How to use this glossary
Business systems work borrows words from IT, finance, operations and management, and the same word can mean slightly different things in different teams. The definitions below are short and general. They describe how the terms are commonly used, not how any one organization, standard or product defines them. Where a term has its own detailed treatment elsewhere on the site, the entry here is only a starting point.
Entries are grouped alphabetically. Definitions are written for non-specialists.
A to C
Access control. The rules and mechanisms that decide who can open, change or approve something in a system. It usually combines identifying a person with deciding what that person is allowed to do, a distinction explained in more depth under authentication and authorization.
Audit trail. A record of who did what and when in a system. A good one lets a reviewer reconstruct how a number or decision came about.
Baseline. A measurement of how things stand before a change. Without a performance baseline, it is hard to say honestly whether a new system or structure made anything better or worse.
Business continuity. The ability to keep essential activities running, or restore them within an acceptable time, after a disruption. Business continuity planning sets out what matters most and how it would be kept going.
Center of excellence. A small group that holds specialist knowledge in one area and helps the rest of the organization apply it. It advises and sets good practice rather than doing all the work itself.
Centralization. Concentrating decisions, systems or activities in one place or team instead of spreading them across locations or units. It is a trade-off: it can bring consistency and lower duplication, and it can also slow local decisions and create dependence on one point.
Change control. A defined way of proposing, reviewing, approving and recording changes so that alterations to systems do not happen unnoticed.
D to M
Data governance. The set of roles, rules and decisions that determine how data is defined, owned, protected and used. It is about accountability more than technology.
Data steward. A person given day-to-day responsibility for the quality and correct use of a particular set of data, often alongside a main job elsewhere.
Decision rights. An explicit statement of who may decide, who must be consulted and who is simply informed for a given type of decision. Clear decision rights reduce arguments about authority later.
Federated model. An arrangement in which a central group sets shared standards while individual units keep control of much of the execution. It sits between full centralization and full local freedom.
Hub and spoke. A structure in which a central hub provides shared capabilities and separate spokes, such as sites or units, use them. A hub and spoke structure can be used for IT, data and logistics alike.
Incident. An unplanned interruption or reduction in the quality of a service, such as an application that stops responding.
Least privilege. Under the least privilege principle, people and systems have only the access they need for their work and no more.
Master data. The core reference information a business uses repeatedly, such as lists of customers, products, suppliers or locations, as opposed to individual transactions.
Metadata. Data that describes other data, such as who created a file, when it changed and what a field means.
Multi-factor authentication. Confirming identity with more than one kind of evidence, for example something known and something held.
O to S
Operating model. A description of how an organization arranges its people, processes, systems and decision-making to deliver what it does. Choosing between centralized, decentralized and hybrid versions is a major design decision.
Process owner. The person accountable for how a business process is designed and performs from start to finish. This differs from a system owner, who is accountable for a particular application or platform.
RACI. A way of assigning roles on a task as responsible, accountable, consulted or informed, usually laid out as a grid.
Service level agreement. A written statement of the level of service a provider commits to, such as target response times. Inside an organization, the same idea is often applied between a shared team and the units it serves.
Shared services. A model in which activities needed by several units, such as payroll or IT support, are provided by one dedicated team to the others, much like an internal supplier.
Single point of failure. A component, person or location whose loss would stop a wider process or system. Concentrating work in one place can create single points of failure unless they are deliberately protected against.
Single source of truth. An agreed, authoritative place for a given piece of information, so that people are not working from conflicting copies. In practice it is easier to state as a goal than to achieve completely.
Single sign-on. A way of logging in once and reaching several systems without repeating the process for each.
Stakeholder. Anyone who is affected by a change or can influence its outcome.
System of record. The system designated as the official home of a certain type of data, whatever copies exist elsewhere.
T to V
Total cost of ownership. The full cost of having something over its life, including setup, running, support, training and eventual replacement, not just the purchase price.
Vendor lock-in. A situation in which moving away from a supplier would be so difficult or costly that the buyer effectively has to stay. It is worth considering before a purchase rather than after.
Version control. Keeping track of successive versions of a document or file so that earlier states can be found and the latest one is clear.
Reading further
Terms in specialist fields have their own vocabularies. Data, IT service, project, security, organization design and procurement terms are each covered in separate glossary pages in this section, with more entries than fit here. Where a precise meaning matters, such as in a contract, a compliance obligation or a security control, rely on the definitions in the relevant document or on advice from a qualified professional rather than on a general glossary.