AIM key terms

The organized group and set of processes within an organization that identifies, evaluates, and treats risks on behalf of the whole enterprise rather than a single unit.

The framework of authority, accountability, and reporting through which a board and senior leaders direct and oversee how risk is managed across the organization.

A structure that separates operational management, independent risk and compliance oversight, and internal audit so that assurance is layered and independent of those taking risk.

An independent function that provides objective assurance on the effectiveness of controls and risk management, reporting typically to the board or audit committee.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in broad statements approved by the board.

The acceptable variation around a specific risk objective, giving practical limits that managers can apply when making day-to-day decisions.

The maximum level of risk an organization can bear without threatening its solvency, strategy, or ability to meet obligations.

The senior executive responsible for leading the enterprise risk management program, advising the board, and coordinating risk activities across business units.

A board-level committee that oversees the organization's risk profile, approves risk appetite, and monitors whether management is managing key exposures effectively.

A coordinated, organization-wide approach to identifying, assessing, and managing risks in relation to strategy and objectives rather than in isolated silos.

A structured record listing identified risks along with their owners, likelihood and impact assessments, controls, and planned treatments.

The individual accountable for managing a specific risk, including monitoring it and ensuring that agreed controls and treatments are implemented and effective.

The process of identifying risks and evaluating their likelihood and potential impact so they can be prioritized and treated appropriately.

Selecting and applying a response to a risk, such as avoiding, reducing, transferring, or accepting it, based on cost and benefit.

Accepting a risk and bearing its financial consequences internally, whether deliberately after analysis or unintentionally because a risk was overlooked.

Shifting the financial consequences of a risk to another party, most commonly through insurance, contracts, or hedging arrangements.

A treatment that eliminates an exposure by ceasing the activity or choosing a different approach that does not create the risk.

Actions that reduce either the likelihood of a loss event or the severity of its consequences, such as controls, engineering, or safety programs.

Policies, procedures, and safeguards designed to prevent, detect, or correct errors and losses and to keep operations aligned with objectives.

An insurance company owned by a non-insurance organization to finance its own retained risks, often gaining cost and coverage advantages over commercial markets.

Insurance purchased by an insurer to transfer part of its assumed risk to another insurer, protecting capital and enabling it to write larger or more volatile risks.

The combined cost of retained losses, insurance premiums, and risk management expenses, used to measure and compare the efficiency of a risk program.

The process of reporting, investigating, documenting, and settling claims to ensure fair, timely payment and to capture data for future risk decisions.

Estimating the funds needed to pay reported and unreported claims, a core actuarial and financial activity that affects solvency and reported results.

Adhering to laws, rules, and supervisory expectations that apply to the organization, supported by monitoring, reporting, and remediation when gaps are found.

The degree to which outcomes, losses, or financial results fluctuate over time, which affects capital needs and the amount of risk an organization can bear.

A newly developing or changing exposure whose likelihood or impact is not yet well understood, making it hard to quantify and easy to underestimate.

A systematic process of looking ahead for signals of change in technology, regulation, markets, or society that could create future risks or opportunities.

Exploring plausible future events and their consequences to test how strategies, capital, and controls would perform under conditions beyond normal experience.

Evaluating how a portfolio, insurer, or organization would withstand severe but plausible adverse conditions, often used to inform capital and contingency planning.

Exposure arising from physical changes such as extreme weather and from the transition to a lower-carbon economy, including policy, legal, and market shifts.

The potential for loss from climate-related hazards such as floods, storms, heat, and wildfire, including both acute events and chronic shifts in conditions.

The risk of financial or strategic loss from moving toward a lower-carbon economy, driven by policy changes, technology shifts, and changing customer preferences.

The potential for loss from digital attacks or failures, including data breaches, ransomware, business interruption, and third-party technology dependencies.

The ability to prevent, absorb, adapt to, and recover from disruptions so that critical services continue to be delivered to customers and the market.

Planning and preparation that enables an organization to keep essential operations running or restore them quickly after a disruption.

Exposure created by relying on vendors, outsourcers, or partners, including service failure, data loss, concentration, and reputational harm from their actions.

The danger of losses becoming excessive because exposures are clustered in one counterparty, geography, product, or source rather than spread widely.

The exposure to widespread disease outbreaks that disrupt operations, claims experience, supply chains, and workforce availability across many lines at once.

Exposure to loss from political instability, conflict, sanctions, trade restrictions, or policy shifts in countries where the organization operates or invests.