CRMI key terms

The effect of uncertainty on objectives, where the effect may be positive or negative. It combines the likelihood of an event with its consequences and is expressed relative to what the organization is trying to achieve.

The coordinated set of activities used to direct and control an organization with regard to risk. It covers identifying, assessing, treating, monitoring, and communicating risks so objectives are met.

The documented structure of policies, processes, roles, and tools that an organization uses to manage risk consistently. It provides the foundation and arrangements for designing, implementing, and improving risk management across the enterprise.

A formal statement of the organization's approach to risk management, including its objectives, principles, responsibilities, and reporting expectations. It authorizes the framework and sets mandatory expectations for how risk is handled.

A governance structure that separates management of risk (first line), independent oversight and challenge (second line), and independent assurance (third line). It clarifies accountability and reduces gaps or duplication in risk control.

An international standard providing principles, a framework, and a process for managing risk that can be adapted to any organization. It emphasizes integration with decision-making, customization, and continual improvement rather than certification.

A widely used enterprise risk management framework that links risk to strategy and performance through governance, strategy setting, performance, review, and communication components. It treats risk management as integral to strategy rather than a separate compliance exercise.

The systematic sequence of establishing context, identifying, analyzing, evaluating, treating, and monitoring risks, with communication and consultation throughout. It is iterative and applied at varying levels of the organization.

The process of finding, recognizing, and describing risks that could affect objectives, including their sources, events, and potential consequences. It draws on multiple techniques and perspectives to surface risks before they are analyzed.

The overall process of identifying, analyzing, and evaluating risk to determine which risks need treatment and what priority they deserve. It combines qualitative and quantitative techniques suited to the decision at hand.

The step of understanding the nature of an identified risk and determining its level by considering likelihood, consequences, and existing controls. It provides the inputs needed to evaluate and prioritize the risk.

The process of comparing analysis results against risk criteria to decide whether a risk is acceptable or requires treatment. It translates measured risk into decisions about priority and action.

The chance that a risk event or scenario will occur within a stated period or under stated conditions. It may be expressed qualitatively as a rating or quantitatively as a frequency or probability.

The consequence or effect on objectives if a risk event occurs, which may be financial, operational, legal, reputational, or strategic. It is often rated on a scale and can be expressed in monetary or non-monetary terms.

The level of risk before considering the effect of controls or mitigation actions. It helps an organization understand its gross exposure and judge whether existing controls are proportionate.

The level of risk that remains after existing controls and treatments have been applied. It is compared against tolerance to decide whether further action or acceptance is appropriate.

The reference values, thresholds, and standards used to evaluate the significance of a risk. They reflect the organization's objectives, appetite, legal obligations, and stakeholder expectations.

A structured record of identified risks, their owners, assessments, controls, and treatment actions. It serves as a working tool for tracking and reporting risk status over time.

A visual grid that plots risks by likelihood and impact, often using color bands to show severity. It helps communicate relative risk levels and prioritize attention at a glance.

A metric that provides early warning of increasing risk exposure or deteriorating controls. KRIs are monitored against thresholds so management can act before losses or incidents occur.

The process of selecting and implementing options to address a risk, such as avoiding, reducing, transferring, or accepting it. The chosen option is documented, assigned an owner, and monitored for effectiveness.

A treatment option that eliminates the activity or exposure giving rise to a risk. It removes the risk but may also forgo the associated opportunities or objectives.

A treatment option that shifts the financial or contractual consequences of a risk to another party, such as through insurance or outsourcing. The underlying risk may remain, so transfer is rarely complete.

A treatment decision to retain a risk without further action because it falls within tolerance or the cost of treatment outweighs the benefit. Acceptance should be documented, authorized, and periodically reviewed.

A measure that modifies the likelihood or impact of a risk, whether preventive, detective, or corrective. Controls may be manual or automated and are assessed for design and operating effectiveness.

An assessment of whether a control is designed appropriately and operating as intended to reduce risk. Weak or failing controls mean residual risk is higher than assumed.

The individual accountable for managing a specific risk, including approving its assessment and ensuring treatment actions are completed. Clear ownership prevents risks from being unmanaged or overlooked.

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives. It is set by senior leadership and expressed in qualitative and quantitative terms.

The acceptable variation or deviation from the risk appetite that the organization can withstand for a specific objective or category. It converts broad appetite into practical limits and thresholds.

The maximum level of risk an organization can bear before breaching its obligations, solvency, or strategic viability. It represents an absolute constraint distinct from what the organization chooses to accept.

A formal document that articulates the organization's appetite and tolerance for risk by category, often with qualitative statements and quantitative limits. It guides decision-making and provides a benchmark for monitoring and reporting.

The shared values, attitudes, and behaviors that determine how people identify, discuss, and act on risk in daily work. A healthy culture encourages transparency, challenge, and escalation rather than silence.

The signals senior leaders send through their words and actions about the importance of risk management and ethical conduct. It shapes whether employees feel safe raising concerns and following controls.

The arrangements by which authority, accountability, and oversight for risk are assigned and exercised across the organization. It includes board oversight, committees, policies, and reporting lines.

A committee of the board responsible for overseeing the organization's risk profile, framework, and appetite. It provides independent challenge to management and ensures significant risks receive board attention.

The ongoing process of tracking risks, controls, and indicators to detect changes in exposure or effectiveness. It feeds reporting and triggers action when thresholds or tolerances are breached.

The structured communication of risk information to decision-makers, such as dashboards, registers, and committee packs. Good reporting is timely, relevant, and tailored to the audience's decisions.

The process of raising a risk to a higher level of authority when it exceeds defined thresholds or requires decisions beyond local mandate. Clear escalation paths ensure significant issues reach those who can act.

The risk of legal or regulatory sanctions, financial loss, or reputational damage from failing to comply with laws, regulations, or internal policies. It is managed through controls, monitoring, and a strong compliance culture.

A structured set of policies, controls, training, monitoring, and reporting designed to prevent and detect breaches of obligations. Effective programs are risk-based, independently tested, and supported by leadership.

An independent function that provides objective assurance on the effectiveness of risk management, control, and governance processes. It sits in the third line and reports to the board or audit committee.

Situations where personal, financial, or other interests could improperly influence professional judgment or decisions. They are managed through disclosure, recusal, and monitoring rather than assumed to be absent.

The risk that decisions or conduct violate accepted moral standards, harming stakeholders and reputation. It is addressed through codes of conduct, training, speak-up channels, and consistent enforcement.