Definitions

The term describes reporting auditability and does not imply an external audit or assurance conclusion.

Incidents should be contained, preserved, escalated, remediated and linked to affected reporting information and users.

Model risk should be assessed at use-case level and may include factual, bias, security, privacy, operational and governance risks.

Drift may require regression testing, control changes, restriction or reverification of affected outputs.

The precise legal or technical definition may differ by jurisdiction and should be addressed in future overlays.

An AI use case should be approved and monitored independently of general permission to access the tool.

AI verification is specific to AI-assisted outputs. It should invoke data validation under E.7 where the output contains or transforms reporting data and general evidence evaluation under F.3 where the output supports a reporting conclusion. It is not formal model validation, legal verification or assurance.

AI-assisted output remains subject to human verification, professional judgement, attribution and approval requirements.

Anticipated effects should distinguish plans, scenarios, estimates and forecasts and should state material assumptions and uncertainty.

Applicability may arise through law, regulation, listing, contract, voluntary adoption or another documented basis.

Application controls may depend on enterprise IT general controls that are outside the reporting practitioner's assessment scope.

The assurance practitioner owns the finding; management owns its response and related reporting decisions.

Readiness does not guarantee engagement acceptance, procedures, findings or an assurance conclusion.

Management responses should be controlled, authorised, complete and traceable and should not direct the assurance procedure.

The published version should match the approved package and retain verifiable release and version records.

This term refers to the internally approved and version-controlled source used for a reported item or channel. It is distinct from an external authoritative source under DEF-A05 and should be linked to the relevant owner, evidence and lineage.

This term refers to an external or formally issued source whose authority is assessed in context. It is distinct from the internally designated authoritative reporting source in DEF-G21. Jurisdiction, adoption status, version, effective date and scope remain part of the authority assessment.

Human review design should actively address automation bias rather than assume that a reviewer will detect errors.

Exceptions should remain visible, controlled and linked to the affected reporting population and decision.

Balance does not require equal word count but should prevent selective or misleading overall presentation.

A base year may require recalculation when material structural, methodological or error-related changes occur.

A baseline should identify the period, scope, boundary, method, source and any normalisation or recalculation rules.

The definition supports reporting analysis and does not replace the organisation's own strategic or financial description.

The methodology should be reproducible and may incorporate authoritative or specialist measurement methods.

Implementation should not begin before the required authority and downstream control needs are identified.

This term applies to broader explicit and implied sustainability claims, including performance, target, product, transition and leadership claims. Reporting-basis claims are separately defined in DEF-A14 and governed through A.8.

Changes in method, boundary, period or evidence should be identified where they affect interpretation.

A compensating control should have defined scope, precision, owner, evidence, duration and residual-risk assessment.

A competence limit should trigger supervision, consultation, specialist involvement, scope restriction, refusal or withdrawal.

Confidentiality does not automatically justify omission of information required for fair and compliant reporting.

Conflicts may be actual, potential or perceived and require assessment and response.

Consolidation should preserve the approved perimeter, required disaggregation and source-level traceability.

A content index is not proof that the referenced disclosure is complete or compliant.

The package should be relevant, complete enough for the task, version-controlled and protected according to information sensitivity and rights.

The deficiency should be assessed for cause, effect, severity, aggregation, remediation and residual risk.

Control evidence should be contemporaneous, retrievable and sufficient to assess the control's operation.

A control objective should be testable and is distinct from the activity performed to achieve it.

The control owner may differ from the person who performs or reviews the control.

A controlled data taxonomy supports internal data models and mappings. It is distinct from a reporting taxonomy used for external structured reporting under DEF-I09 and does not replace an authoritative external taxonomy.

Reporting of corrective action should identify status, owner, timing, resources and implementation evidence and should not imply effectiveness before evidence exists.

Correction of a reported value is not equivalent to remediation of the underlying deficiency.

The critical path should be re-evaluated when scope, dependencies or resource assumptions change.

Consistency permits documented differences where criteria, scope, period or purpose genuinely differ.

A cross-reference should identify the specific document, section, page, table, anchor or stable URL and should remain accessible.

Cross-topic relationships may involve trade-offs, co-benefits, rebound effects, cumulative effects or shared causes and should be evidenced rather than assumed.

A defensible crosswalk records versions, rationale, mapping category, confidence, gaps and limitations.

The applicable reporting basis and finance or accounting owners determine the exact treatment and reporting location.

A data dictionary supports semantic consistency across entities, systems and outputs and should be version-controlled.

A data element may be a raw source value, attribute, dimension, calculated field or status and is narrower than a metric.

Lineage should enable retrieval and re-performance and identify manual interventions and versions.

The data owner may differ from the person who prepares, uploads or technically administers the information.

Data validation tests reporting data and information and may operate as a control under F.2. It is distinct from AI-output verification under DEF-I20 and does not by itself constitute internal audit or independent assurance.

Examples may include investment, lending, stewardship, regulatory oversight, impact assessment, procurement or management decisions.

Decision rights should identify reserved matters, delegation limits, evidence and escalation.

Decision usefulness is assessed in the context of the reporting purpose and does not replace the applicable disclosure requirements.

A dependency may create exposure but is not automatically an impact or a material organisational risk.

Examples may include reconciliation, variance analysis, review and exception reporting.

The tag should accurately represent the underlying disclosure and should not be selected solely by label similarity.

Successful technical validation does not by itself demonstrate disclosure compliance or reporting accuracy.

Disaggregation is used where aggregate information would obscure material variation or where required by the reporting basis.

Disclosure architecture precedes detailed drafting and does not by itself demonstrate disclosure completeness.

A disclosure map supports architecture and delivery and should remain linked to the authoritative requirements register.

A disclosure outline implements the approved architecture and does not authorise changes to reporting scope or materiality.

Dissent should identify the basis, authority, unresolved risk and route for decision or escalation.

Double materiality does not permit one perspective to cancel the other or require both perspectives to be met.

Due care includes obtaining specialist support or refusing work where competence, time or evidence is insufficient.

Entity-specific disclosure is distinct from generic standard wording, peer language or policy boilerplate.

Extensions should be necessary, clearly defined, anchored and controlled to preserve comparability and avoid duplication.

An estimate should identify method, population, assumptions, evidence, uncertainty, approval and review or replacement expectations.

An evidence pack should be relevant, cross-referenced, protected and distinguish authoritative and superseded versions.

Challenge should seek clarification, corroboration or resolution and preserve respectful professional conduct.

Facilitation does not transfer formal decision authority to the facilitator.

Finalisation ends with controlled handover and archive and is distinct from post-publication correction.

Financial connectivity does not itself establish accounting recognition, valuation or financial-statement materiality.

The precise objective and threshold are determined by the applicable reporting basis and should not be confused with impact materiality.

Generated content should be treated as a candidate output requiring use-case-specific grounding, review and approval.

Greenwashing risk may arise even where an individual statement is narrowly true but the overall impression is misleading.

Citation or retrieval alone is not sufficient where the source does not support the specific output.

Fluency or apparent confidence does not reduce the need for independent verification.

Human accountability cannot be transferred to a tool, model, vendor or disclaimer.

The human role should be substantive, adequately informed and evidenced rather than nominal.

The definition supports identification and classification; materiality, severity and legal responsibility are determined through other processes.

The criteria may include severity and likelihood and should be applied to specific impacts rather than topic labels alone.

Inappropriate pressure should be resisted and escalated proportionately.

Threats may include self-review, management participation, advocacy, familiarity, self-interest and intimidation and are assessed under the applicable professional requirements.

The scope, level, criteria, period and conclusion should be stated accurately and should not be extended beyond the assurance report.

An intended user is not necessarily the same as an affected stakeholder, data owner, report preparer or general audience.

Interoperability does not imply legal equivalence, automatic compliance or official endorsement.

Judgement uncertainty should be documented and distinguished from data or measurement uncertainty.

The existence, scope and preservation of privilege should be determined by qualified legal counsel.

A lessons-learned record is incomplete unless actions have owners, priorities, deadlines and follow-up.

Likelihood is not applied to discount an impact that has already occurred and should be assessed using the applicable materiality perspective and method.

A limitation disclosure should identify affected information, reason, effect and improvement or reassessment where applicable.

Preparation, advice, specialist support and assurance do not transfer management accountability.

A management representation may supplement but does not replace other evidence needed to support the reporting conclusion.

Management review is not independent assurance and should be evidenced through substantive questions, responses and conclusions.

Its status may be legal, listing-based, contractual, proprietary, voluntary or informal and must be identified rather than assumed.

The classification and treatment of market-sensitive information are determined under applicable law and market rules.

The object of the conclusion and its terminology may differ by reporting instrument and should be explained in the relevant Standards View.

The process may include impact, financial or both perspectives and requires evidence, judgement, approval and maintenance.

A threshold is not a universal number and should be calibrated, sensitivity-tested and prevented from excluding non-compensable or severe cases mechanically.

Metadata supports interpretation, lineage, system integration and record governance.

A metric should be governed through a protocol that states its purpose, unit, period, boundary, method, owner and evidence.

A metric boundary applies to one metric or defined data set and may differ from the overall reporting perimeter. It should be documented in the metric methodology and reconciled to the umbrella reporting-boundary concept in DEF-C07.

A metric protocol may reference a separate specialist methodology and data-dictionary entries.

Completion should be based on evidence that the acceptance criteria are met, not only on the passage of time.

Modelled data should retain the model version, parameters, assumptions, input sources, limitations and specialist ownership.

The appropriate logic depends on the reporting question and should not force every disclosure into one standard template.

Technology may support but should not become the decision owner for a non-delegable judgement.

Objectivity does not require absence of all interests, but relevant threats should be identified and managed.

Formal independence threats in assurance, audit, certification or similar activities are defined in DEF-F26 and determined under the applicable professional framework.

Connectivity should be demonstrated through actual processes, decisions and evidence rather than generic statements of integration.

This concept is narrower than the detailed reporting perimeter addressed in Domain C.

Overall impression should be evaluated across the complete communication and relevant connected channels.

Evidence of oversight requires more than the existence of a mandate or meeting.

Public perception should be considered when selecting safeguards and communication.

Performance analysis should use validated and comparable information and should not be presented as a forecast or causal conclusion beyond the evidence.

A driver should not be described as causal unless the evidence supports that conclusion.

Monitoring should have defined ownership, cadence, issue intake, escalation and closure.

Management retains responsibility for decisions, judgements, information and publication.

Examples may include approved definitions, access restrictions, required workflow fields and pre-use methodology approval.

Applicable privacy and data-protection requirements are jurisdiction-specific and require qualified ownership.

Professional currency requires learning, application, reflection and reassessment and is not demonstrated by attendance hours alone.

Escalation should be timely, factual, protected and documented and may include refusal or withdrawal where unresolved.

Integrity includes avoiding association with materially false, incomplete or misleading reporting information.

Professional scepticism is neither automatic distrust nor unsupported accusation.

Prohibited uses should be documented, communicated, monitored and supported by escalation and incident processes.

Material prompts should be controlled for purpose, neutrality, confidentiality, version and reproducibility where the use case requires it.

Reporting workflows using retrieved or external content should include proportionate controls to detect and contain malicious or irrelevant instructions.

The effect on data, disclosures, controls, comparatives and other channels should be assessed and authorised by management.

The representativeness, bias and limitations of the proxy should be assessed and disclosed.

The original and corrected information, reason, affected period, approvals, notifications and downstream updates should remain traceable.

Overrides should be governed, evidenced, consistently applied and retained whether they add or remove a matter.

A quality gate is an internal control and does not constitute independent assurance.

Reasonable alternatives should be considered where they could materially affect the conclusion or reporting output.

A reconciliation is weak where both sides depend on the same untested source or error.

Record integrity includes working, reviewed, approved, published, superseded and archived records.

Recusal should identify the affected responsibilities, replacement arrangements and continuing information restrictions.

Formal accessibility compliance may require specialist assessment beyond the Global Core.

Assertions provide a basis for identifying reporting risks, control objectives and evidence needs.

Used to identify the context in which a competency is demonstrated; it does not imply a contractual engagement.

An assumption should have an owner, basis, validation date, consequence and route for confirmation or revision.

The reporting basis should identify applicable instruments, status, scope, assumptions, reliefs and limitations.

A reporting boundary is an umbrella rule used to determine the reporting perimeter. A metric-specific boundary is defined separately in DEF-E07 and should be reconciled to the overall perimeter. Boundaries may be organisational, operational, value-chain, geographic, topic-specific or temporal.

A reporting control may be manual, automated or hybrid and should have an owner, frequency, precision, evidence and exception route.

This is a management reporting-control concept describing whether the control is capable of addressing the defined risk. It is distinct from evidence that the control operated and does not constitute an audit or assurance conclusion.

This is a management reporting-control concept describing operation during the relevant period. Formal audit or assurance conclusions about operating effectiveness remain with the authorised audit or assurance practitioner.

The cycle may support more than one report or external submission.

The decision record does not replace the authority or specialist competence required for the underlying conclusion.

A delivery model may be centralised, decentralised or hybrid and remains subject to the role and accountability architecture.

Evidence may be internal or external, direct or indirect, observed or modelled and should be evaluated for quality and coverage.

The term is used for reporting preparation, management review and assurance readiness. The independent assurance practitioner determines evidence appropriateness for an assurance engagement under the applicable standard.

The term is used for reporting preparation, management review and assurance readiness. The independent assurance practitioner determines evidence sufficiency for an assurance engagement under the applicable standard.

Reporting governance concerns the reporting process and is distinct from governance and business conduct reported as sustainability subject matter.

Market and counterparty requests are treated separately in A.7 unless they themselves constitute a formal reporting instrument.

An issue is distinct from a risk, action, assumption, decision or change request.

A reporting perimeter may differ by instrument, topic, metric or disclosure and should be reconciled to other organisational perimeters.

A request should state completion, evidence, confidentiality and approval conditions.

Reporting risk may arise from data, methods, systems, people, judgement, change, governance, evidence or publication.

It translates the reporting basis and materiality conclusions into an execution direction and does not replace corporate sustainability strategy.

A reporting taxonomy is used to structure or tag reported information, including external digital filings. It is distinct from the internal controlled data taxonomy in DEF-E05 and does not replace the applicable reporting requirements or filing rules.

Reporting technology should be selected and governed against defined reporting, control, data and lifecycle requirements.

Workflow status should reflect actual completion and quality conditions.

This term is narrower than a general sustainability claim. A reporting-basis claim is governed through A.8; broader environmental, social, performance, target and leadership claims are substantiated under G.7, and assurance or certification wording is controlled under F.9.

Use-case definition should precede tool selection and should identify non-delegable judgement and specialist boundaries.

The register may also support data, control, assurance-readiness and curriculum views but remains distinct from the published content index.

Governance should be demonstrated through actual use, records and decisions and should not be presented as proof that every AI output is reliable or compliant.

A restatement should identify the reason, periods and information affected and preserve the originally published record.

Failure to meet the restrictions should stop or suspend the use rather than be treated as a minor exception.

Retaliation risk should inform confidentiality, route selection, protection, monitoring and specialist consultation.

Safeguards may include independent review, separation, restricted participation, disclosure, recusal, reassignment or withdrawal.

Classification and disclosure treatment should be determined through the appropriate legal and information-governance process.

Severity should not be reduced through unsupported averaging where one dimension indicates a severe or potentially irremediable effect.

Shadow use should be identified, assessed and either brought under control, restricted, suspended or retired.

C.2 defines who may sign and the decision-right architecture; F.5 governs the substantive review, representation and operational sign-off process. Sign-off is not independent assurance and does not by itself prove that effective review occurred.

The judgement should identify criteria, evidence, authority, alternatives, uncertainty, approval and reassessment.

The hierarchy should distinguish normative sources from implementation material, educational material and secondary commentary.

A source system should be evaluated for suitability, provenance, access, stability, coverage and control.

The reporting practitioner may evaluate reporting relevance and completeness but should not claim to reperform specialist work outside their competence.

Spreadsheet controls should be proportionate to the materiality and complexity of the reporting use.

Structured data should remain reconcilable to authoritative human-readable reporting and underlying evidence.

The exact meaning and terminology are determined by the applicable assurance framework.

Subject-matter literacy is not the same as professional qualification or authority to perform specialist scientific, legal, engineering, clinical, valuation or investigation work.

Specialist status is contextual and should be supported by competence, scope, independence or conflict considerations and appropriate evidence.

The delegating or approving person retains the responsibilities assigned under the reporting governance model.

Context analysis frames reporting questions and information needs but does not itself determine materiality or specialist conclusions.

An opportunity should not be assumed merely because an action has a positive sustainability intent; evidence and materiality remain separate questions.

Financial materiality, magnitude and valuation are assessed under the applicable reporting basis and Domain C.

The depth of analysis should be proportionate to the reporting question and should not imply specialist scientific modelling.

A target should distinguish ambition, feasibility, dependency and actual progress and may include interim milestones.

A deviation assessment should distinguish performance from target, boundary, denominator and methodology changes.

A trajectory may be linear or non-linear and should distinguish plan or forecast from actual performance.

Technical translation should simplify complexity without altering meaning or removing material qualification.

Third-party involvement does not transfer management accountability or remove the need for competence, conflict and deliverable review.

The inventory should include unapproved or discovered shadow use where relevant and distinguish active, restricted, suspended and retired tools.

A trade-off should be described transparently and should not be resolved through undisclosed netting.

A trend conclusion should consider changes in boundary, method, denominator, estimate and reporting period.

Uncertainty may be qualitative or quantitative and should be communicated proportionately without false precision.

The explanation should avoid false precision and identify material assumptions, ranges, scenarios or limitations where relevant.

Unintended consequences should be considered where reasonably foreseeable and supported by evidence or clearly identified assumptions.

Value-chain mapping is distinct from legal entity structure, financial consolidation, reporting perimeter and data consolidation.

The comparator, method and materiality of the variance should be explicit.

Automation should preserve human decision rights and make failures and overrides visible.

A working paper should enable another competent reviewer to understand and, where relevant, reperform the work.