SAMRA cheat sheet

Risk is defined as the effect of uncertainty on objectives, expressed as a combination of likelihood and consequence; ISO 31000 treats risk as having both upside and downside effects, while ISO Guide 73 distinguishes risk from the event that triggers it.

Risk management is coordinated activities to direct and control an organization with regard to risk; its purpose is value creation and protection, not risk elimination.

Residual risk is the risk remaining after controls are applied; inherent (gross) risk is assessed before controls, and the gap between them measures control effectiveness.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk tolerance is the acceptable variation around a specific objective, and risk capacity is the maximum risk it can bear before breaching solvency or mandate.

Likelihood x consequence matrices are qualitative or semi-quantitative; multiplying ordinal scale scores is mathematically invalid for interval operations, so scales must be defined so that products are meaningful.

Expected loss (single period) = Probability of event x Financial impact; for frequency-severity data, expected annual loss = expected frequency x expected severity.

Risk assessment comprises three sequential processes: risk identification, risk analysis, and risk evaluation; evaluation compares analysis results against risk criteria to decide whether treatment is needed.

Quantitative techniques include Monte Carlo simulation, value at risk, expected shortfall, fault tree analysis, and event tree analysis; qualitative techniques include Delphi, scenario workshops, and risk matrices.

Identification techniques: brainstorming, Delphi, structured interviews, SWOT, PESTLE, HAZOP, FMEA, fault tree analysis, bow-tie analysis, scenario analysis, checklists, and process mapping.

Sources of risk include strategic, operational, financial, compliance, reputational, cyber, supply chain, and external/contextual factors; a taxonomy or risk breakdown structure (RBS) prevents blind spots.

HAZOP uses guide words (no, more, less, as well as, part of, reverse, other than) applied to process parameters to find deviations; FMEA scores Severity x Occurrence x Detection to give a Risk Priority Number (RPN).

Bow-tie analysis links causes to a top event through preventive barriers and the top event to consequences through mitigative barriers, exposing escalation factors that defeat each barrier.

Risk evaluation decision rules: if residual risk is below the acceptable threshold, accept and monitor; if within the tolerable band, treat cost-effectively; if above the intolerable threshold, avoid or transfer regardless of cost.

ALARP (As Low As Reasonably Practicable) requires comparing the cost of further reduction against the risk reduction achieved; gross disproportion (cost far exceeds benefit) justifies stopping.

Correlation between risks must be modelled: positive correlation increases aggregate exposure and reduces diversification benefit; ignoring it understates portfolio risk.

Risk criteria are the terms of reference against which significance is evaluated, including legal requirements, stakeholder concerns, and organizational objectives; they must be set before analysis to avoid bias.

The ISO 31000 treatment options are: avoid the risk, take or increase the risk to pursue opportunity, remove the risk source, change likelihood, change consequence, share the risk, and retain the risk by informed decision.

The 4Ts framework maps to Tolerate (retain), Treat (reduce likelihood or consequence), Transfer (insurance, contracts, outsourcing), and Terminate (avoid the activity).

Hierarchy of controls in order of effectiveness: elimination, substitution, engineering controls, administrative controls, and personal protective equipment; PPE is the least reliable.

A control is only effective if it is designed, implemented, and operating; test operating effectiveness separately from design adequacy.

Defence in depth uses independent, redundant barriers so that failure of one control does not cause the top event; common-cause failure can defeat multiple barriers simultaneously.

Risk transfer via insurance does not eliminate risk: deductibles, exclusions, limits of indemnity, and counterparty credit risk remain retained.

Treatment plans require an owner, action, due date, expected risk reduction, cost, and success measure; unowned actions are the most common cause of failed treatment.

Cost-benefit of treatment compares the reduction in expected loss (or reduction in risk score) against the total cost of the control over its lifecycle, including maintenance and training.

Effective risk communication is two-way, timely, and tailored to the audience; the message must convey likelihood, consequence, and uncertainty without false precision.

Risk reporting should align to the risk appetite statement, show movement against prior periods and thresholds, and distinguish inherent from residual exposure.

Escalation criteria should be pre-defined by threshold (e.g., risk score above appetite, regulatory breach, or emerging risk with high uncertainty) so reporting is not personality-dependent.

The risk register is the core reporting artifact: ID, description, cause, consequence, owner, inherent score, controls, residual score, treatment, target date, and status.

Near-misses and incidents are leading indicators; reporting only realized losses lags reality and hides deteriorating control environments.

Communication plans should identify stakeholders, information needs, frequency, channel, and format; boards typically require aggregated heat maps and top-risk profiles, while operational teams need detailed registers.

Confidentiality and legal privilege must be considered when documenting risk; some jurisdictions protect certain risk assessments from disclosure, but careless wording can waive that protection.

Crisis communication uses pre-agreed holding statements, single-source-of-truth spokespersons, and regular update cadence to counter misinformation.

Monitoring is continuous checking of the risk environment and control performance; review is periodic reassessment of the framework's suitability, adequacy, and effectiveness.

Key Risk Indicators (KRIs) are metrics with defined thresholds and escalation triggers that provide early warning of increasing exposure; they must be predictive, measurable, and owned.

Key Performance Indicators measure outcomes, Key Control Indicators measure control health, and KRIs measure risk drivers; using one type as a proxy for another distorts the picture.

The three lines model: first line owns and manages risk, second line provides oversight, guidance, and challenge, third line (internal audit) provides independent assurance.

Assurance mapping consolidates all assurance sources (audit, compliance testing, self-assessments, external certification) to identify gaps and duplication across the risk universe.

Risk maturity models (e.g., from ad hoc to optimized) assess the framework itself; improvement plans should follow a PDCA (Plan-Do-Check-Act) cycle.

Lessons-learned reviews after incidents or project closure should update risk criteria, control design, and the risk taxonomy, not just close the record.

Audit findings should be tracked to closure with root-cause analysis; repeat findings indicate a systemic control failure rather than isolated error.

ISO 31000:2018 provides principles, a framework, and a process; it is not certifiable and does not prescribe specific risk techniques.

COSO ERM (2017) structures risk management around five components and twenty principles, linking risk to strategy and performance; it is not a certification standard either.

ISO/IEC 27005 supports ISO/IEC 27001 information security risk management; ISO 22301 covers business continuity management systems and is certifiable.

The Basel III framework sets capital requirements for banks, including operational risk capital, liquidity coverage ratio, and leverage ratio.

Three lines model (IIA 2020) replaced the earlier Three Lines of Defense; it emphasizes the governing body's role and the alignment of assurance activities.

Board-level risk governance requires a risk committee with defined terms of reference, independent challenge of management, and approval of the risk appetite statement.

A risk management framework comprises: mandate and commitment, framework design (understanding the organization and context, articulating risk management commitment, allocating roles and resources), implementation, evaluation, and improvement.

Regulatory drivers include SOX (financial controls), GDPR/CCPA (privacy), DORA (EU digital operational resilience for financial entities), and NIS2 (EU critical infrastructure cybersecurity).

Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives; program risk affects program outcomes and benefits realization.

PMBOK risk process: plan risk management, identify risks, perform qualitative analysis, perform quantitative analysis, plan risk responses, implement responses, and monitor risks.

Qualitative analysis uses a probability-impact matrix and data quality assessment; quantitative analysis uses expected monetary value (EMV), decision trees, sensitivity (tornado) analysis, and Monte Carlo schedule/cost simulation.

EMV = Probability x Impact; the contingency reserve is derived from identified risks (known-unknowns), while the management reserve covers unidentified risks (unknown-unknowns).

Risk breakdown structure (RBS) organizes project risk by source (technical, external, organizational, project management) to ensure coverage and support aggregation.

Risk-adjusted schedule and cost baselines incorporate contingency; the contingency drawdown approach releases reserve as risk exposure is retired.

Opportunity responses are exploit, share, enhance, and accept; threat responses are avoid, transfer, mitigate, and accept.

Portfolio risk aggregation must account for inter-project dependencies and shared resources; a project that is acceptable alone may be unacceptable in combination.

Emerging risks have high uncertainty, limited historical data, and potentially high impact; they are best handled with scenario analysis, horizon scanning, and adaptive monitoring rather than point estimates.

Horizon scanning techniques include PESTLE, STEEPLE, Delphi panels, trend analysis, and red-team exercises; outputs feed the risk register with explicit uncertainty flags.

Organizational resilience combines absorptive capacity (resist and absorb), adaptive capacity (adjust to change), and restorative capacity (recover); ISO 22316 provides guidance on resilience.

Business continuity management follows ISO 22301: business impact analysis (BIA) identifies critical activities and recovery time objectives (RTOs); the recovery point objective (RPO) defines tolerable data loss.

Climate-related risk disclosure frameworks include TCFD (now under ISSB IFRS S1/S2), which structures governance, strategy, risk management, and metrics/targets.

Cyber risk is a top emerging risk: ransomware, supply chain compromise, and third-party concentration risk require tabletop exercises and tested incident response plans.

Concentration risk arises from dependence on single suppliers, cloud providers, or markets; mapping dependencies and testing substitutability are core mitigations.

Stress testing and scenario planning (e.g., severe-but-plausible scenarios) test resilience against tail events and reveal where recovery capacity is exceeded.

Risk is defined as the effect of uncertainty on objectives, expressed as a combination of likelihood and consequence; ISO 31000 treats risk as having both upside and downside effects, while ISO Guide 73 distinguishes risk from the event that triggers it.

Risk management is coordinated activities to direct and control an organization with regard to risk; its purpose is value creation and protection, not risk elimination.

Residual risk is the risk remaining after controls are applied; inherent (gross) risk is assessed before controls, and the gap between them measures control effectiveness.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk tolerance is the acceptable variation around a specific objective, and risk capacity is the maximum risk it can bear before breaching solvency or mandate.

Likelihood x consequence matrices are qualitative or semi-quantitative; multiplying ordinal scale scores is mathematically invalid for interval operations, so scales must be defined so that products are meaningful.

Expected loss (single period) = Probability of event x Financial impact; for frequency-severity data, expected annual loss = expected frequency x expected severity.

Risk assessment comprises three sequential processes: risk identification, risk analysis, and risk evaluation; evaluation compares analysis results against risk criteria to decide whether treatment is needed.

Quantitative techniques include Monte Carlo simulation, value at risk, expected shortfall, fault tree analysis, and event tree analysis; qualitative techniques include Delphi, scenario workshops, and risk matrices.

Identification techniques: brainstorming, Delphi, structured interviews, SWOT, PESTLE, HAZOP, FMEA, fault tree analysis, bow-tie analysis, scenario analysis, checklists, and process mapping.

Sources of risk include strategic, operational, financial, compliance, reputational, cyber, supply chain, and external/contextual factors; a taxonomy or risk breakdown structure (RBS) prevents blind spots.

HAZOP uses guide words (no, more, less, as well as, part of, reverse, other than) applied to process parameters to find deviations; FMEA scores Severity x Occurrence x Detection to give a Risk Priority Number (RPN).

Bow-tie analysis links causes to a top event through preventive barriers and the top event to consequences through mitigative barriers, exposing escalation factors that defeat each barrier.

Risk evaluation decision rules: if residual risk is below the acceptable threshold, accept and monitor; if within the tolerable band, treat cost-effectively; if above the intolerable threshold, avoid or transfer regardless of cost.

ALARP (As Low As Reasonably Practicable) requires comparing the cost of further reduction against the risk reduction achieved; gross disproportion (cost far exceeds benefit) justifies stopping.

Correlation between risks must be modelled: positive correlation increases aggregate exposure and reduces diversification benefit; ignoring it understates portfolio risk.

Risk criteria are the terms of reference against which significance is evaluated, including legal requirements, stakeholder concerns, and organizational objectives; they must be set before analysis to avoid bias.

The ISO 31000 treatment options are: avoid the risk, take or increase the risk to pursue opportunity, remove the risk source, change likelihood, change consequence, share the risk, and retain the risk by informed decision.

The 4Ts framework maps to Tolerate (retain), Treat (reduce likelihood or consequence), Transfer (insurance, contracts, outsourcing), and Terminate (avoid the activity).

Hierarchy of controls in order of effectiveness: elimination, substitution, engineering controls, administrative controls, and personal protective equipment; PPE is the least reliable.

A control is only effective if it is designed, implemented, and operating; test operating effectiveness separately from design adequacy.

Defence in depth uses independent, redundant barriers so that failure of one control does not cause the top event; common-cause failure can defeat multiple barriers simultaneously.

Risk transfer via insurance does not eliminate risk: deductibles, exclusions, limits of indemnity, and counterparty credit risk remain retained.

Treatment plans require an owner, action, due date, expected risk reduction, cost, and success measure; unowned actions are the most common cause of failed treatment.

Cost-benefit of treatment compares the reduction in expected loss (or reduction in risk score) against the total cost of the control over its lifecycle, including maintenance and training.

Effective risk communication is two-way, timely, and tailored to the audience; the message must convey likelihood, consequence, and uncertainty without false precision.

Risk reporting should align to the risk appetite statement, show movement against prior periods and thresholds, and distinguish inherent from residual exposure.

Escalation criteria should be pre-defined by threshold (e.g., risk score above appetite, regulatory breach, or emerging risk with high uncertainty) so reporting is not personality-dependent.

The risk register is the core reporting artifact: ID, description, cause, consequence, owner, inherent score, controls, residual score, treatment, target date, and status.

Near-misses and incidents are leading indicators; reporting only realized losses lags reality and hides deteriorating control environments.

Communication plans should identify stakeholders, information needs, frequency, channel, and format; boards typically require aggregated heat maps and top-risk profiles, while operational teams need detailed registers.

Confidentiality and legal privilege must be considered when documenting risk; some jurisdictions protect certain risk assessments from disclosure, but careless wording can waive that protection.

Crisis communication uses pre-agreed holding statements, single-source-of-truth spokespersons, and regular update cadence to counter misinformation.

Monitoring is continuous checking of the risk environment and control performance; review is periodic reassessment of the framework's suitability, adequacy, and effectiveness.

Key Risk Indicators (KRIs) are metrics with defined thresholds and escalation triggers that provide early warning of increasing exposure; they must be predictive, measurable, and owned.

Key Performance Indicators measure outcomes, Key Control Indicators measure control health, and KRIs measure risk drivers; using one type as a proxy for another distorts the picture.

The three lines model: first line owns and manages risk, second line provides oversight, guidance, and challenge, third line (internal audit) provides independent assurance.

Assurance mapping consolidates all assurance sources (audit, compliance testing, self-assessments, external certification) to identify gaps and duplication across the risk universe.

Risk maturity models (e.g., from ad hoc to optimized) assess the framework itself; improvement plans should follow a PDCA (Plan-Do-Check-Act) cycle.

Lessons-learned reviews after incidents or project closure should update risk criteria, control design, and the risk taxonomy, not just close the record.

Audit findings should be tracked to closure with root-cause analysis; repeat findings indicate a systemic control failure rather than isolated error.

ISO 31000:2018 provides principles, a framework, and a process; it is not certifiable and does not prescribe specific risk techniques.

COSO ERM (2017) structures risk management around five components and twenty principles, linking risk to strategy and performance; it is not a certification standard either.

ISO/IEC 27005 supports ISO/IEC 27001 information security risk management; ISO 22301 covers business continuity management systems and is certifiable.

The Basel III framework sets capital requirements for banks, including operational risk capital, liquidity coverage ratio, and leverage ratio.

Three lines model (IIA 2020) replaced the earlier Three Lines of Defense; it emphasizes the governing body's role and the alignment of assurance activities.

Board-level risk governance requires a risk committee with defined terms of reference, independent challenge of management, and approval of the risk appetite statement.

A risk management framework comprises: mandate and commitment, framework design (understanding the organization and context, articulating risk management commitment, allocating roles and resources), implementation, evaluation, and improvement.

Regulatory drivers include SOX (financial controls), GDPR/CCPA (privacy), DORA (EU digital operational resilience for financial entities), and NIS2 (EU critical infrastructure cybersecurity).

Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives; program risk affects program outcomes and benefits realization.

PMBOK risk process: plan risk management, identify risks, perform qualitative analysis, perform quantitative analysis, plan risk responses, implement responses, and monitor risks.

Qualitative analysis uses a probability-impact matrix and data quality assessment; quantitative analysis uses expected monetary value (EMV), decision trees, sensitivity (tornado) analysis, and Monte Carlo schedule/cost simulation.

EMV = Probability x Impact; the contingency reserve is derived from identified risks (known-unknowns), while the management reserve covers unidentified risks (unknown-unknowns).

Risk breakdown structure (RBS) organizes project risk by source (technical, external, organizational, project management) to ensure coverage and support aggregation.

Risk-adjusted schedule and cost baselines incorporate contingency; the contingency drawdown approach releases reserve as risk exposure is retired.

Opportunity responses are exploit, share, enhance, and accept; threat responses are avoid, transfer, mitigate, and accept.

Portfolio risk aggregation must account for inter-project dependencies and shared resources; a project that is acceptable alone may be unacceptable in combination.

Emerging risks have high uncertainty, limited historical data, and potentially high impact; they are best handled with scenario analysis, horizon scanning, and adaptive monitoring rather than point estimates.

Horizon scanning techniques include PESTLE, STEEPLE, Delphi panels, trend analysis, and red-team exercises; outputs feed the risk register with explicit uncertainty flags.

Organizational resilience combines absorptive capacity (resist and absorb), adaptive capacity (adjust to change), and restorative capacity (recover); ISO 22316 provides guidance on resilience.

Business continuity management follows ISO 22301: business impact analysis (BIA) identifies critical activities and recovery time objectives (RTOs); the recovery point objective (RPO) defines tolerable data loss.

Climate-related risk disclosure frameworks include TCFD (now under ISSB IFRS S1/S2), which structures governance, strategy, risk management, and metrics/targets.

Cyber risk is a top emerging risk: ransomware, supply chain compromise, and third-party concentration risk require tabletop exercises and tested incident response plans.

Concentration risk arises from dependence on single suppliers, cloud providers, or markets; mapping dependencies and testing substitutability are core mitigations.

Stress testing and scenario planning (e.g., severe-but-plausible scenarios) test resilience against tail events and reveal where recovery capacity is exceeded.