ARM (The Institutes Insurance Designations) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Pure risk

Pure risk involves only the chance of loss or no loss, with no possibility of gain; it is the primary focus of traditional risk management.

Speculative risk

Speculative risk includes the possibility of gain, loss, or no change, such as investing or launching a product; it is managed through enterprise risk management.

Peril

A peril is the actual cause of a loss, such as fire, flood, theft, or liability claim; hazards increase the chance or size of perils.

Hazard

A hazard is a condition that increases the frequency or severity of a loss, including physical, moral, morale, and legal hazards.

Expected loss formula

Expected loss equals loss frequency multiplied by average loss severity over a defined period; it supports comparing retention with insurance transfer.

Risk appetite

Risk appetite is the amount and type of risk an organization is willing to pursue or retain to meet its objectives, expressed in qualitative or quantitative terms.

Risk tolerance

Risk tolerance is the acceptable variation or deviation from risk appetite for a specific risk or objective; it sets boundaries for decision-making and escalation.

Loss prevention

Loss prevention reduces the frequency of losses through controls such as safety training, maintenance, and screening; it differs from loss reduction, which lowers severity.

Loss reduction

Loss reduction lowers the severity of losses after they occur, using measures such as sprinklers, backup systems, and emergency response plans.

Risk retention

Risk retention is accepting and financing losses internally, either planned or unplanned; it is suitable when losses are predictable, low severity, and transfer costs exceed retention costs.

Cost of risk

Cost of risk includes insurance premiums, retained losses, administrative costs, loss control spending, and opportunity costs; tracking it evaluates total risk management performance.

Internet of Things

The Internet of Things connects physical devices that collect and exchange data; it expands cyber attack surfaces and creates privacy, product liability, and business interruption exposures.

Model risk

Model risk is the potential for adverse consequences from incorrect or misused models, including bias, data errors, drift, and lack of explainability in AI systems.

Algorithmic bias

Algorithmic bias occurs when a model produces systematically unfair outcomes because of biased data, design choices, or use; it creates legal, reputational, and regulatory risk.

Shared responsibility model

In cloud computing, the shared responsibility model divides security duties between provider and customer; the customer typically retains responsibility for data, access, and configuration.

Smart contract

A smart contract is self-executing code on a blockchain that automatically enforces terms; errors are difficult to reverse and legal enforceability varies by jurisdiction.

Telematics

Telematics uses devices and sensors to transmit real-time vehicle or equipment data; insurers and risk managers use it for pricing, loss control, and claims management.

Third-party risk

Third-party risk arises from outsourcing to vendors, suppliers, or service providers; critical risks include data breaches, service outages, concentration, and subcontractor failures.

Cyber insurance

Cyber insurance transfers residual cyber loss exposures such as breach response, business interruption, and liability; it complements, rather than replaces, preventive controls and incident preparedness.

Data governance

Data governance defines roles, policies, and controls for data quality, privacy, security, and use; it supports reliable analytics and compliance with privacy regulations.

Digital twin

A digital twin is a virtual model of a physical asset or process fed with real-time data; it supports risk assessment, predictive maintenance, and operational resilience testing.

Vendor concentration risk

Vendor concentration risk is the danger that reliance on few or interconnected providers creates single points of failure; it requires exit plans, diversification, and enhanced due diligence.

Risk treatment plan

A risk treatment plan specifies selected controls, financing, owners, deadlines, resources, and success measures for reducing or transferring an identified risk.

Risk owner

A risk owner is the individual accountable for managing a specific risk, including implementing treatment, monitoring indicators, and reporting changes to governance.

Key risk indicator

A key risk indicator is a metric that signals increasing or decreasing risk exposure; thresholds trigger escalation, review, or additional controls before losses occur.

Recovery time objective

Recovery time objective is the maximum acceptable time to restore a process or system after disruption; it drives backup, staffing, and technology recovery requirements.

Recovery point objective

Recovery point objective is the maximum acceptable amount of data loss measured in time; it determines backup frequency and replication design.

Maximum tolerable downtime

Maximum tolerable downtime is the longest period a business process can be unavailable before unacceptable financial, legal, or reputational harm occurs.

Deductible

A deductible is the amount the insured pays before insurance responds to a loss; higher deductibles reduce premium and increase retained risk.

Self-insured retention

A self-insured retention is a specified amount the insured pays per loss before coverage applies, often used in liability programs; it may include defense costs.

Captive insurer

A captive insurer is a licensed subsidiary formed to finance parent-company risks; feasibility depends on predictable losses, capital, regulation, tax, and reinsurance access.

Risk maturity model

A risk maturity model assesses capabilities across governance, process, data, reporting, and culture; it helps prioritize improvements and benchmark against peers.