RMIA CPRM cheat sheet

Risk is the effect of uncertainty on objectives; it is expressed as a combination of the likelihood of an event and its consequences, and may be positive (opportunity) or negative (threat).

ISO 31000 risk process sequence: establish context, identify risks, analyze risks, evaluate risks, treat risks; communication/consultation and monitoring/review run across all steps.

Risk identification techniques include brainstorming, Delphi, structured interviews, SWOT, HAZOP, FMEA, fault trees, scenario analysis, and checklists; selection depends on complexity, data availability, and stakeholder breadth.

Qualitative analysis uses descriptor scales (rare, unlikely, possible, likely, almost certain) and a risk matrix; semi-quantitative analysis assigns numeric scores to scales, not true probabilities.

Quantitative analysis tools: expected value = probability x impact; EMV = sum of (probability x monetary outcome); Monte Carlo simulation yields a distribution of outcomes rather than a single point estimate.

Risk evaluation compares analysis results against risk criteria to decide: accept, treat, transfer, avoid, or exploit; tolerability thresholds define the boundary between acceptable and unacceptable risk.

The risk treatment hierarchy is avoid, reduce (mitigate), transfer (share, e.g., insurance), and accept (retain); residual risk is the risk remaining after treatment and must be re-evaluated against criteria.

Inherent risk is the exposure before controls; residual risk is after controls; control effectiveness is the gap between them, and control cost should not exceed the expected loss reduction.

Risk appetite is the amount and type of risk an organization is willing to pursue; risk tolerance is the acceptable deviation around that appetite; risk capacity is the maximum risk the organization can bear.

A risk register records, at minimum: risk ID, description, cause, consequence, owner, likelihood, impact, score, controls, treatment action, target date, and status; it is a living document reviewed on a defined cycle.

Risk ownership assigns accountability to a named individual who has authority over the risk response; the risk owner differs from the action owner who executes specific mitigation tasks.

Key risk indicators (KRIs) are leading metrics with defined thresholds (green/amber/red) that signal rising exposure; key performance indicators measure outcomes, not exposure.

Bow-tie analysis maps multiple causes (threats) on the left, a central event, and multiple consequences on the right, with preventive controls on causes and mitigating controls on consequences.

Heat maps plot likelihood against impact with risks positioned by score; color bands must be defined by documented criteria, otherwise the visual conveys no decision value.

Risk reporting to the board should present top risks against appetite, movement since last period, treatment status, incidents, and emerging risks; aggregation can hide concentration risk.

Business continuity planning: a BIA identifies critical processes, RTO is the maximum tolerable downtime, RPO is the maximum tolerable data loss; recovery strategies must meet both.

Three lines model: operational management owns and manages risk (first line); a risk/compliance function monitors and advises (second line); internal audit provides independent assurance (third line).

Emerging risk identification draws on horizon scanning, scenario planning, and external data; indicators include rapid change, high uncertainty, and low organizational awareness.