Enterprise Risk Management (ERM) key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively and quantitatively in a statement approved by senior leadership.

The acceptable variation around a specific risk limit or target, defining how much deviation from the desired risk level the organization can absorb without corrective action.

The maximum level of risk an organization can bear before breaching constraints such as capital, liquidity, or regulatory requirements, independent of what it chooses to accept.

A specific, measurable threshold assigned to a risk exposure or business unit that translates appetite into operational boundaries and triggers escalation when breached.

The framework of roles, responsibilities, policies, and oversight bodies through which a board and management direct and monitor risk-taking across the enterprise.

A governance structure where operating management owns risk, an independent risk function monitors it, and internal audit provides objective assurance to the board.

A structured, organization-wide process for identifying, assessing, prioritizing, and responding to risks that could affect strategic objectives, integrating risk information into decision-making.

A living inventory recording each identified risk, its owner, likelihood and impact ratings, existing controls, and planned responses, used to track and report exposures.

The individual accountable for managing a specific risk, including approving responses, monitoring indicators, and reporting changes in exposure to governance bodies.

A forward-looking metric that signals rising or falling exposure to a particular risk, enabling early warning before losses or incidents materialize.

The shared values, attitudes, and behaviors that determine how employees identify, discuss, and act on risk, including willingness to escalate concerns.

The structured communication of risk exposures, limit utilization, and emerging threats to management and the board, supporting informed oversight and timely decisions.

An independent function that evaluates the design and effectiveness of risk management and controls, reporting findings directly to the audit committee or board.

The process of evaluating identified risks by estimating likelihood and impact, often combining qualitative judgment with quantitative analysis to prioritize attention.

The level of exposure that exists before any controls or mitigation are applied, providing a baseline for judging how much risk management effort is warranted.

The exposure remaining after existing controls and mitigation measures have been applied, which is compared against tolerance to decide whether further action is needed.

A policy, procedure, or mechanism designed to reduce the likelihood or impact of a risk, such as segregation of duties, approvals, or automated validation checks.

Actions taken to lessen exposure, including transferring risk through insurance, reducing activity, diversifying, or strengthening controls, chosen based on cost-benefit analysis.

A response that eliminates an activity or exposure entirely rather than managing it, typically used when risk exceeds capacity or offers no commensurate return.

A deliberate decision to retain a risk without further action because it falls within appetite or because mitigation costs exceed expected benefits.

Shifting the financial consequences of a risk to another party, commonly through insurance, hedging, outsourcing, or contractual indemnities, without eliminating the underlying exposure.

A response that eliminates an activity or exposure entirely rather than managing it, typically used when risk exceeds capacity or offers no commensurate return.

A visual grid plotting risks by likelihood and impact, often color-coded, to help management compare exposures and prioritize responses at a glance.

A computational technique that repeatedly samples from probability distributions of uncertain inputs to produce a distribution of possible outcomes for a risk or portfolio.

A statistical estimate of the maximum loss expected over a defined horizon at a given confidence level, widely used to summarize market risk exposure.

The average loss occurring in the worst cases beyond the Value at Risk threshold, capturing tail severity that VaR alone does not reveal.

Analysis of how a portfolio or institution performs under severe but plausible adverse scenarios, used to reveal vulnerabilities that normal-period models may understate.

A forward-looking method that constructs coherent hypothetical futures, often combining multiple risk factors, to explore potential impacts on strategy and capital.

Taking an offsetting position or contract to reduce exposure to an adverse price, rate, or event movement, ideally leaving the firm's net risk within tolerance.

A measure of how two variables move together, ranging from minus one to plus one, critical for assessing diversification benefits and portfolio-level risk aggregation.

Spreading exposure across assets, counterparties, or activities so that no single loss event can severely damage the whole, reducing unsystematic risk.

The danger arising from excessive exposure to a single counterparty, sector, product, or geography, which undermines diversification and amplifies losses.

The potential for loss when a borrower or counterparty fails to meet contractual obligations such as interest or principal payments on time.

The risk that an institution cannot meet cash obligations as they fall due, or can only do so by selling assets at unfavorable prices.

The risk of loss from inadequate or failed internal processes, people, systems, or external events, excluding strategic and reputational risk in common definitions.

The potential for adverse consequences from decisions based on incorrect or misused model outputs, including flawed assumptions, data errors, or inappropriate application.

The process of combining individual risk exposures across units and risk types into an enterprise-level view, accounting for correlations and diversification effects.

A formal document articulating the types and levels of risk the organization will pursue or avoid, linking qualitative principles to quantitative limits and metrics.