The words the auditor uses.
Alphabetical order. Every definition is ours; none copies the text of the standard.
- Corrective action
- What you change so a nonconformity does not recur. Different from the correction, which only fixes the specific case.
- Accreditation
- The recognition a certification body receives from an accreditation body (in Colombia, ONAC) that it audits competently. Without accreditation, the certificate has no market value.
- Scope
- Which products, processes and sites your management system covers. It is written on the certificate.
- Annex A
- The reference control list of ISO 27001 (93) and ISO 42001 (38). You choose them according to your risks and justify them in the Statement of Applicability.
- Internal audit
- The one the company itself (or someone it hires) performs to check the system works, before the certification audit. Mandatory at least once per cycle.
- Gap
- The distance between what a requirement demands and what your company does today. In TAoI every gap has an owner, a state and a date.
- Certificate
- The document an accredited certification body issues after auditing your system. Valid for three years, with annual surveillance audits.
- Compliant
- State of a requirement that is met and has evidence. In TAoI it is one of four states, with in progress, gap and observation.
- Context of the organization
- Clause 4: external and internal issues, interested parties and scope. It is the first thing built.
- Statement of Applicability (SoA)
- The ISO 27001 and 42001 document that says, control by control, whether it applies, why and how it is implemented. It is the first thing the auditor opens.
- Auditor-days
- The unit in which certification bodies quote the audit. They depend on the company's size, risk and sites.
- Risk owner
- The person with authority to decide on a risk: approves its treatment plan and accepts what remains. A specific job title, not a department.
- Processor
- Whoever processes personal data on behalf of someone else (a controller). The same business is usually controller of some data and processor of other data.
- Harmonized structure (HLS)
- The common skeleton of all ISO management system standards: clauses 4 to 10. Formerly called the high-level structure.
- Stage 1 / Stage 2
- The two parts of the initial certification audit: readiness review (documentation) and on-site audit of the operation.
- Impact assessment
- In ISO 42001 (clause 6.1.4) and ISO 27701, the analysis of the consequences of an AI system or a data processing for people. Different from the risk assessment, which looks at the organization.
- Evidence
- Records, documents or observable facts showing something was done. Without evidence, for the auditor it did not happen.
- Finding
- What the auditor concludes when comparing evidence against criterion: conformity, nonconformity or observation.
- ICONTEC
- Colombia's national standards body. It adopts ISO standards as NTC and also acts as a certification body.
- Documented information
- The name the standards give to documents and records. Clause 7.5 governs how they are created, approved, controlled and protected.
- Major / minor nonconformity
- Breach of a requirement. A major blocks the certificate until closed; a minor allows issuing it with an action plan.
- Clause
- Each numbered section of the standard (4.1, 7.5.3, 8.3). In other countries it is called a clause or chapter.
- Observation
- The auditor's warning about something that is not a breach yet, but could become one.
- ONAC
- Colombia's National Accreditation Body. It accredits certification bodies; its directory is where you check whether a certificate is worth anything.
- Interested party
- Anyone who affects or can be affected by your system: customers, employees, suppliers, regulators, neighbours.
- Recertification
- The full audit carried out at the end of the certificate's three years to renew it.
- Controller
- Whoever decides why and how personal data is processed. In Colombia, the one answerable to the SIC and to data subjects.
- Management review
- The periodic meeting, with minutes, where management looks at the system's results and makes decisions. Mandatory before Stage 1.
- Inherent and residual risk
- Inherent risk is the risk before counting the controls already in place; residual risk is what remains afterwards. Residual risk is calculated from the controls, not typed in by hand.
- Surveillance audit
- The shorter annual audit that keeps the certificate valid between certification and recertification.
- Audit rehearsal
- An internal audit that mimics the certification one, stage by stage. In TAoI it repeats until Stage 1 is a formality.
- Management system
- The set of processes, documents, owners and indicators with which a company runs part of its activity: quality (QMS), information security (ISMS), privacy (PIMS) or AI (AIMS).
- Transition
- The period certification bodies grant to migrate from one edition of the standard to the next (for example, 27701:2019 to 2025 before October 2028).