AIRAF key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated qualitatively and often bounded by quantitative tolerances that guide decision-making across business units.

The maximum level of risk an organization can bear before breaching constraints such as capital adequacy, liquidity, or solvency, independent of how much risk it chooses to take.

The acceptable variation around a risk appetite, expressed as measurable limits or thresholds that trigger escalation when approached or breached by a business line or portfolio.

A governance structure separating operational management, independent risk oversight and compliance functions, and internal audit, each with distinct responsibilities for identifying, managing, and assuring risks.

An integrated, organization-wide approach to identifying, assessing, and managing risks across all functions, aligning risk decisions with strategy, capital allocation, and performance objectives rather than treating risks in silos.

The shared values, behaviors, and norms that determine how employees identify, discuss, and act on risk, including willingness to escalate concerns without fear of reprisal.

The signals sent by senior leadership through words and actions that set expectations for ethical conduct and risk management throughout the organization.

A structured log recording identified risks, their owners, likelihood and impact ratings, existing controls, and planned responses, used to track and prioritize risk treatment over time.

The individual accountable for managing a specific risk, including approving assessments, implementing responses, and monitoring changes in exposure within assigned authority.

The level of risk existing before any controls or mitigants are applied, providing a baseline against which the effectiveness of controls can be measured.

The risk remaining after existing controls and mitigants have been applied, compared against tolerance to determine whether further treatment is required.

A visual matrix plotting risks by likelihood and impact, often color-coded, to help committees compare exposures and prioritize attention across a portfolio.

The estimated probability or frequency that a given risk event will occur within a defined period, informed by historical data, expert judgment, or scenario analysis.

The magnitude of consequences if a risk event occurs, measured in financial, operational, regulatory, or reputational terms and often scaled to organizational size.

A statistical estimate of the maximum loss a portfolio is expected to incur over a specified horizon at a given confidence level, widely used for market risk measurement.

The average loss conditional on losses exceeding the Value at Risk threshold, capturing tail severity that Value at Risk alone does not reveal.

Analysis of portfolio or institution performance under severe but plausible adverse scenarios, such as sharp rate moves or prolonged recessions, to reveal vulnerabilities beyond normal statistical assumptions.

A forward-looking technique that defines coherent hypothetical futures and traces their combined effects on exposures, cash flows, and capital, complementing historical and statistical models.

A computational method generating many random paths for risk factors to produce a distribution of outcomes, supporting valuation, capital estimation, and probabilistic risk assessment.

Comparison of model-generated risk estimates with actual realized outcomes over time to validate accuracy and detect underestimation of losses.

The potential for adverse consequences from decisions based on incorrect or misused model outputs, arising from flawed assumptions, poor data, or inappropriate application.

Actions taken to reduce the likelihood or impact of a risk, including avoidance, reduction, transfer, and acceptance, selected according to cost, effectiveness, and appetite.

An assessment of whether a control is designed appropriately and operates as intended, rated by testing results and used to derive residual risk from inherent risk.

Structured examination of controls through inquiry, observation, inspection, or reperformance to confirm they function reliably over the review period.

A control critical to preventing or detecting a significant risk, warranting more frequent monitoring and stronger evidence of operating effectiveness than secondary controls.

A transaction or position that offsets exposure to a risk factor, such as an interest rate swap or currency forward, reducing volatility at a cost that includes basis and counterparty risk.

A forward-looking metric tracked against thresholds to provide early warning of rising risk exposure, enabling timely management action before losses materialize.

The periodic communication of risk exposures, limit utilization, incidents, and emerging concerns to management, committees, and the board in a form suited to each audience.

The defined process for raising risks, breaches, or incidents to higher authority within specified timeframes so that decisions and resources are applied appropriately.

A concise visual summary of selected risk metrics, trends, and limit status designed for executive and board oversight rather than detailed operational use.

The process of selecting and implementing options to modify risk, including avoidance, reduction, transfer, and acceptance, documented with owners and target dates.

The minimum capital an institution must hold against risk-weighted exposures under applicable rules, serving as a buffer against unexpected losses and a constraint on risk-taking.

Due diligence procedures verifying client identity, business nature, and source of funds to prevent money laundering, fraud, and sanctions violations.

Laws, regulations, and internal programs designed to detect and prevent the disguising of illicit proceeds through monitoring, reporting, and recordkeeping obligations.

A confidential filing to the appropriate authority describing transactions that appear unusual or potentially linked to unlawful activity, made without notifying the customer.

Situations where personal, financial, or organizational interests could improperly influence professional judgment, requiring disclosure, avoidance, or managed separation of duties.

A formal statement of the principles and standards of conduct expected of employees, covering integrity, confidentiality, fair dealing, and compliance with laws.

The protected reporting of suspected misconduct or unethical behavior through designated internal or regulatory channels, supported by anti-retaliation safeguards.