CRM54 Principles Exam key terms

The effect of uncertainty on objectives, where the effect can be positive, negative, or both. It is usually described by a combination of the likelihood of an event and the consequences if it occurs.

A lack of complete knowledge about an event, its timing, or its outcome. Risk management addresses uncertainty by identifying what could differ from expectations and deciding how to respond.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated at a high level. It guides decisions about which risks to take, avoid, or reduce.

The specific, measurable level of variation an organization will accept around a particular objective or risk category. It translates broad appetite statements into practical thresholds that trigger escalation or action.

The maximum level of risk an organization can absorb financially and operationally before its solvency, reputation, or ability to meet obligations is seriously threatened. It sets an upper bound on appetite.

The level of risk that exists before any controls or mitigation measures are applied. It provides a baseline for judging how much protection current controls actually deliver.

The level of risk remaining after existing controls and treatment measures have been applied. Comparing it with inherent risk shows whether controls are working and whether further action is needed.

The systematic process of finding, recognizing, and recording risks that could affect objectives. It draws on workshops, data analysis, past incidents, and expert judgment to build a complete risk register.

The overall process of identifying risks, analyzing their likelihood and impact, and evaluating whether they are acceptable. Its output informs decisions about treatment priorities and resource allocation.

Examining a risk to understand its causes, likelihood, potential consequences, and existing controls. It may be qualitative, semi-quantitative, or quantitative depending on the decision being supported.

Comparing the results of risk analysis against agreed criteria to decide whether a risk is acceptable or requires treatment. It converts analysis into a judgment about priority and action.

The chance that a particular event or consequence will occur, expressed as a probability, frequency, or descriptive rating. It is one of the two core dimensions used to rank risks.

The magnitude of the consequences if a risk event occurs, measured in financial, operational, legal, safety, or reputational terms. It is combined with likelihood to determine overall risk severity.

A tool that plots likelihood against impact on a grid to assign risk ratings and priority levels. It supports consistent comparison of risks and defines thresholds for escalation and treatment.

A living record of identified risks, their owners, ratings, controls, and treatment plans. It is the central tool for tracking risk status and supporting reporting and review.

The reference levels and standards an organization uses to evaluate the significance of risk. They include appetite statements, tolerance thresholds, and legal or regulatory requirements.

The person accountable for managing a specific risk, including approving treatment plans and monitoring changes in exposure. Clear ownership ensures risks are actively managed rather than merely recorded.

The process of selecting and implementing options to modify risk, such as avoiding, reducing, transferring, or accepting it. The chosen option is documented in a plan with responsibilities and timelines.

A treatment option that eliminates the activity or exposure giving rise to a risk. It removes the risk entirely but may also forgo the benefits the activity would have delivered.

A treatment option that lowers the likelihood or impact of a risk through controls such as process changes, training, or redundancy. Some residual risk typically remains after reduction.

Shifting the financial consequences of a risk to another party, typically through insurance, contracts, or outsourcing. The underlying risk may still occur, so accountability usually remains with the original owner.

Accepting a risk and its consequences without transferring it, either deliberately after evaluation or unavoidably because it was not recognized. Deliberate retention should be documented and within tolerance.

A decision to retain a risk because its level is within appetite or because treatment would cost more than the benefit. It should be formally approved, recorded, and periodically reviewed.

A measure that modifies risk by preventing an event, detecting it, or reducing its consequences. Controls may be preventive, detective, or corrective and should be proportionate to the risk.

An assessment of how well a control actually reduces risk when operating as intended. It considers design adequacy and operating performance, and informs the gap between inherent and residual risk.

A control that is critical to preventing or detecting a significant risk, so that its failure would materially increase exposure. Key controls receive more frequent testing and monitoring attention.

Examining evidence to confirm that a control is designed appropriately and operates consistently over time. Results support conclusions about control effectiveness and identify remediation needs.

A contract in which an insurer agrees to compensate the insured for specified losses in exchange for premiums. It transfers financial risk but does not eliminate the underlying exposure or its causes.

The amount of a covered loss that the insured must bear before the insurer pays. A higher deductible lowers premiums but increases retained risk.

The amount paid to an insurer for coverage over a defined period. It reflects the insurer's assessment of expected losses, expenses, and the risk profile of the insured.

The process of arranging funds to cover the financial consequences of risk, through insurance, reserves, captives, or other mechanisms. It complements risk control by addressing what losses would cost.

Documented procedures for maintaining or restoring critical operations during and after a disruption. It sets recovery priorities, roles, and timeframes based on a prior impact analysis.

A study that identifies critical business functions and quantifies how disruption affects them over time. Its findings set recovery time objectives that shape continuity and recovery planning.

A governance structure separating management's ownership of risk, independent oversight functions, and internal audit assurance. It clarifies accountability and reduces gaps or duplication in risk coverage.

An independent function that evaluates the effectiveness of risk management, control, and governance processes. It provides objective assurance to the board and management without owning the risks it reviews.

Confidence, based on evidence, that controls and risk management processes are working as intended. It can be provided by management, compliance, internal audit, or external parties.

A measurable metric that provides early warning that risk exposure is increasing or approaching tolerance limits. Indicators are monitored against thresholds that trigger escalation or corrective action.

The structured communication of risk information to decision-makers, including exposure levels, trends, and treatment status. Effective reporting is timely, accurate, and tailored to the audience's needs.

Planned interaction with parties affected by or interested in an organization's risks, such as staff, regulators, customers, and investors. It builds trust and informs risk decisions with diverse perspectives.

The exchange of risk information and reasoning between the organization and its stakeholders in clear, accessible language. It supports informed decisions and manages expectations about residual exposure.

The framework of direction, authority, and accountability by which an organization is controlled. In risk terms it defines who sets appetite, who owns risks, and how performance is overseen.

The governing body's responsibility to approve risk appetite, monitor major exposures, and challenge management on risk decisions. It provides top-level accountability for the risk management framework.

The risk of legal penalties, financial loss, or reputational damage from failing to follow laws, regulations, or internal policies. It is managed through monitoring, training, and clear policy ownership.

A statement of the ethical behaviors and standards expected of everyone in the organization. It guides decisions where rules are unclear and supports a culture of integrity.

The reporting of suspected wrongdoing, often through a protected confidential channel. Effective programs allow concerns to surface early and reduce the risk of concealed compliance failures.

The shared values, attitudes, and behaviors that determine how people in an organization identify and respond to risk. It shapes whether policies are followed in practice or only on paper.

The extent to which staff understand the risks relevant to their work and their role in managing them. It is built through training, communication, and visible leadership commitment.

Ongoing checking of risks, controls, and the risk management framework to detect changes and confirm performance. It uses indicators, testing, and reporting to prompt timely corrective action.

A periodic or event-driven reassessment of risks and the effectiveness of the framework. It confirms that ratings, controls, and treatment plans remain valid as circumstances change.

The ongoing effort to strengthen risk management processes based on monitoring results, incidents, and feedback. It turns lessons learned into updated practices rather than repeating the same weaknesses.

A structured review of incidents or exercises that captures what happened, why, and what should change. Findings feed back into risk identification, controls, and training to prevent recurrence.

An event that has actually occurred and caused or nearly caused loss or disruption. Incidents are recorded, investigated, and analyzed to update risk assessments and controls.

An event that could have caused harm or loss but did not, often by chance. Near misses are valuable early warnings and should be reported and investigated like incidents.