The concept being tested is risk governance—the coordinated activities that establish how an organization directs and controls its approach to risk. Risk governance provides the framework, accountability, and oversight—the policies, risk appetite, roles, and decision-making processes—that guide how risk is identified, assessed, managed, and monitored across the enterprise. It sits above day-to-day risk management activities, ensuring those activities align with objectives, regulatory requirements, and stakeholder expectations. An asset is a resource of value the organization uses or holds, not a governance framework. A stakeholder is anyone with an interest in the organization, which is about who is affected or involved, not the control structure for risk. Access risk refers to a type of risk related to unauthorized or inappropriate access, not to the overarching governance mechanism that directs risk across the enterprise.

The process of determining and documenting the risk an enterprise faces is risk identification. This first step in risk management involves discovering potential events or conditions—from both inside and outside the organization—that could affect objectives, and describing them in a structured way. It captures details such as what could happen, why it might occur, the potential impact, and who would own the risk, typically resulting in a risk register or inventory. This foundation enables later steps like evaluating and prioritizing risks and deciding on responses. A risk scenario is a narrative example used to illustrate how a risk could unfold, not the overall process. A risk awareness program is about educating stakeholders on risk concepts, not identifying specific risks. A threat event is a specific incident that could cause harm, rather than the process of identifying and documenting risks.

A penetration test is a live examination where authorized testers simulate real-world attacker behavior to test how well security controls stand up to actual breach attempts. By attempting to exploit weaknesses, escalate privileges, and access sensitive data in a controlled setting, this type of testing reveals how effective defenses are in practice and whether detection and response processes work as intended. It goes beyond mere vulnerability scanning by proving what an attacker could achieve in the real world, helping prioritize fixes and validate security improvements. The other terms describe metrics or indicators rather than the active, attacker-simulated testing itself, so they don’t capture the practical assessment of defenses that a penetration test provides.

Control objectives describe the intended result of applying controls to a process—the purpose or outcome the control procedures are meant to achieve. They set the target for what the controls are designed to ensure, such as preventing errors, ensuring compliance, or safeguarding assets. By defining this desired outcome, you know what success looks like and can design and test controls accordingly. This is different from governance, which is the broad framework for directing and controlling an organization; a RACI chart, which maps who is responsible, accountable, consulted, and informed; and a vulnerability, which is a weakness that could be exploited. For example, in a purchasing process the control objective might be to ensure all purchases are properly authorized and supported, guiding controls like required manager approval and documentation matching.