RMIA CPRM flashcards
RMIA CPRM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Definition of risk
- The effect of uncertainty on objectives. It combines the likelihood of an event with its consequences and can be negative (threat) or positive (opportunity).
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives, stated qualitatively or quantitatively by leadership.
- Risk tolerance
- The acceptable variation or deviation around the stated risk appetite for a specific risk category, often expressed as a threshold or limit.
- Risk capacity
- The maximum level of risk the organization can absorb before breaching objectives, legal obligations, or financial solvency; it is a hard constraint above appetite.
- Inherent risk
- The level of risk exposure before any controls or treatments are applied; it establishes the baseline against which control effectiveness is measured.
- Residual risk
- The risk remaining after controls and treatments have been applied. It must be compared against risk criteria to confirm it is tolerable.
- Risk criteria
- Documented terms of reference used to evaluate the significance of risk, including thresholds, legal requirements, and organizational objectives that define acceptability.
- Expected monetary value
- A quantitative technique: EMV equals the sum of each outcome's probability multiplied by its monetary value, giving a probability-weighted average outcome.
- Monte Carlo simulation
- A quantitative method that repeatedly samples probability distributions for uncertain inputs to produce a distribution of possible project or portfolio outcomes.
- Risk matrix
- A grid plotting likelihood against consequence using defined scales and color bands, used to rank risks and prioritize treatment decisions.
- Risk treatment hierarchy
- The ordered set of response options: avoid, reduce or mitigate, transfer or share, and accept or retain, selected by cost-benefit comparison.
- Risk transfer
- Shifting the financial consequence of a risk to a third party, such as an insurer or contractor; accountability for the risk generally remains with the originator.
- Risk avoidance
- Eliminating the activity or exposure that generates a risk entirely; effective for unacceptable risks but may forfeit associated opportunities or benefits.
- Risk identification
- The process of finding, recognizing, and describing risks, using techniques such as brainstorming, checklists, interviews, FMEA, and scenario analysis.
- SWOT analysis
- A structured technique examining strengths, weaknesses, opportunities, and threats; weaknesses and threats inform internal and external risk identification.
- FMEA
- Failure mode and effects analysis: a bottom-up technique that identifies how components can fail, rates severity, occurrence, and detection, and prioritizes corrective action.
- HAZOP study
- Hazard and operability study: a systematic team-based technique applying guide words to process parameters to identify deviations and their causes and consequences.
- Fault tree analysis
- A deductive top-down technique that starts with an undesired event and uses Boolean logic gates to trace the combinations of failures that could cause it.
- Bow-tie analysis
- A diagram with a central event, threats and preventive controls on the left, and consequences and mitigating controls on the right, linking causes to outcomes.
- Risk register
- A living record of identified risks containing description, cause, consequence, owner, likelihood, impact, score, controls, treatment actions, due dates, and status.
- Risk owner
- The named individual accountable for managing a specific risk and its response, with the authority and resources to implement and monitor treatment.
- Action owner
- The person responsible for completing a specific mitigation task within a treatment plan; distinct from the risk owner who holds overall accountability.
- Key risk indicator
- A leading metric with defined thresholds that signals whether risk exposure is rising or falling, enabling proactive intervention before losses occur.
- Risk heat map
- A visual display positioning risks on likelihood and impact axes with defined color bands, used to communicate relative exposure to decision makers.
- Business impact analysis
- A process identifying critical business functions and the consequences of their disruption, establishing recovery priorities, RTOs, and RPOs.
- Recovery time objective
- The maximum tolerable duration of disruption for a process before unacceptable consequences occur; it drives continuity strategy selection.
- Recovery point objective
- The maximum tolerable amount of data loss measured in time, determining backup frequency and replication design for critical systems.
- Three lines model
- A governance structure: management owns risk, a risk and compliance function monitors and advises, and internal audit provides independent assurance.
- Risk aggregation
- Combining individual risk exposures across the organization; correlation and concentration can make the aggregate exceed the simple sum of parts.
- Emerging risk
- A risk that is new, changing, or newly visible, characterized by high uncertainty, rapid change, and limited organizational awareness or historical data.
- Horizon scanning
- A systematic process of looking for early signals of change in the external environment to identify emerging risks and opportunities before they materialize.
- Control effectiveness
- The degree to which a control reduces the likelihood or impact of a risk, measured as the difference between inherent and residual risk levels.