides services in support of business processes for an entity (paragraph OV4.03)
should: Denotes a principle requirement management should comply with except in rare circumstances where the requirement is not relevant for the entity (paragraphs OV2.06 and OV2.07)
software: The application software, access control software, and other software used to perform specific functions of the entity's business processes (paragraph 11.05)
succession plans: The processes that address an entity's need to replace competent personnel over the long term (paragraph 4.06)
transaction control activities: Controls that directly mitigate information processing risks in the entity's business processes (paragraph 10.17)
user control activities: Partially automated control activities that individuals perform by using information technology or by relying on the information processed through technology (paragraph 10.07)
Assessment Definitions
Governance -
