- Published
- 8 October 2026
- Last reviewed
- 8 October 2026
How to use this glossary
Use these introductory terms when recording decisions, reviewing controls or organising audit evidence. Exact meanings depend on the applicable policy, standard and audit context. The examples do not establish compliance for any organisation.
Browse the alphabetical term index below. Select a term to jump to its definition, example and common mistake. Use the return link after each entry to browse again. You can also use your browser’s Find command to locate a word on this page. Definitions are original RDE plain-language explanations. All examples are fictional teaching scenarios.
Term index
12 terms, listed alphabetically.
- Accountability
- Audit
- Audit evidence
- Compliance
- Control
- Control owner
- Escalation
- Finding
- Governance
- Residual risk
- Risk
- Risk appetite
Definitions and practical examples
Accountability
Meaning: Answerability for an agreed decision, responsibility or result.
Example: A named service owner explains why a launch decision was made and follows up its conditions.
Common mistake to avoid: Assigning tasks does not remove the agreed decision accountability.
Audit
Meaning: A systematic examination of evidence against relevant criteria.
Example: A reviewer checks sampled approvals against the organisation’s approval policy.
Common mistake to avoid: The applicable criteria and scope matter; an informal check is not necessarily a formal audit.
Audit evidence
Meaning: Information used to support an audit assessment or conclusion.
Example: A dated approval record and transaction reference support review of one payment.
Common mistake to avoid: Record origin and relevance. A screenshot without context may not establish what occurred.
Compliance
Meaning: Meeting applicable requirements, such as agreed rules, policies or obligations.
Example: A reviewer checks whether the required approval was obtained before payment.
Common mistake to avoid: A checklist tick alone does not demonstrate that the underlying requirement was met.
Control
Meaning: A measure intended to manage risk or support an objective.
Example: A second authorised person reviews a payment before it is released.
Common mistake to avoid: Describe how it operates, who owns it and what evidence it produces.
Control owner
Meaning: The person responsible for the operation and upkeep of a particular control.
Example: A finance lead maintains the payment-approval process and resolves exceptions.
Common mistake to avoid: The person who performs one check may differ from the control owner.
Escalation
Meaning: Raising an issue or decision to an appropriate level of authority.
Example: An unresolved conflict of interest is referred to the authorised governance lead.
Common mistake to avoid: Provide evidence, impact and the decision required rather than only an alarm.
Finding
Meaning: An assessment based on evidence compared with defined review criteria.
Example: A sampled payment lacks the approval required by the organisation’s policy.
Common mistake to avoid: Separate the observed gap from an unsupported claim about intent or fraud.
Governance
Meaning: Arrangements for direction, decision authority, accountability and oversight.
Example: A project charter states who can approve launch and who receives assurance reports.
Common mistake to avoid: A meeting schedule alone does not make decision authority clear.
Residual risk
Meaning: Risk remaining after controls or responses have been considered.
Example: A second approval reduces errors, but collusion or mistaken approval may remain possible.
Common mistake to avoid: State whether controls are proposed or operating, and record the assessment basis.
Risk
Meaning: Uncertainty that may affect the achievement of objectives.
Example: A key supplier may miss a delivery date, affecting the training launch.
Common mistake to avoid: Separate an uncertain future event from an issue that has already occurred.
Risk appetite
Meaning: The amount and type of risk an organisation is willing to pursue or retain.
Example: Leaders set boundaries for acceptable disruption during a service trial.
Common mistake to avoid: Use authorised organisational guidance rather than inventing a personal threshold.
A distinction worth keeping clear
A risk describes uncertainty and its possible effect. A control is a measure intended to change that risk. Evidence helps a reviewer assess whether the control was used and effective. Recording a control does not prove it operated.
Practise using the terms
A team worries that payments may be approved by the person requesting them. It introduces a separate approval and retains approval records. Identify the risk, control and evidence, and name one question for a review. Write your answer in your own notes before reading the explanation. No answer is submitted or stored by this page.
Suggested answer and explanation
The risk concerns inappropriate or erroneous payments without independent approval. The control is approval by a separate authorised person. Approval records provide evidence of its operation. A reviewer could ask whether the approver was authorised and genuinely separate from the requester for the sampled payments.
Sources and scope
The sources below support the terminology and relevant context. The definitions, examples, cautions and practice tasks on this page are original RDE teaching material, not verbatim extracts or a replacement for an official standard or certification syllabus. Reviewed 8 October 2026. Author: Jefferson Otonbara Imgbi.
Cover image: AI-generated illustrative scene created specifically for this resource.