CRM55 key terms

The effect of uncertainty on objectives, often expressed as the chance of a loss or an unfavorable outcome combined with the size of that outcome.

A state in which outcomes, timing, or consequences are not known exactly, so decisions must be made with incomplete information and varying degrees of confidence.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated in broad terms and approved by senior leadership.

The specific amount of variation in outcomes an organization can accept for a particular risk or category, often expressed as limits, thresholds, or ranges.

The maximum risk an organization can bear before its financial resources, operations, or mission are seriously impaired, determined by capital, cash flow, and obligations.

The system of direction, oversight, and accountability through which leaders set objectives, assign authority, monitor performance, and ensure risks are managed appropriately.

A governance structure in which operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

A person with authority and accountability for managing a specific risk, including selecting treatments, monitoring changes, and reporting on the risk's status.

The level of risk that exists before any controls or treatments are applied, useful as a baseline for judging how much protection controls actually provide.

The level of risk remaining after controls and treatments have been applied, which leadership compares with tolerance to decide whether further action is needed.

A condition, substance, activity, or source that has the potential to cause harm, damage, injury, or loss, but does not by itself guarantee that harm will occur.

The extent to which an organization is subject to potential loss from a hazard or peril, often measured by values at risk, people affected, or time exposed.

A specific event or cause of loss, such as fire, flood, theft, or liability claim, that can act on an exposure and produce damage or financial consequences.

The number of times a loss event or claim is expected to occur within a defined period, often expressed as a probability or a count per year.

The size or financial impact of a single loss event, including direct damage, business interruption, liability payments, and other consequences that may follow.

The average loss anticipated over a period, calculated by multiplying the probability or frequency of an event by its likely severity or average cost.

A structured record of identified risks that typically lists each risk, its causes and consequences, its owner, existing controls, ratings, and planned actions.

A diagram that places a risk event at the center, shows threats and causes on one side, and consequences on the other, with controls along each pathway.

A process that identifies critical business functions, estimates how disruption affects them over time, and sets recovery priorities, objectives, and resource needs for continuity planning.

An action, device, policy, or process that reduces the likelihood or impact of a loss, or that helps detect and correct problems after they arise.

Measures that reduce the probability or frequency of a loss event, such as safety training, maintenance programs, security, and design changes that remove hazards.

Measures that lessen the severity or size of a loss once an event occurs, such as sprinkler systems, emergency response, backups, and rapid claims handling.

A risk control technique that spreads people, assets, or activities across different locations or units so a single event cannot destroy everything at once.

Documented procedures that help an organization continue or restore critical operations during and after a disruption, including roles, communications, resources, and recovery steps.

The process of arranging funds or contractual protections to pay for losses that occur, using methods such as retention, insurance, or capital markets.

A risk financing choice in which an organization keeps some or all of a loss exposure and pays for resulting losses from its own resources rather than transferring them.

A contract in which an insurer agrees to pay specified losses of an insured in exchange for a premium, pooling many similar exposures according to policy terms.

The amount an insured must pay toward a covered loss before the insurer pays its share, reducing small claims and lowering the premium.

A licensed insurance company owned by a non-insurance organization, formed mainly to insure the parent's risks and often to retain selected exposures more efficiently.

A coordinated approach to identifying, assessing, treating, and monitoring risks across an entire organization, linking risk decisions with strategy, capital, and performance.

A measurable signal that shows whether a risk is rising or falling, chosen because it changes before or alongside changes in the likelihood or impact of loss.

The shared values, beliefs, and behaviors that shape how people identify, discuss, escalate, and act on risk within an organization.

A risk that is new, changing, or not yet fully understood, and that could grow in importance because of technology, regulation, environment, markets, or social trends.

A visual grid that plots risks by likelihood and impact, often using color bands, so leaders can compare exposures and prioritize treatment and monitoring.

A measure used to track progress toward objectives, such as output, timeliness, cost, or service quality, which risk reporting may compare with risk indicators.

A report from an insurer listing claims history for a policy period, including dates, causes, amounts paid, reserves, and status, used in underwriting and risk review.

A summary display that presents selected risk metrics, limits, incidents, and trends in a concise format so decision makers can monitor exposures at a glance.

A technique that matches sources of assurance, such as audits, testing, and management reviews, to key risks and controls to reveal gaps and duplication.

A process for employees or others to record and escalate events, near misses, and control failures so the organization can respond, investigate, and prevent recurrence.

Comparing an organization's risk practices, losses, or performance measures with peers, industry data, or recognized standards to identify gaps and improvement opportunities.