Glossary
Terms, defined.
30 terms used across ShelfGRC and its guides, each in a sentence or two.
A
- AI assistant
- The assistant, headed ShelfGRC AI on most pages, answers questions about your organisation's own risk and compliance records and drafts text for new records and updates. It only ever reads Public, non-privileged records, and a record it helps you draft is still submitted as a proposal.
- Read the AI Assistant guide
- Attestation
- The record made when an obligation's Status update is approved. Last Attested is set, an entry is added to its Attestation History, and Next Due moves to one review cycle (365 days by default) after the update was submitted.
- Read the Obligations guide
C
- Category risk tolerance
- The highest severity band each top-level risk category accepts. A risk whose residual rating, or inherent rating if it has no residual assessment, is above its category's tolerance is flagged Over tolerance.
- Read the Risks guide
- Classification
- A record's sensitivity level, which decides who can read it. Public records are visible to everyone who can see the record's business unit, Confidential records only to people granted Confidential access, and Highly sensitive records only to the people named under Restricted to.
- Read the Risks guide
- Compliance status
- The only state an obligation carries: Not Assessed, Compliant, Partially Compliant or Not Compliant. Once a day, an obligation whose due date has passed with no assessment since reverts to Not Assessed.
- Read the Obligations guide
- Control
- A safeguard, such as a check, process or technical measure, that manages your risks and meets your obligations. Each control is typed as Preventative, Detective or Corrective.
- Read the Controls guide
- Control effectiveness
- How well a control works, rated separately on each link to a risk or obligation rather than on the control itself. The default scale is Effective, Partially Effective and Ineffective, and your organisation can set its own levels.
- Read the Controls guide
E
- Evidence
- The proof that your controls work and your obligations are met, such as audit reports, attestations, certificates, screenshots and logs. You upload the document, describe it clearly, then link it to the records it supports.
- Read the Evidence guide
- Executive Overview
- A pre-built, always-current summary of your organisation's posture, for owners and admins. It opens with five headline tiles and a 12-month Forward-Look Workload chart, followed by six sections covering risks, compliance, incidents, treatment plans, controls and policies.
- Read the Reporting guide
H
- Highly sensitive
- A classification for a very small number of cases: only the people named under Restricted to can see the record. It is left out of the dashboard and the AI assistant, and reports list it as Highly sensitive with no title or detail.
- Read the Risks guide
I
- Impact
- One of the two inputs to a risk rating, scored from 1 to 5 alongside likelihood. The default level labels run from Negligible to Severe, and your organisation can rename them and its impact headings.
- Read the Risks guide
- Incident
- Something that went wrong, recorded in the Breach & Incident Register with why it happened and what you did about it. Each incident has a severity and a status from Open through to Closed, and can record its root cause and control failure.
- Read the Incidents guide
- Inherent risk
- A risk's rating before any controls, worked out from its likelihood and impact. It is shown as the Inherent Score in the Risks register.
- Read the Risks guide
L
- Likelihood
- One of the two inputs to a risk rating, scored from 1 to 5 alongside impact. The default level labels run from Rare to Almost Certain, and your organisation can rename them.
- Read the Risks guide
M
- Maker-checker
- The approval model behind every proposal: one person proposes a change and an owner or admin approves it before anything is saved. If your organisation turns on Require second approver, nobody can approve their own proposal.
- Read the Proposals & Approvals guide
N
- Notifiable breach
- An incident flagged as a breach that must be reported. The register shows it as pending until a date notified is recorded, and each party you told is logged in the incident's Notification Register.
- Read the Incidents guide
O
- Obligation
- A requirement your organisation must meet, such as a law, regulation, contract, standard or internal rule. Each obligation records who owns it, when it is next due, how compliant you are and which controls support it.
- Read the Obligations guide
- Organisational unit
- A unit in your organisation's hierarchy, which starts at Whole Business. Every record is owned by a unit, and the units a person is assigned to decide which records they can see.
- Read the Settings & Team guide
P
- Policy
- One of your organisation's governing documents, recorded with its owner, lifecycle status and next review date. Its status moves through Draft, In Review, Approved (passed review but not yet in effect), Active (in force now) and Retired (withdrawn or superseded).
- Read the Policies guide
- Privilege
- A setting separate from classification that marks a record as legally privileged. A Privileged record is visible only to people who hold Privileged access, whatever its classification.
- Read the Settings & Team guide
- Proposal
- A change filed for approval, such as a new record, an edit, a status change, a review or an import. Nothing in the register changes until an owner or admin approves it, and a rejected proposal changes nothing.
- Read the Proposals & Approvals guide
R
- Reporting Canvas
- A custom report, for owners and admins, composed by placing live data blocks on a grid. It saves automatically and can be exported as a PDF or a PowerPoint deck.
- Read the Reporting guide
- Residual risk
- Your judgement of the risk that remains once controls are working, rated from a residual likelihood and impact. The residual score cannot be higher than the inherent score.
- Read the Risks guide
- Risk
- Something that could go wrong, recorded in the Risks register and rated by likelihood and impact. Each risk has an owner, a category and a status of Open, Mitigating or Closed.
- Read the Risks guide
- Risk heatmap
- A 5 by 5 grid with likelihood as rows and impact as columns, counting the risks in each cell and colouring each cell by its severity band. You can switch it between the residual and inherent view.
- Read the Risks guide
S
- Severity band
- A named range of risk scores, such as Low, Medium, High or Critical, that turns a likelihood and impact into a rating. The score is likelihood times impact (1 to 25), and owners and admins can rename bands, change their ranges and override individual cells.
- Read the Risks guide
- Spreadsheet import
- Brings an existing register in from a CSV or Excel file on the Uploads page: you map each ShelfGRC field to a column in your file, and the whole import becomes one proposal. An import always creates new records and never updates existing ones.
- Read the Uploads & Imports guide
- Standard reports
- Twelve pre-built report types on the Reports hub: six summary reports, each covering one area of your programme, and six register reports, each printing a complete register. They are tables and charts built directly from your data, with no AI-written commentary.
- Read the Reporting guide
T
- Taxonomy
- The category lists your registers use, each with categories and one level of subcategories. The four trees are Risk, Incident, Root Cause and Control, and obligations and policies share the Risk tree.
- Read the Settings & Team guide
- Treatment plan
- The remediation work that brings a risk back within tolerance: who does it, by when and why. A plan linked to risks inherits the rating of the highest-rated one, and is shown as Overdue once its due date passes without it being Completed.
- Read the Treatment Plans guide