CRM55 cheat sheet

Risk is the effect of uncertainty on objectives; it can be positive or negative and is commonly assessed through likelihood and impact.

Risk management comprises coordinated activities to direct and control an organization with regard to risk, integrated into strategy and performance.

Risk appetite is the amount and type of risk an organization is willing to pursue; risk tolerance is acceptable variation around appetite; risk capacity is the maximum bearable risk.

The three lines model assigns risk ownership to operating management, independent oversight to risk and compliance functions, and independent assurance to internal audit.

The COSO ERM framework has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

Inherent risk is assessed before controls; residual risk after controls; target risk is the desired level, and gaps drive treatment decisions.

Risk criteria define how significance is judged, including likelihood-impact matrices, quantitative thresholds, and escalation triggers.

Expected loss equals probability of an event multiplied by its financial severity; risk score commonly equals likelihood rating multiplied by impact rating.

Risk identification draws on brainstorming, interviews, workshops, process maps, inspections, loss data, near misses, audits, and scenario analysis.

Structured techniques include SWOT, PESTLE, HAZOP, FMEA, fault-tree analysis, event-tree analysis, and Delphi review.

A hazard is a source of harm; exposure is the potential for financial or nonfinancial loss from a hazard interacting with an asset, activity, or liability.

Expected annual loss is the sum over events of frequency times average severity; it supports ranking and treatment prioritization.

Exposure analysis considers property replacement cost, business interruption, extra expense, liability, personnel, and reputational consequences.

Concentration and correlation can make aggregate exposure larger than the sum of individually assessed risks, especially with common suppliers, systems, or locations.

Root-cause analysis distinguishes immediate causes from underlying system causes using methods such as the five whys and cause-and-effect diagrams.

A risk register typically records risk ID, description, cause, consequence, owner, likelihood, impact, controls, residual rating, treatment, and review date.

The hierarchy of controls orders risk reduction as elimination, substitution, engineering controls, administrative controls, and personal protective equipment.

Loss prevention reduces the frequency of loss; loss reduction reduces the severity or consequences after a loss event.

Preventive controls stop errors before they occur; detective controls identify them afterward; corrective controls restore conditions and limit recurrence.

Control effectiveness is assessed by design adequacy and operating effectiveness, not by the mere existence of a documented control.

Segregation of duties, authorization limits, reconciliations, physical safeguards, access controls, and maintenance are common control mechanisms.

Business impact analysis identifies critical processes and sets recovery time objectives, recovery point objectives, and maximum tolerable downtime.

Residual risk is compared with risk appetite and target risk; unacceptable gaps require additional treatment, transfer, avoidance, or acceptance with authority.

Control cost is justified when marginal reduction in expected loss and nonfinancial benefit exceed the control's total cost, subject to legal and regulatory requirements.

Risk financing options include retention, insurance, contractual transfer, captives, hedging, and securitization; the choice balances cost, volatility, and control.

Insurance pools independent exposures; premiums must cover expected losses, expenses, profit, and risk margin, and are reduced by deductibles and limits.

Insurable risks are typically measurable, accidental, definable, and sufficiently independent for pooling; catastrophic and unquantifiable risks often need alternative financing.

Occurrence policies cover injury or damage occurring during the policy period; claims-made policies cover claims first made or reported during the period, subject to retroactive dates.

Property coinsurance payment equals insurance carried divided by insurance required, multiplied by the loss, then adjusted for deductible and policy limit.

Actual cash value equals replacement cost less depreciation; replacement cost pays repair or replacement without depreciation, subject to policy terms.

Captives retain risk within a licensed insurer owned by the parent, requiring capital, governance, actuarial analysis, and reinsurance for large losses.

Cost of risk includes insurance premiums, retained losses, administration, control costs, and risk-financing expenses; it is used to compare financing alternatives.

Operational risk is loss from inadequate or failed processes, people, systems, or external events; legal risk is included, while strategic and reputational risk are often categorized separately.

Enterprise risk management aggregates strategic, operational, financial, compliance, and reputational exposures against appetite and capital.

Risk and control self-assessments identify risks, evaluate control design and performance, and rate residual exposure with owned action plans.

Key risk indicators are measurable, predictive metrics with thresholds and owners; breaches trigger escalation, investigation, and corrective action.

Operational loss event types include internal fraud, external fraud, employment practices, clients and business practices, physical asset damage, system failures, and process execution failures.

Scenario analysis and stress testing apply severe but plausible events to estimate tail losses, capital needs, liquidity strain, and operational disruption.

Third-party risk management covers vendor due diligence, contract terms, ongoing monitoring, concentration, subcontractors, and exit or continuity planning.

Model risk arises from data, assumptions, design, implementation, and use; controls include validation, documentation, change control, and independent review.

A risk program includes policy, governance, risk registers, assessment schedules, treatment plans, training, communication, reporting, and independent assurance.

Monitoring combines ongoing management review, key risk indicators, control testing, incident tracking, audit findings, and action-plan follow-up.

Risk reporting is tailored to audience and frequency; board reports typically cover top risks, appetite status, movements, incidents, control effectiveness, and treatment progress.

Useful program metrics include loss frequency and severity, near-miss counts, overdue actions, control test pass rates, incident resolution time, and appetite breaches.

An assurance map records assurance sources and coverage by risk area, revealing gaps, duplication, and overreliance on a single assurance provider.

Maturity models typically progress from ad hoc to developing, defined, managed, and optimized risk management capability.

Continual improvement uses plan-do-check-act cycles, post-incident reviews, lessons learned, and updates to risk criteria and controls.

Records should be complete, accurate, timely, and retained according to legal, regulatory, privacy, and confidentiality requirements.