RMIA CPRM key terms

The effect of uncertainty on objectives, usually expressed as a combination of the likelihood of an event and the severity of its consequences, whether positive or negative.

Coordinated activities to direct and control an organization with regard to risk, including identifying, assessing, treating, monitoring, and communicating risks in support of objectives.

The set of components, policies, processes, and governance arrangements that provide the foundations and arrangements for designing, implementing, and improving risk management throughout an organization.

The amount and type of risk an organization is willing to pursue or retain in order to achieve its objectives, stated at an aggregate level and approved by leadership.

The acceptable variation or deviation from the stated risk appetite that an organization is willing to bear for a specific objective, category, or activity.

The maximum amount of risk an organization can absorb before its financial, operational, or reputational viability is threatened, independent of what it chooses to accept.

A defined point or limit that triggers a specific action or escalation when exceeded, used to convert appetite and tolerance statements into operational decision rules.

The level of risk that exists before considering the effect of existing controls, used as a baseline for judging whether treatment is warranted and proportionate.

The level of risk remaining after existing controls and treatments have been applied, which must be compared against tolerance to decide on further action.

The process of finding, recognizing, and describing risks, including their sources, events, causes, and potential consequences, and recording them in a structured inventory.

An element, circumstance, or condition that alone or in combination has the potential to give rise to risk, such as people, processes, systems, or external environment.

The process of understanding the nature and characteristics of a risk, including its causes, consequences, likelihood, and the effectiveness of existing controls.

The process of comparing the results of risk analysis with established criteria to determine whether a risk is acceptable or requires treatment.

The reference values, thresholds, and standards used to evaluate the significance of risk, often reflecting legal requirements, organizational objectives, and stakeholder expectations.

The chance or probability that a specified event or consequence will occur, expressed qualitatively or quantitatively and often combined with impact in risk scoring.

The magnitude of the consequences of an event on objectives, which may be measured in financial, operational, safety, legal, or reputational terms.

A tool that plots likelihood against impact across defined scales to produce a risk rating, supporting prioritization and comparison of risks.

A structured record of identified risks containing attributes such as owner, cause, consequence, rating, controls, treatment actions, and status, used to track and report risk.

The person or entity accountable for managing a particular risk, including approving treatment decisions and monitoring changes in the risk profile.

The process of selecting and implementing options to modify risk, such as avoiding, reducing, transferring, or accepting it, and evaluating whether residual risk is acceptable.

A treatment decision to retain a risk without further modification, made knowingly by an authorized person when the risk falls within tolerance or treatment is not cost-effective.

A treatment option that shifts the financial or contractual consequences of a risk to another party, such as through insurance or outsourcing, without eliminating the underlying source.

A treatment option that eliminates a risk by not commencing or by discontinuing the activity that gives rise to it, which may forgo associated opportunities.

A measure that maintains and modifies risk, such as a policy, procedure, system, or physical safeguard, intended to prevent, detect, or correct unwanted events.

The degree to which a control achieves its intended purpose when operating as designed, an input to judging residual risk and prioritizing control improvements.

A metric used to monitor changes in the level of exposure to a risk and provide early warning that a risk is approaching or exceeding a defined threshold.

The ongoing process of tracking identified risks, control performance, and the effectiveness of treatments, and recording and reporting changes to support decisions.

A periodic or triggered reassessment of risk information and treatment progress to confirm that assumptions, ratings, and controls remain valid and relevant.

The arrangements by which leadership directs and oversees risk management, including roles, accountability, reporting lines, committee structures, and escalation paths.

A governance structure that separates management's ownership of risk, independent risk and compliance oversight functions, and internal audit's independent assurance role.

An independent and objective assurance function that evaluates the design and operating effectiveness of risk management, control, and governance processes and reports to the board.

An independent assessment or verification, often evidence-based, that risk management and controls are operating as intended and that reported information is reliable.

The shared values, beliefs, and behaviors within an organization that shape how people identify, discuss, and respond to risk in everyday decisions.

The signals sent by senior leadership through their words and actions about the importance of risk management and ethical behavior, which shape behavior throughout the organization.

The structured communication of risk information, including ratings, trends, and treatment status, to decision-makers and stakeholders in a form that supports action.

The process of raising a risk or issue to a higher authority when it exceeds defined thresholds or when local resolution is not possible within delegated limits.

A structured investigative method used to identify the underlying conditions that produced an event or loss, so that corrective actions address causes rather than symptoms.

The process of recording, classifying, investigating, and responding to events that have occurred, capturing lessons learned and feeding them back into risk assessment.

A technique that explores plausible future events or combinations of circumstances to assess potential consequences and inform planning and stress testing.

A technique that evaluates how a portfolio, process, or organization would perform under severe but plausible adverse conditions, used to challenge assumptions and capital adequacy.

The practice of weighing the assessed level of risk against objectives, costs, and opportunities when choosing among alternatives, rather than relying on intuition alone.

A capability to plan for and respond to disruptive incidents, maintaining critical operations at acceptable levels through recovery strategies and tested plans.

A risk that is newly identified or changing in nature and whose full consequences are not yet well understood, requiring early monitoring and adaptive response.

The process of combining individual risk exposures across units or categories to understand the total exposure and interdependencies facing the organization.

A relationship in which one risk or control affects the likelihood or impact of another, meaning risks must be assessed in combination rather than in isolation.

The stage of development of an organization's risk management capability, typically described along a progression from ad hoc practices to integrated, continuously improving processes.

A documented schedule of actions, responsibilities, resources, and target dates for implementing selected risk treatment options and monitoring their completion.

An audit schedule that prioritizes areas of higher assessed risk and weaker controls, aligning assurance effort with the organization's risk profile.