Clear language for complex systems.

Independent recognition that a conformity-assessment body is competent for specified activities. Check the accredited scope; a body’s accreditation does not automatically cover every standard or service it offers.

An organisation that assesses and recognises the competence of bodies performing activities such as certification, testing or inspection. It has a different role from the body certifying your management system.

The person accountable for getting an agreed action completed and providing suitable evidence. Naming a department alone can leave responsibility unclear when an action depends on several teams.

A structured examination of how an AI system may affect people, groups and the wider context. Its scope, assumptions and conclusions should support decisions about development, use and oversight.

A maintained record of the AI systems and uses relevant to the organisation. Useful fields include purpose, owner, supplier, data involved, deployment status and the decisions requiring human oversight.

The connected governance, processes and records used to manage an organisation’s AI activities. ISO/IEC 42001 provides requirements for such a system; the scope must match the activities actually managed.

An examination of uncertainties and potential consequences associated with an AI activity. It should inform treatment and oversight decisions rather than serve only as a completed questionnaire.

Anti-money laundering. The term covers arrangements intended to prevent or detect misuse of services for money laundering. Whether particular obligations apply depends on the organisation and its activities.

An annex label whose meaning depends on the specific standard and edition. For example, ISO/IEC 27001 uses Annex A for reference controls; do not assume every standard uses it identically.

The part of ISO’s directives associated with the common structure used by many management-system standards. Shared headings help integration, but do not make the technical requirements of different standards interchangeable.

Changing information so people are no longer identifiable in the relevant circumstances. Removing names alone may be insufficient if other details still permit identification or linkage.

A record of assets relevant to a defined scope, such as devices, software, information or equipment. Ownership, location, criticality and lifecycle status make it useful for control decisions.

A structured, objective examination of evidence against defined criteria. Its usefulness depends on clear objectives, suitable competence and a sample capable of supporting the conclusions reported.

The person or organisation requesting an audit. The client may differ from the organisation being audited, as when a buyer commissions an assessment of a supplier.

The overall judgement reached after considering the audit’s objectives and findings. It should stay within the scope and evidence examined and make significant limitations clear.

The requirements used to evaluate evidence, such as a specified standard, contract, policy or procedure. Agreeing them prevents personal preferences from being presented as mandatory requirements.

Information relevant to the audit criteria that can be evaluated and, where appropriate, verified. Records, observations and corroborated explanations can all contribute; a claim alone may need supporting evidence.

The result of comparing audit evidence with the agreed criteria. A useful finding distinguishes what was expected, what was observed and the conclusion drawn from that comparison.

What an audit is intended to establish. A focused objective helps select useful samples and prevents the exercise from becoming a general collection of documents without a decision in view.

The arrangements for one audit, including its objectives, scope, criteria, activities and participants. It turns the wider programme into work that can be scheduled and performed.

The coordinated set of audits planned over time. It considers priorities, coverage, resources and previous results, rather than being only a list of annual calendar dates.

The record communicating an audit’s scope, methods, findings and conclusions. It should identify important sampling limits and give readers enough evidence to understand the judgement.

Selecting part of a population or process for examination. Sampling supports a proportionate audit but creates limits; the sample should reflect the objective, risks and variations being investigated.

The boundaries of a particular audit, including activities, locations, organisational units and relevant period. It can be narrower than the complete management-system or certification scope.

A connected sequence of evidence that shows how an activity or decision progressed. For example, a changed customer requirement can be traced through approval, delivery and acceptance.

The organisation, team or activity being audited. Its responsibility is to explain the work and provide appropriate evidence, while the auditor remains responsible for an objective evaluation.

The knowledge and ability needed to perform the assigned audit effectively. It depends on the standard, activities, risks and methods involved; a training certificate alone does not establish every competence needed.

The ability of authorised users or processes to access information and services when needed. The required level depends on the service and risk, rather than a universal uptime figure.

A separate copy of information or system state intended to support recovery. Its value depends on protection, coverage and successful restoration, not simply a record that copying completed.

The arrangements used to maintain or restore important activities during disruption. Plans should connect the organisation’s priorities with realistic resources, dependencies, communications and recovery tests.

Establishing the relationship between a measuring instrument’s indications and appropriate reference values. It supports confidence in measurements but does not, by itself, prove that equipment is suitable for every intended use.

UKAS’s certificate-checking service for relevant accredited management-system certifications. It is one verification route; check the certificate’s details and investigate any uncertainty with the issuing body.

The activities, locations and organisational boundaries described by a certificate. Compare it with the product or service you are buying; a valid certificate can still be irrelevant to that purchase.

Checking a certificate’s issuer, holder, scope, edition, status and relevant accreditation. Use the issuing body and appropriate registers; an unsuccessful database search alone does not establish that a certificate is false.

Independent confirmation that specified requirements have been met within a defined scope. For management systems, the certificate concerns the system described; it is not a guarantee of every product, outcome or transaction.

The organisation that audits and makes certification decisions under its applicable scheme. It is separate from ISO, which develops standards, and from the accreditation body that assesses the CB.

The planned sequence of assessment, surveillance and recertification activity for a certificate. Confirm the actual programme with the certification body rather than assuming an internal calendar establishes certificate validity.

A database used to check accredited management-system certification information. It is associated with Global ACI and was previously known as IAF CertSearch; records should be interpreted alongside issuer and accreditation information.

The arrangements for evaluating, approving, implementing and reviewing a change. Good evidence shows how affected people, risks, dependencies and documents were considered before and after implementation.

A common shorthand for the main management-system sections in many ISO standards. Exact requirements and numbering depend on the edition; always check the standard being applied.

An amendment addressing consideration of climate relevance and related interested-party requirements in applicable management-system standards. It does not create a generic requirement for every organisation to obtain net-zero certification.

The division of security and operational responsibilities between a cloud provider and its customer. The split depends on the service; purchasing a cloud product does not transfer every customer responsibility.

The ability to apply relevant knowledge and skills to achieve intended results. Training can contribute, but evidence may also include observed work, experience, supervision and evaluation.

Legal requirements and other commitments that apply to the defined activities. A useful register explains applicability, responsibility and how fulfilment is evaluated, rather than merely listing legislation titles.

Keeping information from being disclosed to people or processes without appropriate authorisation. Controls need to reflect the information, its recipients and the circumstances in which it is used.

Meeting the relevant requirement. An auditor should identify the criteria and supporting evidence, because conformity to one requirement does not establish that every other requirement is satisfied.

The internal and external circumstances that affect the management system’s purpose and results. Useful analysis connects relevant issues to scope, risks, objectives and decisions.

Repeated activity to make the management system or its results better. Evidence can include learning from performance, incidents, audits and feedback, followed by changes whose results are evaluated.

An arrangement that changes or manages risk or supports a required outcome. A control may involve people, processes, technology or physical measures; its existence and effectiveness are separate questions.

The person accountable for a control’s operation and review. The owner should understand the expected outcome, evidence, exceptions and when weaknesses must be escalated.

In data protection, the party deciding the purposes and means of processing personal information. The role follows the actual activity and decisions, not only the label in a contract.

Action that deals with a detected problem, such as fixing an incorrect record or replacing defective output. It may resolve the immediate issue without addressing why it occurred.

Action aimed at removing the cause of a detected problem so it does not recur. Completion evidence should be distinguished from evidence that the action actually worked.

The Chartered Quality Institute, a professional body associated with quality and auditing. References to membership or qualifications should be specific and verifiable rather than used as a general claim of authority.

A supplier whose failure could materially affect an important activity or obligation. Criticality should be based on dependency and consequence, not simply the amount spent.

An NCSC scheme focused on five technical control areas intended to address common internet-based attacks. It is distinct from ISO/IEC 27001 and has its own scope and assessment process.

The Cyber Essentials route that includes independent technical verification. Its testing and prerequisites belong to the official scheme; readiness support alone does not establish certification.

An incident affecting the security of personal information, potentially involving loss, alteration, destruction, unauthorised disclosure or access. The required response depends on the facts and applicable legal duties.

Limiting personal information to what is appropriate and needed for the stated purpose. It matters when collecting evidence for an audit as well as when designing ordinary services.

A structured assessment of how proposed processing affects people’s privacy and how risks will be addressed. Whether a DPIA is required depends on the processing and applicable rules.

A defined data-protection role with advisory and monitoring responsibilities. Not every organisation must appoint one; the need and arrangements require assessment against the applicable legal criteria.

The person to whom personal information relates. Understanding the people affected helps an organisation assess privacy risks, explain its processing and handle applicable rights.

Checking that the resulting design can meet the intended use or user need. The methods should reflect the product or service and the consequences of an incorrect conclusion.

Checking that design outputs satisfy the specified design inputs. It is different from confirming suitability for actual intended use, although both activities may use related evidence.

Arrangements for identifying, approving, updating, making available and protecting documents. The aim is that people use suitable current information and that obsolete material is handled deliberately.

Information that the organisation needs to maintain or retain for its management system. It can be digital or physical; the required content and control matter more than a preferred template.

The agreed date by which an action or decision should be completed. It is useful only when responsibilities, dependencies and the evidence of completion are clear.

The extent to which an activity or control achieves its intended result. A completed task, issued policy or attended course may provide evidence of activity without establishing effectiveness.

A technique that transforms information so it is unreadable without the appropriate means to recover it. Its effectiveness depends on implementation, key management and where protection applies.

An element of an organisation’s activities, products or services that can interact with the environment. Assessing significance helps decide where control and improvement effort are most needed.

A change to the environment associated with an activity, product or service. Distinguishing an aspect from its impact helps explain how operational decisions affect environmental outcomes.

The connected arrangements used to manage environmental responsibilities and performance. Its scope should reflect relevant activities, impacts, obligations and the organisation’s ability to control or influence them.

A structured list of evidence with useful references, owners and dates. It helps reviewers find relevant records without requiring every document to be copied into a single folder.

An outside organisation or person supplying a product, service or process. The controls needed depend on how the supplied activity affects the organisation’s results and obligations.

An audit conducted for the organisation’s own purposes, commonly called an internal audit. An external person can perform it if the arrangements support appropriate competence and objectivity.

A comparison of current arrangements with a defined target or criteria. It identifies development priorities but should not be treated automatically as a completed internal audit or certification decision.

Global Accreditation Cooperation Incorporated, the international organisation that has assumed the former accreditation-cooperation roles of IAF and ILAC. Its current document register helps identify applicable conformity-assessment references.

The arrangements through which direction, accountability and oversight are exercised. For a management system, this includes who makes decisions, what information they use and how consequences are reviewed.

The common structure used across many ISO management-system standards. It supports alignment of shared topics while leaving each standard’s discipline-specific requirements and evidence needs intact.

A source or situation with the potential to cause harm. Identifying a hazard is the starting point for considering who may be affected and what controls are needed.

An approach to selecting controls that gives preference to removing or reducing a hazard before relying on individual protective measures. Suitability depends on the activity and applicable requirements.

Arrangements that enable appropriate people to understand, monitor and intervene in an automated or AI-supported activity. Naming a human reviewer is insufficient if they lack information, authority or time.

The International Accreditation Forum, whose former functions are now within Global ACI. The name remains in legacy documents and references, so check the current identifier and applicable version.

A legacy reference associated with multisite management-system certification. When planning current certification arrangements, check the corresponding Global ACI document and its applicable issue rather than relying on an old copy.

A legacy reference associated with transfers of accredited management-system certification. A transfer involves certification-body decisions and checks; it is not simply changing the logo on a certificate.

The legacy transition document associated with ISO/IEC 27001:2022. It concerns a specific historical edition change; do not use it as a generic timetable for every future ISMS revision.

A legacy reference concerning ICT use in conformity assessment. Remote methods need to be appropriate to the evidence and objective; the reference does not make every audit suitable for remote delivery.

A legacy reference for determining certification audit time for quality, environmental and occupational health and safety systems. It should not be treated as a universal internal-audit duration calculator.

The International Laboratory Accreditation Cooperation, whose former functions are now within Global ACI. Legacy terminology may still appear in accreditation material and should be interpreted in its historical context.

Making an evaluation without interests or pressures distorting the judgement. Identifying and managing conflicts matters as much as stating that an auditor is independent.

An event that disrupts, harms or threatens an intended outcome. The organisation should define its relevant categories so reporting, escalation and response are consistent with the consequences.

Assigning information categories that guide its handling and protection. A useful scheme connects labels with practical rules for access, sharing, storage, retention and disposal.

The management arrangements used to identify and treat information-security risks, operate controls and evaluate results. ISO/IEC 27001 provides requirements; buying security software alone does not create the system.

Uncertainty about events that could affect information confidentiality, integrity or availability. Assessment should connect relevant threats and weaknesses with consequences for the organisation and affected parties.

A system that coordinates requirements from several management disciplines within shared business processes. Integration should preserve specialist controls and clear responsibilities rather than simply combining manuals.

Protecting information and systems against inappropriate alteration or destruction. Relevant controls should address how errors or unauthorised changes are prevented, detected and corrected.

A person or organisation whose needs or actions are relevant to the management system. The useful question is which requirements matter to the defined scope and how they are addressed.

An audit performed for the organisation’s own management-system assurance. It evaluates agreed criteria and implementation, with suitable competence, objectivity and follow-up within a planned programme.

The International Register of Certificated Auditors, associated with CQI. Any claim about an individual’s registration should identify the actual status and scope and be checked rather than inferred from course attendance.

The International Organization for Standardization, which develops international standards. ISO does not perform management-system certification; certificates are issued by separate certification bodies.

Guidance on auditing management systems, including programme management and auditor competence. It supports audit practice but is not an organisational management-system certification standard.

A standard setting requirements for bodies auditing and certifying management systems. It addresses the certification body’s operation and is different from the management-system standard applied to its client.

A standard for bodies auditing and certifying information security management systems. It is relevant to certification-body competence and assessment arrangements, not a substitute for the client’s ISO/IEC 27001 requirements.

Parties that jointly determine the purposes and means of particular personal-information processing. The arrangement requires examination of actual decisions and responsibilities, rather than inference from a shared supplier alone.

A selected measure used to understand performance against an objective. A useful KPI has a defined calculation, owner and decision purpose, with attention to misleading or incomplete data.

The legal justification relied on for particular personal-information processing. It should match the purpose and circumstances; consent is one possible basis, not the automatic answer to every activity.

The auditor responsible for directing an audit team or assignment. The title does not, by itself, prove registration, sector competence or authority to issue certification.

A maintained record of legal requirements considered applicable to defined activities. It becomes useful when it records applicability, ownership, evaluation and updates, rather than a long undifferentiated list.

Considering relevant stages before and after the organisation’s immediate operations, such as design, purchasing, use and disposal. It helps identify where environmental control or influence is possible.

A serious failure judged under the applicable audit or certification classification rules. Severity depends on its effect on the system and confidence in outcomes, not merely the number of examples found.

Leadership’s planned evaluation of whether the management system remains suitable, adequate and effective. Useful outputs include decisions, resources and actions; a meeting agenda alone is not evidence of review.

The boundaries and applicability of the organisation’s management system. It should describe included activities and interfaces clearly and remain consistent with how the organisation actually operates.

A change significant enough to require reconsideration of system or audit boundaries. New locations, services or legal entities may affect evidence, risks and certification arrangements.

The ability to relate a measurement result to suitable references through a documented chain. The necessary arrangements depend on the measurement and the confidence required for the decision.

A failure classified as less serious under the applicable criteria while still requiring appropriate action. It should not be dismissed as optional, and repeated failures may change the overall judgement.

Ongoing or periodic observation of a process, condition or result. Define what is measured, how information is reviewed and what triggers action so monitoring supports decisions.

An access control using more than one different type of authentication factor. Its design and coverage matter; enabling it for some accounts does not show that every important access path is protected.

Certification covering an organisation operating through several sites under applicable arrangements. Eligibility and sampling are determined using relevant certification rules, not simply by putting multiple addresses on one application.

An event that could have caused harm but did not do so in that instance. Reviewing it can reveal weaknesses before a more serious incident occurs.

A product, service result or other output that does not meet applicable requirements. Controls should prevent unintended use or delivery and record the disposition and any necessary approval.

Failure to meet a specified requirement. A defensible finding identifies the requirement and evidence of the gap; disagreement with an auditor’s preference is not enough on its own.

Information that supports a conclusion and can be assessed independently of unsupported opinion. Reliability depends on relevance, source, completeness and whether other evidence corroborates or contradicts it.

A recorded matter identified during an audit that is not necessarily a nonconformity. Its meaning should be explained in the report so readers do not mistake an optional suggestion for a mandatory action.

The arrangements for managing work-related health and safety risks and improving performance. The system should connect operational controls, worker involvement, competence and management decisions.

A suggestion for improving performance where a failure against a requirement has not necessarily been established. It should be clearly distinguished from a nonconformity and considered on its merits.

An activity performed by an external party as part of the organisation’s operations. Outsourcing the work does not remove the need to understand interfaces, requirements and relevant oversight.

Assessing whether arrangements and results meet their intended purpose. It draws on monitoring, analysis, audit and review rather than relying on one score or isolated positive result.

Information relating to an identifiable person. Identification can arise from combinations of details, so a record may still be personal data even when it does not contain a name.

A cycle for setting intentions, carrying out work, checking results and making improvements. It is a practical way to connect management-system activities rather than a separate certification requirement by itself.

An approved statement of direction or intention that guides decisions. Its value depends on being relevant, understood and reflected in operating arrangements, not simply displayed on a wall or website.

Considering privacy throughout the design and change of services, systems and processes. It should influence purposes, data choices, access, retention and safeguards before the solution is fixed.

The governance and processes used to manage privacy-related responsibilities and risks. ISO/IEC 27701 provides a management-system framework; it does not replace analysis of applicable privacy law.

Access that permits powerful administrative or security-relevant actions. It warrants clear authorisation, proportionate protection, monitoring and review because misuse or error can have wide consequences.

Connected activities that transform inputs into outputs. Understanding the purpose, owner, resources, controls and interactions helps an audit examine how work achieves results.

The person accountable for a process’s performance and control. Ownership should include authority to address weaknesses or a clear route for escalating decisions beyond that authority.

In data protection, a party processing personal information on a controller’s behalf. The role depends on the activity and actual decisions; an organisation can also be a controller for different processing.

Separating identifying details from other information so attribution requires additional information. It can reduce risk, but the resulting information may still be personal data and needs appropriate controls.

The connected arrangements used to consistently meet relevant product or service requirements and improve performance. A useful QMS reflects actual workflows and customer needs rather than existing only as a manual.

A defined result the organisation intends to achieve for quality. It should connect to the policy and relevant processes, with a way to evaluate progress and decide what action is needed.

The assessment and decision process used to renew certification for a further cycle. Its timing, scope and evidence requirements are agreed with the certification body under applicable arrangements.

Information retained as evidence of an activity or result. Useful records are identifiable, protected and retrievable, with retention based on the relevant purpose and obligations.

The intended limit on data loss expressed as a point in time to which recovery should be possible. It helps determine backup and replication needs for the relevant activity.

An exercise checking whether information, systems or activities can be restored as intended. Record the outcome and lessons, including gaps between the plan and actual capability.

The intended time within which an activity or system should be restored after disruption. It should be based on business needs and tested capability, not chosen only as an attractive target.

An audit using communication technology to access people or evidence without all participants being together. Suitability depends on objectives, evidence quality, confidentiality and the need for physical observation.

The risk remaining after controls or treatment are considered. It should be understood and owned rather than assumed to be zero because a mitigation task has been completed.

A record of how long information is kept and what happens afterwards. Periods should reflect purposes and applicable requirements; there is no universal retention period suitable for every audit record.

A decision to retain a risk on an understood basis. Record the authority, rationale, conditions and review point so acceptance is distinguishable from neglect or an unassigned action.

The level or kinds of risk an organisation is prepared to take in pursuit of its objectives. It should inform decisions, while recognising that legal duties cannot simply be waived by preference.

A structured examination of risks to support priorities and decisions. The method should suit the activity and explain assumptions, consequences and the basis for evaluation.

The person accountable for monitoring and deciding how a particular risk is managed. Treatment tasks can be delegated, but ownership should remain clear.

A maintained record of risks, evaluation, treatment and ownership. It is useful when it supports decisions and review, rather than becoming an unchanged list of generic threats.

The selected response to risk, such as avoiding an activity, changing controls, sharing exposure or retaining the risk. Record the intended result and who can approve the remaining risk.

Considering uncertainty and potential consequences when planning and running processes. It should influence decisions and controls rather than appear only as a risk register prepared for an audit.

An investigation into why a problem occurred. It should look beyond the immediate error to conditions and controls that allowed it, then support actions whose effectiveness can be checked.

A statement that a requirement or activity is outside a defined scope. Its acceptability depends on the standard and circumstances; exclusions should not hide activities necessary to the system’s claimed outcomes.

An audit performed for a party with an interest in the organisation, commonly a customer auditing a supplier. Criteria, access and confidentiality should be agreed before work starts.

Setting up technology to reduce unnecessary exposure and support its intended security. Evidence should show the actual settings and controlled exceptions, not only a generic hardening policy.

A measure used to manage information-security risk. Its relevance depends on the risk and context; technical installation alone does not demonstrate that the control is operated or effective.

An environmental aspect prioritised as significant using the organisation’s defined evaluation method. The basis should be explainable and reflected in relevant controls, objectives or monitoring.

The first stage of an initial management-system certification assessment, used to examine key readiness matters and inform further assessment. A readiness rehearsal is not the certification body’s Stage 1 audit.

The certification assessment stage examining implementation and effectiveness of the management system. It is carried out within the certification body’s process; a simulated readiness exercise cannot make its certification decision.

A commonly used term for an interested party. In audit planning, focus on the relevant needs, influence and obligations instead of assuming that every possible stakeholder creates a binding requirement.

An ISMS record identifying the necessary controls, reasons for their inclusion, implementation status and the justification for excluding reference controls where applicable. It should connect to risk treatment and obligations.

A request by a person to exercise access rights over their personal information. Handling it requires identifying the request, checking relevant circumstances and following the applicable legal process.

The evidence and decisions used to understand whether a supplier can meet relevant requirements. Certificates, questionnaires, audits and performance records contribute differently and should be selected according to risk.

An audit of a supplier against agreed criteria, usually for a buyer’s assurance. It should support a purchasing or oversight decision and remain within the agreed rights of access.

An assessment during a certification cycle that supports confidence in continued conformity. It is distinct from the organisation’s own internal audits and follows the certification body’s programme.

A person contributing specialist knowledge to an audit or assessment. Their role should be clear, and specialist input does not automatically make them the person responsible for the audit conclusion.

An audit by an independent external body, commonly within a certification process. Independence, competence and scheme arrangements distinguish it from an internal or customer-commissioned audit.

The people who direct and control the organisation at the level relevant to the management-system scope. Their role includes accountability, decisions and resources, not simply approving a policy annually.

The ability to follow the history, movement or application of something through connected records. What needs tracing depends on the product, service, process and applicable requirements.

The time allowed under a defined arrangement to move from one edition or scheme requirement to another. Distinguish publication, application, accreditation and certified-client milestones rather than using one generic deadline.

The United Kingdom’s general data-protection framework, applied alongside relevant domestic legislation and amendments. Its application depends on processing activities and circumstances, not whether an organisation holds an ISO certificate.

The United Kingdom Accreditation Service, the UK’s national accreditation body. It assesses conformity-assessment bodies; it does not act as the organisation’s internal auditor or issue its management-system certificate.

Checking that an outcome is suitable for its intended use or purpose. The evidence and method depend on the activity; the term should be defined clearly when used in a particular technical discipline.

Checking specified information or results against defined requirements. State what was checked and the basis used so verification is not mistaken for a broader guarantee.

Identifying and managing changes to information so the applicable version can be established. Useful controls preserve authorship, approval, change history and the status of superseded material.

The process of identifying, prioritising and addressing weaknesses in technology. It includes ownership, remediation and verification, with decisions based on exposure and consequence rather than a raw count of findings.

Seeking and considering workers’ views before relevant decisions are made. Evidence should show how input influenced the decision or why a different course was taken.

Involving workers in relevant health and safety activities and decisions. Participation requires practical opportunities and suitable support, not merely sending information after decisions have already been made.