ARM (The Institutes Insurance Designations) cheat sheet

Risk is uncertainty about outcomes; pure risk has only loss or no-loss outcomes, while speculative risk includes gain, loss, or no change.

The risk management process is: establish context and objectives, identify risks, analyze, evaluate, treat, monitor and review, and communicate and consult throughout.

An exposure is a person, property, or activity subject to loss; a peril is the cause of loss; a hazard is a condition that increases frequency or severity.

Expected loss equals loss frequency multiplied by average loss severity; it is a baseline for comparing retention, insurance, and loss control costs.

Risk control techniques include avoidance, loss prevention, loss reduction, separation, duplication, and diversification; prevention targets frequency and reduction targets severity.

Risk financing techniques include retention, transfer, and hybrids; retention is appropriate when losses are predictable, low severity, and transfer costs exceed retention costs.

Risk appetite is the amount and type of risk an organization is willing to pursue; risk tolerance is the acceptable variation around that appetite.

Cost of risk equals insurance premiums plus retained losses plus administrative costs plus loss control spending plus opportunity costs; it measures total program cost.

ERM integrates risk across silos; COSO ERM components are governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.

Emerging technology risks commonly span strategic, operational, cyber, legal and regulatory, reputational, and third-party or concentration categories.

IoT devices expand attack surfaces and create privacy, product liability, and business interruption exposures because sensors collect and transmit data continuously.

AI and machine learning create model risk through bias, data errors, drift, adversarial inputs, and limited explainability; controls include validation, monitoring, and human oversight.

Cloud computing uses a shared responsibility model: the provider secures the infrastructure, while the customer typically secures data, identities, access, and configurations.

Blockchain and smart contracts provide tamper-resistant records but create irreversible coding errors, key-management failures, and uncertain legal enforceability.

Telematics and usage-based insurance use real-time data for pricing and loss control; associated risks include privacy, consent, data quality, and regulatory scrutiny.

Cyber risk quantification uses frequency and severity, scenario analysis, and loss exceedance estimates; cyber insurance transfers residual loss but does not replace preventive controls.

Third-party risk management evaluates vendor criticality, concentration, subcontractor chains, service-level gaps, right-to-audit clauses, and exit or portability plans.

Emerging technology governance includes maintaining a technology inventory, assessing risks, setting policy, training users, testing incident response, and reporting to the board.

Strategy implementation links risk treatment to business objectives by assigning owners, deadlines, resources, and measurable success criteria.

Treatment selection compares avoidance, reduction, transfer, and retention using cost-benefit analysis, risk appetite, legal requirements, and loss predictability.

Insurance program design addresses limits, deductibles or self-insured retentions, coinsurance, aggregates, per-occurrence triggers, reinstatements, and exclusions.

Retention analysis compares expected retained losses, volatility, and administrative cost against premiums and frictional costs of transfer.

Captive feasibility depends on predictable losses, sufficient capital, regulatory approval, tax treatment, and access to reinsurance; tax savings alone are insufficient.

Monitoring uses key risk indicators, loss ratios, claims trends, control testing, and audit findings; thresholds trigger escalation and treatment review.

Business continuity planning uses recovery time objective, recovery point objective, and maximum tolerable downtime to set recovery requirements for processes and technology.

Risk culture is shaped by tone at the top, incentives, training, speak-up channels, and consistent risk language across functions and levels.

Risk maturity models assess governance, process, data, reporting, and culture; benchmarking against peers and maturity gaps informs improvement priorities.