CRM54 Principles Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual risk

The risk remaining after existing controls and treatments have been applied. It is compared with risk tolerance to decide whether further action or acceptance is appropriate.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. It is set by the board and expressed in qualitative and quantitative statements.

Risk capacity

The maximum level of risk the organization can bear before breaching its capital, liquidity, or solvency constraints. Risk appetite must be set below capacity.

Three lines model

A governance structure where operating management owns and manages risk, risk and compliance functions monitor and advise, and internal audit provides independent assurance to the board.

Pure versus speculative risk

Pure risk offers only loss or no loss, such as fire damage. Speculative risk can produce gain or loss, such as entering a new market, and is generally not insurable.

Risk attitude

The organization's or individual's chosen stance toward risk, ranging from risk-averse through risk-neutral to risk-seeking. It shapes which residual risk levels are accepted.

Bow-tie analysis

A diagram placing a central event between its causes and preventive barriers on one side and its consequences and mitigating barriers on the other. It links causes to controls explicitly.

FMEA risk priority number

The product of severity, occurrence, and detection scores in failure mode and effects analysis. Higher values indicate failure modes needing earlier corrective action.

Annualized loss expectancy

The expected yearly loss from a risk, calculated as the annual rate of occurrence multiplied by the average loss per event. It supports cost-benefit comparison of controls.

Risk register

A structured record of identified risks, each with description, cause, consequence, owner, inherent and residual ratings, controls, treatment actions, and review dates.

SWIFT technique

Structured What-If Technique: a facilitated workshop using standardized prompt words to systematically challenge a process and identify deviations and their consequences.

Delphi method

An iterative, anonymous expert-consultation technique where responses are summarized and reshared across rounds until views converge, reducing dominance and group pressure.

Correlated risk

A situation where multiple exposures are triggered by the same event or driver, so aggregate loss can greatly exceed the sum of individually assessed losses.

Hierarchy of controls

A ranking of treatment strength: eliminate the hazard, substitute it, apply engineering controls, then administrative controls, and finally personal protective equipment.

Preventive versus detective control

Preventive controls stop or reduce the likelihood of an event before it occurs; detective controls identify events after occurrence so that corrective action can follow.

Recovery time objective

The target time within which a process or system must be restored after disruption. It must be shorter than the maximum tolerable downtime.

Segregation of duties

A control that divides authorization, custody, recording, and reconciliation of a transaction among different people so no single person can complete and conceal it.

Risk transfer by contract

Shifting financial or legal consequence to another party through indemnities, hold-harmless clauses, or insurance. Reputational and some legal exposure usually remains.

Control effectiveness testing

Sampling transactions or observing performance to confirm a control is designed appropriately and actually operates as intended throughout the period.

Self-insured retention

A specified amount the insured retains and pays per loss before the insurance policy responds. It functions like a large deductible but differs in legal treatment.

Coinsurance clause

A property policy condition requiring the insured to carry insurance to a stated percentage of value; otherwise claims are reduced proportionally for underinsurance.

Utmost good faith

The insurance principle requiring the applicant to disclose all material facts the insurer would consider relevant. Breach may allow the insurer to avoid the policy.

Pure premium

The portion of an insurance premium that covers expected losses only, excluding insurer expenses, risk load for volatility, and profit margin.

Captive insurer

A licensed insurance company owned by a non-insurance parent to finance its own retained risks. Feasibility depends on predictable losses and adequate premium volume.

Policy aggregate limit

The maximum total the insurer will pay across all covered claims during the policy period, distinct from a per-occurrence limit applying to each single loss.

Fraud triangle

A model describing three conditions behind fraud: pressure or incentive, opportunity, and rationalization. Controls mainly reduce opportunity through segregation and oversight.

Risk committee

A board or management committee that oversees the risk framework, reviews the top exposures and appetite status, and approves significant risk policies and limits.

Conflict of interest

A situation where a personal or organizational interest could improperly influence professional judgment. It is managed by disclosure, recusal, and a maintained register.

Speak-up culture

An environment where staff can raise concerns about misconduct or risk without fear of retaliation, supported by independently administered confidential reporting channels.

Stakeholder power-interest grid

A mapping tool plotting stakeholders by their influence over outcomes and their interest in them, guiding how intensively each group is engaged and reported to.

Key risk indicator

A metric tracking exposure to a risk against defined thresholds, usually with green, amber, and red bands that trigger escalation when breached.

Assurance mapping

A technique consolidating assurance from management self-assessment, compliance testing, and internal audit against the risk universe to reveal coverage and gaps.