CRMI flashcards
CRMI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Inherent risk
- The level of risk before any controls or mitigations are applied, used as a baseline to judge how much controls reduce exposure.
- Residual risk
- The level of risk remaining after existing controls are applied; it is compared with risk tolerance to decide if further treatment is needed.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed through statements and limits.
- Risk tolerance
- The acceptable variation around the risk appetite, defining the boundaries within which risk-taking remains consistent with the appetite statement.
- Three lines model
- A governance structure where the first line owns risk, the second provides oversight and challenge, and the third gives independent assurance.
- Risk criteria
- The thresholds and scales used to evaluate the significance of risk; they should be defined before assessment to reduce bias.
- Risk register
- A structured record of identified risks including description, cause, consequence, owner, controls, ratings, and treatment status.
- Bow-tie analysis
- A diagram that maps threats and preventive controls on one side and consequences and mitigative controls on the other around a central event.
- Risk owner
- The person accountable for managing a specific risk and its treatment; accountability can be delegated in actions but not in responsibility.
- Cause-event-consequence
- A risk description structure that separates what causes the risk, the event itself, and its resulting impact, preventing conceptual confusion.
- Likelihood-impact matrix
- A tool that plots risks by likelihood and impact ratings to prioritize them, often using a multiplicative score to rank exposure.
- Qualitative risk assessment
- An assessment using descriptive scales such as high, medium, and low, useful when data is scarce or precision is not required.
- Value at Risk
- A loss threshold not expected to be exceeded with a given confidence over a defined horizon; it does not describe losses beyond that threshold.
- Expected Shortfall
- The average loss conditional on losses exceeding the Value at Risk threshold; it is more sensitive to tail risk than VaR.
- Monte Carlo simulation
- A technique that samples from input probability distributions to generate an output distribution of outcomes for risk and capital analysis.
- Key risk indicator
- A forward-looking metric with defined thresholds that signals rising or falling risk exposure and triggers escalation when breached.
- Scenario analysis
- An assessment of coherent combinations of inputs or events to explore plausible future outcomes and their impacts on objectives.
- Expected loss
- The product of an event's probability and its financial impact; it ignores tail severity unless the full loss distribution is modeled.
- Risk heat map
- A visual display of risks by likelihood and impact ratings; it can obscure scale definitions and aggregation assumptions if not carefully designed.
- Risk treatment options
- The choices of avoid, reduce, transfer, or accept risk; each changes likelihood, impact, or both and must be justified against tolerance.
- Preventive control
- A control designed to reduce the likelihood of an event occurring, such as segregation of duties or access restrictions.
- Detective control
- A control designed to identify that an event has occurred, such as reconciliation or exception reporting, enabling timely correction.
- Risk transfer
- Shifting financial consequence of a risk to another party through insurance, contracts, or outsourcing; some accountability remains with the transferor.
- Control cost-benefit test
- A comparison of the reduction in expected loss from a control against the control's total cost of ownership to judge whether it is worthwhile.
- Risk avoidance
- Eliminating an activity that creates risk; it removes the downside but also forgoes any upside the activity would have produced.
- Treatment plan
- A documented action to modify a risk, specifying an owner, action, due date, and success measure so it can be tracked and verified.
- Tone at the top
- The signals senior leadership sends about the importance of risk management, reinforced or undermined by incentives and observed behavior.
- Risk committee charter
- A document defining a risk committee's membership, quorum, decision rights, meeting frequency, and reporting lines to the board.
- Risk culture
- The shared values and behaviors that determine how risks are identified and managed in practice, evidenced under pressure rather than stated values.
- Segregation of duties
- A control that prevents one person from initiating, approving, and recording a transaction, reducing fraud and error risk.
- Escalation criteria
- Predefined rules specifying which risks or breaches must be reported upward and within what timeframe, ensuring timely management attention.
- Compliance risk
- The risk of legal or regulatory sanctions, financial loss, or reputational damage from failing to comply with applicable laws and regulations.