ARM (The Institutes Insurance Designations) key terms

The possibility that actual outcomes will differ from expected outcomes, including the chance of loss, injury, damage, or a missed opportunity.

A situation with only two possible outcomes: loss or no loss. There is no chance of gain, so pure risks are usually the focus of insurance.

A situation that can produce a loss, no change, or a gain. Business ventures and investments involve speculative risk, which is generally not insurable.

The actual cause of a loss, such as fire, flood, theft, or a collision. Insurance policies typically name the perils they cover.

A condition that increases the chance or size of a loss from a given peril, such as icy sidewalks, faulty wiring, or careless driving habits.

Any person, property, activity, or financial interest that could be harmed by a loss event and therefore represents a potential claim or cost.

How often a loss is expected to occur over a defined period. Higher frequency usually calls for stronger loss control and more retention planning.

The size or cost of an individual loss when it occurs. High-severity exposures are often transferred to insurers or managed with strict limits.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed broadly and used to guide decisions.

Accepting the financial consequences of a risk rather than transferring or avoiding it. Retention may be planned, such as a deductible, or unplanned.

Shifting the financial consequences of a risk to another party, most commonly through insurance, contracts, hedging, or outsourcing arrangements.

A risk control measure that reduces the likelihood of a loss occurring, such as installing alarms, training employees, or performing maintenance.

A company-wide approach that identifies, assesses, and manages all major risks together, aligning risk decisions with the organization's strategy and objectives.

The risk that remains after controls, insurance, or other treatments have been applied. It must be monitored to confirm it stays within acceptable limits.

A tendency for people to take greater risks or exercise less care because insurance or another arrangement will cover the consequences of a loss.

A situation where people with higher-than-average risk are more likely to buy or keep insurance, which can raise costs for the entire insured group.

The practices, technologies, and controls used to protect computer systems, networks, and data from unauthorized access, attack, or damage.

The possibility of financial loss, operational disruption, or reputational harm from failures or attacks involving computers, networks, and digital data.

An incident in which sensitive, protected, or confidential information is accessed, disclosed, altered, or destroyed without authorization, often triggering legal notice duties and liability.

Malicious software that locks or encrypts a victim's files or systems and demands payment, usually in cryptocurrency, to restore access.

A fraudulent message, often an email or text, that impersonates a trusted party to trick recipients into revealing credentials, clicking links, or sending money.

A network of everyday devices, such as sensors, cameras, and appliances, connected to the internet, creating new convenience along with expanded cyber and privacy exposures.

Computer systems that perform tasks normally requiring human intelligence, such as learning, prediction, and decision-making, raising risks of error, bias, and accountability.

The delivery of computing services, storage, and software over the internet from remote servers, which shifts some control and security responsibilities to third-party providers.

A shared, tamper-resistant digital ledger that records transactions across many computers, supporting uses such as cryptocurrency, smart contracts, and supply-chain tracking.

Technology that collects and transmits data about a vehicle or device's use, such as mileage, location, and driving behavior, often used to price insurance or manage risk.

A policy that can cover losses from cyber events, such as data breaches, ransomware, network interruption, and related legal or notification expenses.

The overall structure of policies, roles, processes, and tools an organization uses to identify, assess, treat, and monitor risk on an ongoing basis.

The way authority and accountability for risk decisions are assigned and overseen, typically by the board, executives, and risk committees, and how those groups interact.

A model that separates risk-taking and managing (first line), independent oversight and compliance (second line), and objective assurance (third line, internal audit).

The shared values, attitudes, and behaviors in an organization that determine how people identify, discuss, and respond to risk in daily work.

A measurable metric that signals increasing or decreasing exposure to a significant risk, giving management an early warning before losses occur.

A structured record listing identified risks, their causes, potential impacts, existing controls, owners, and planned treatments, used to track and review risk.

A document that specifies the chosen response to each significant risk, the actions required, responsible persons, resources, and target completion dates.

A process for preparing an organization to keep critical operations running or restore them quickly after a disruption, using plans, backups, and alternate arrangements.

The coordinated response to a sudden, high-impact event, focused on protecting people, communicating with stakeholders, and stabilizing operations.

A technique that explores how plausible future events or combinations of events could affect the organization, helping test strategies and identify emerging risks.

A licensed insurance company owned by a non-insurance organization to finance its own risks, often providing cost savings and direct access to reinsurance markets.

An independent function that reviews controls, risk management, and governance and reports findings to senior management and the board or audit committee.