CRM55 flashcards
CRM55 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Risk
- The effect of uncertainty on objectives, encompassing potential positive or negative deviations from expected outcomes and measured by likelihood and impact.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, approved and overseen at governance level.
- Risk tolerance
- The acceptable variation around a risk appetite or objective threshold; it defines when escalation or corrective action is required.
- Three lines model
- A governance structure where operating management owns risk, independent oversight functions monitor and advise, and internal audit provides independent assurance to the board.
- Residual risk
- The risk remaining after existing controls and treatments have been applied; it is compared with target risk and appetite to decide further action.
- Expected annual loss
- The sum of each event's probability multiplied by its financial severity over a year; used to compare exposures and prioritize risk treatments.
- Hazard
- A source or condition with potential to cause harm, loss, or disruption; it is distinct from risk, which combines likelihood and consequence.
- FMEA
- Failure mode and effects analysis: a structured method that identifies how a process or product can fail, rates severity, occurrence, and detection, and prioritizes corrective action.
- Risk register
- A structured record of identified risks containing description, cause, consequence, owner, likelihood, impact, controls, residual rating, treatment actions, and review dates.
- Concentration risk
- Exposure accumulation from correlated or common-cause events, such as one supplier, region, or system, which can produce losses larger than individual estimates suggest.
- Hierarchy of controls
- A preferred order for reducing risk: eliminate the hazard, substitute it, apply engineering controls, use administrative controls, then rely on personal protective equipment.
- Loss prevention
- Controls and practices that reduce the likelihood or frequency of a loss event, such as maintenance, training, inspection, and access restrictions.
- Loss reduction
- Measures that lessen the severity or consequences of a loss after it occurs, such as sprinklers, containment, backup systems, and emergency response.
- Recovery time objective
- Recovery time objective: the maximum acceptable time to restore a process or system after disruption, derived from business impact analysis.
- Detective control
- A control designed to identify errors, irregularities, or adverse events after they occur, enabling timely correction and escalation.
- Insurable interest
- A financial stake in the subject matter such that loss or damage causes a measurable economic detriment, supporting enforceability of an insurance contract.
- Claims-made policy
- Insurance covering claims first made or reported during the policy period, often with a retroactive date and extended reporting period.
- Coinsurance clause
- A property insurance condition that penalizes underinsurance by applying the ratio of carried insurance to required insurance when calculating a covered loss payment.
- Captive insurer
- A licensed insurance company owned by a non-insurance parent to finance retained risks, subject to regulatory capital, governance, and reinsurance arrangements.
- Cost of risk
- The total cost of managing risk, typically including insurance premiums, retained losses, administration, control costs, and risk-financing expenses.
- Operational risk
- The risk of loss from inadequate or failed internal processes, people, systems, or external events, including legal, fraud, cyber, and conduct exposures.
- Risk and control self-assessment
- Risk and control self-assessment: a structured process in which business units identify risks, evaluate controls, and rate residual exposure with action plans.
- Key risk indicator
- A measurable metric linked to a risk that provides early warning of increasing exposure and is monitored against defined thresholds with an accountable owner.
- Stress testing
- A forward-looking technique that applies severe but plausible scenarios to portfolios or operations to estimate potential losses and capital or liquidity needs.
- Third-party risk
- Exposure arising from vendors, suppliers, outsourcers, or partners whose failure, misconduct, or disruption can affect the organization's operations, compliance, or reputation.
- Model risk
- The potential for adverse consequences from decisions based on incorrect or misused models, including data, assumptions, design, implementation, and governance weaknesses.
- Risk reporting
- The structured communication of risk information to defined audiences, covering top exposures, appetite status, incidents, control effectiveness, and treatment progress at an appropriate frequency.
- KRI threshold
- A predefined trigger level for a key risk indicator that signals increasing exposure and initiates escalation, investigation, or corrective action.
- Assurance map
- A tool that records sources and coverage of assurance across risk areas, helping identify gaps, duplication, and reliance on independent oversight.
- PDCA cycle
- A continual improvement cycle of plan, do, check, and act used to design, operate, monitor, and refine risk management processes.
- Maturity model
- A staged framework describing progression of risk management capability from ad hoc practices through defined, integrated, and optimized performance.
- Post-incident review
- A structured examination after an incident to identify causes, control failures, response effectiveness, and corrective actions for preventing recurrence.