CRM56 key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative statements and quantitative limits that guide decisions and constrain business activity.

The acceptable variation around a target or limit for a specific risk, defining how far actual exposure may deviate before escalation or corrective action is triggered.

The maximum level of risk an organization can bear before breaching constraints such as capital adequacy, liquidity, regulatory requirements, or solvency, independent of its stated preferences.

A governance structure in which operating management owns and manages risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

A committee of the governing body responsible for overseeing the risk management framework, approving risk appetite, and challenging management on significant exposures and emerging risks.

The senior executive accountable for the enterprise-wide risk management framework, independent risk reporting, and advising the board on aggregate risk exposures and emerging threats.

A formal document recording the organization's risk appetite, including qualitative narrative, quantitative limits, escalation thresholds, and the metrics used to monitor adherence over time.

A quantified threshold on a specific exposure or metric that translates risk appetite into operational constraints, with defined escalation and remediation steps when breached.

The level of risk present before any controls or mitigation are applied, used as a baseline to judge how much risk reduction existing controls actually deliver.

The risk remaining after existing controls and mitigation have been applied, and the figure normally compared against risk appetite and limits when making decisions.

The structured process of identifying risks, analyzing their likelihood and impact, and evaluating whether the resulting exposure is acceptable relative to defined criteria.

A living record of identified risks capturing owners, causes, consequences, assessed ratings, existing controls, planned treatments, and review dates for governance and monitoring.

The named individual accountable for managing a specific risk, including maintaining assessments, implementing treatments, and reporting changes in exposure to governance bodies.

The assessed probability or frequency that a risk event will occur within a defined period, often expressed as a rating scale, percentage, or events per year.

The assessed magnitude of consequences if a risk event occurs, measured in financial loss, regulatory sanction, operational disruption, reputational damage, or harm to people.

A grid mapping likelihood against impact to assign risk ratings and priorities, useful for consistent screening though limited by coarse scales and subjective placement.

The degree to which a control achieves its intended objective when operating as designed, assessed through testing and used to determine residual risk levels.

A control designed to stop an undesirable event or error before it occurs, such as segregation of duties, authorization limits, or access restrictions on systems.

A control designed to identify errors, omissions, or policy breaches after they occur, such as reconciliations, exception reports, and monitoring alerts reviewed by staff.

The selection and implementation of options to modify risk, including avoidance, reduction through controls, transfer to third parties, or acceptance with monitoring.

Shifting the financial consequences of a risk to another party, typically through insurance, hedging, or contractual arrangements, without eliminating the underlying exposure.

A documented decision to retain a risk without further mitigation, justified by cost-benefit analysis and approved at an authority level consistent with risk appetite.

A forward-looking metric tracked to provide early warning of rising risk exposure, selected for its predictive link to losses and monitored against defined thresholds.

A metric measuring progress toward business objectives, which must be balanced with risk indicators so that growth incentives do not encourage excessive or hidden risk-taking.

An estimate of the maximum loss on a portfolio over a defined horizon at a given confidence level, widely used but silent on the size of losses beyond that threshold.

The average loss in the worst tail of the distribution beyond a chosen confidence level, capturing tail severity that value at risk does not measure.

Analysis of portfolio or firm outcomes under severe but plausible scenarios, used to reveal vulnerabilities that statistical models calibrated on normal conditions may miss.

A technique that identifies scenarios or combinations of events severe enough to threaten the viability of the business, working backwards from failure rather than forwards from assumptions.

Comparing model-generated risk estimates with realized outcomes over time to test whether the model's assumptions and calibration remain valid and to trigger recalibration.

The risk of adverse consequences from decisions based on incorrect or misused model outputs, including flawed assumptions, poor data, or inappropriate application.

A forward-looking method that constructs coherent hypothetical futures, often combining several risk drivers, to explore exposures and inform planning beyond historical data.

The risk that a borrower or obligor fails to meet contractual payment obligations, causing loss through default, delay, or deterioration in creditworthiness.

The risk that the other party to a transaction, particularly a derivative or securities financing trade, defaults before final settlement of the contract's cash flows.

The risk that one leg of a transaction is delivered while the counterparty fails to deliver the offsetting leg, creating a temporary full principal exposure.

The estimated likelihood that an obligor will fail to meet its obligations within a specified horizon, a core input to credit pricing, provisioning, and capital calculation.

The share of exposure expected to be lost if a default occurs, reflecting collateral, seniority, and recovery prospects, usually expressed as a percentage of exposure.

The risk of loss arising from excessive exposure to a single counterparty, sector, product, or market, so that one adverse event affects a large share of the portfolio.

The risk that an institution cannot meet payment obligations as they fall due without incurring unacceptable losses, whether from cash shortfalls or impaired market liquidity.

The risk of loss from movements in market prices such as interest rates, foreign exchange rates, equity prices, and commodity prices affecting trading or balance sheet positions.

The risk that changes in interest rates reduce net interest income or economic value, arising from repricing mismatches, basis differences, and embedded optionality in products.

The risk of loss from inadequate or failed internal processes, people, systems, or external events, including fraud, errors, outages, and legal or regulatory penalties.

The risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with applicable laws, regulations, rules, and internal standards.

The risk of loss from unenforceable contracts, litigation, regulatory action, or unclear legal rights, including costs of disputes and adverse judgments.

The structured communication of risk information to management and governing bodies, covering exposures, limit utilization, incidents, and emerging risks in a timely, decision-useful form.

The defined process for raising breaches, emerging risks, or unresolved issues to higher authority levels within set timeframes so that decisions are made at the right level.

The shared values, attitudes, and behaviors that determine how people identify, discuss, and act on risk, including willingness to challenge and to report problems openly.

The signals sent by senior leaders through their decisions, incentives, and communications about the importance of ethical conduct and effective risk management.

Capital held in proportion to the risks an institution bears, ensuring that those taking greater risk maintain a larger buffer against unexpected loss.

Exposures adjusted by regulatory or internal risk weights to reflect relative credit, market, and operational risk, forming the denominator of capital adequacy ratios.