Enterprise Risk Management (ERM) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Enterprise Risk Management

A structured, entity-wide process used by boards and management to identify potential events, manage risk within a stated appetite, and provide reasonable assurance about achieving strategic objectives.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its mission and value. It is set at entity level and guides strategy and resource allocation decisions.

Risk Tolerance

The acceptable variation in performance relative to a specific objective. Tolerances translate broad entity-level risk appetite into measurable limits for individual objectives and units.

Risk Capacity

The maximum risk an organization can bear before breaching constraints such as capital, liquidity, or regulatory limits. Capacity is a hard boundary; appetite should be set below it.

COSO ERM 2017 Components

Five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting. Together they support twenty underlying principles.

Three Lines Model

A governance structure: the first line owns and manages risk in operations; the second provides independent oversight and frameworks; the third, internal audit, gives independent assurance to the board.

Chief Risk Officer Role

Leads the enterprise risk program, coordinates risk assessment and aggregation, challenges business risk-taking, reports top risks to the board, and promotes a strong risk culture.

Board Risk Committee

A board committee that oversees the risk management framework, reviews the top risk profile and tolerances, approves risk appetite, and monitors whether management stays within approved limits.

Risk Culture

The shared values and behaviors that determine how risk is identified and handled. Indicators include tone at the top, accountability, incentive alignment, and willingness to escalate bad news.

Risk Universe

The complete inventory of risk categories relevant to the entity, commonly strategic, operational, financial, compliance, and reputational. It defines the scope of the ERM program.

Key Risk Indicator

A metric that signals rising or falling exposure to a specific risk. Effective indicators are measurable, predictive, owned by a responsible manager, and tied to defined thresholds.

Risk Aggregation

The process of combining individual risk exposures into an entity-level view, accounting for correlations and diversification, to compare total risk against appetite and capital.

Strategy-Risk Alignment

The requirement that risk appetite be considered when selecting strategy and objectives, so risk is evaluated before a strategy is accepted rather than only after implementation.

Risk Appetite Statement

A formal document specifying the types and levels of risk acceptable for major categories, expressed qualitatively and quantitatively, with limits and escalation triggers for breaches.

Risk Owner

The individual accountable for managing a specific risk, including selecting a response, maintaining controls, monitoring indicators, and reporting changes in residual exposure.

Inherent Versus Residual Risk

Inherent risk is the exposure before considering controls; residual risk is the exposure remaining after controls operate. Responses are judged by whether residual risk falls within tolerance.

Risk Register

A structured record of identified risks with description, category, owner, causes, consequences, likelihood and impact ratings, controls, response plans, and status tracking.

Risk Response Options

Four standard responses: avoid by exiting the activity; reduce by mitigating likelihood or impact; share or transfer through insurance, hedging, or contracts; accept and monitor within tolerance.

Expected Loss Formula

Expected loss equals probability of default times loss given default times exposure at default (EL = PD x LGD x EAD). LGD is a fraction of exposure not recovered after default.

Value at Risk

The loss threshold that is not expected to be exceeded with a given confidence level over a defined horizon. It says nothing about the magnitude of losses beyond the threshold.

Expected Shortfall

The average loss occurring in the tail beyond the Value at Risk threshold. Also called conditional VaR; it is subadditive and captures tail severity that VaR ignores.

Monte Carlo Simulation

A technique that samples inputs from specified probability distributions, runs many iterations, and builds an output distribution of possible outcomes for risk or valuation estimates.

Sensitivity Analysis

A method that varies one input or assumption at a time to measure how much an output changes, identifying which variables most influence the result.

Scenario Analysis

An assessment that changes several related inputs coherently to model a plausible future state, capturing interactions that single-variable sensitivity analysis cannot reveal.

Stress Testing

Applying severe but plausible adverse conditions, often beyond historical experience, to assess whether exposures, capital, and liquidity remain adequate under extreme scenarios.

Backtesting

Comparing model-predicted outcomes or risk measures with actual realized results over a period to evaluate whether the model remains accurate and appropriately calibrated.

Model Risk

The risk of adverse consequences from decisions based on incorrect or misused model outputs, arising from flawed assumptions, data errors, implementation faults, or inappropriate application.

Independent Model Validation

Review of a model by parties not involved in its development, assessing conceptual soundness, data quality, implementation, outputs, limitations, and ongoing performance monitoring.

Correlation Risk

The risk that assumed relationships between variables change, especially in stress, reducing diversification benefits and making portfolio risk higher than models predict.

Fat Tails

A distribution property where extreme outcomes occur more often than a normal distribution implies. Fat-tailed risks make normal-based VaR understate tail losses.

Risk Heat Map

A visual grid plotting risks by likelihood and impact, often colored by severity. It communicates relative priority but compresses quantitative detail into ordinal ratings.

Control Effectiveness Rating

An assessment of whether a control is designed appropriately and operating as intended. The rating adjusts residual risk and informs whether further response is required.

Risk-Adjusted Return

A performance measure comparing return with the risk taken to generate it, such as return on risk-adjusted capital, used to align business incentives with appetite.