Conventions

Regulatory requirement

The laws or industry standards applicable to a business and that are imposed by authorized institutes such as a government.

(Compliance) Framework

This is a set of guidelines that details an approach designed to adhere to regulations. It outlines rules to achieve this goal based on the organization's business processes and (internal) controls.

Authority document

This specifies the requirements that a company must adhere to. They may take different forms such as laws, regulations, industry best practices, customer contracts, or internal policies. It is essential that they are similar to regulatory requirements. Sometimes, certain control objectives are spelled out in them, but most often businesses have to determine those themselves.

Control objectives

Control objectives are most often abstract. They answer the questions '"what" and "why". Therefore, they can be defined by someone who understands compliance but doesn't have an in-depth technological knowledge. For example, the German data protection law specifies that transferred customer data has to be protected. So the control objective would be "data protection".

Control activities

These are activities to help ensure that requirements, stated in policies to address risks, are met. They answer the questions of "who", "where", "when", and "how." Therefore, they have to be defined by someone who has in-depth technical knowledge. Control activities may take different forms such as approvals, segregation of duties, reviews, and so on. Based on the previous example, the control activity defines who is responsible for protecting the data, which systems to include, and how data should be protected.

Program

A program gives a structure to compliance management. It contains authority documents and their mapping to control objectives, control activities, and documentation for the results of those controls; it might also contain risk assessments and further documentation. Quite often it is tool-assisted.

Risk management

This is the process of identifying, assessing, and managing risks. Based on company risk level, it includes the decision on whether to minimize, monitor, or control the probability and impact of those risks. Issues with negative outcomes from those risks will be transferred, minimized, or accepted.