SAMRA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Effect of uncertainty on objectives

The ISO 31000 definition of risk. It covers both negative and positive deviations from expected outcomes and is expressed through likelihood and consequence.

Residual versus inherent risk

Inherent risk is assessed before controls; residual risk remains after controls operate. The difference between them indicates how much the control environment reduces exposure.

Risk appetite versus tolerance

Risk appetite is the amount and type of risk an organization is willing to pursue or retain. Risk tolerance is the acceptable variation around a specific objective.

Risk capacity

The maximum risk an organization can bear before breaching solvency, mandate, or regulatory limits. Capacity must exceed appetite, otherwise the strategy is unachievable.

Expected loss formula

Expected loss equals probability of the event multiplied by financial impact. For frequency-severity data, expected annual loss equals expected frequency times expected severity.

Risk assessment process order

Risk assessment runs as identification, then analysis, then evaluation. Evaluation compares analysis results against pre-set risk criteria to decide whether treatment is required.

HAZOP guide words

A structured technique applying guide words such as no, more, less, as well as, part of, reverse, and other than to process parameters to find hazardous deviations.

FMEA risk priority number

RPN equals Severity multiplied by Occurrence multiplied by Detection. Higher RPN indicates greater priority for corrective action; each factor uses a defined ordinal scale.

Bow-tie analysis

A diagram linking causes to a top event through preventive barriers, and the top event to consequences through mitigative barriers, exposing escalation factors that defeat barriers.

ALARP principle

As Low As Reasonably Practicable. Further risk reduction is required unless its cost is grossly disproportionate to the benefit achieved.

Risk criteria

The terms of reference against which risk significance is evaluated, including legal requirements, stakeholder concerns, and organizational objectives. They are set before analysis.

Risk breakdown structure

A hierarchical taxonomy organizing risk by source, such as technical, external, organizational, and project management, to ensure identification coverage and support aggregation.

ISO 31000 treatment options

Avoid the risk, take or increase the risk to pursue opportunity, remove the risk source, change likelihood, change consequence, share the risk, and retain by informed decision.

Four Ts of treatment

Tolerate (retain), Treat (reduce likelihood or consequence), Transfer (insurance, contracts, outsourcing), and Terminate (avoid the activity altogether).

Hierarchy of controls

Ordered by effectiveness: elimination, substitution, engineering controls, administrative controls, then personal protective equipment. PPE is the least reliable because it depends on human behavior.

Defence in depth

Independent, redundant barriers so that failure of one control does not cause the top event. Common-cause failure can defeat several barriers simultaneously.

Control effectiveness testing

Design adequacy and operating effectiveness are tested separately. A well-designed control that is not implemented or operating provides no risk reduction.

Risk register core fields

Identifier, description, cause, consequence, owner, inherent score, controls, residual score, treatment action, target date, and status. It is the primary risk reporting artifact.

Key risk indicator

A metric with defined thresholds and escalation triggers providing early warning of increasing exposure. It must be predictive, measurable, and assigned a clear owner.

Escalation criteria

Pre-defined thresholds, such as risk score exceeding appetite or a regulatory breach, that trigger reporting to a higher governance level regardless of individual judgment.

Crisis communication holding statement

A pre-agreed, factual statement issued quickly after an incident, delivered by a designated spokesperson, to counter speculation and misinformation before full facts are known.

Three lines model

First line owns and manages risk; second line provides oversight, guidance, and challenge; third line, internal audit, provides independent assurance to the governing body.

Assurance mapping

Consolidating all assurance sources, such as audit, compliance testing, self-assessment, and external certification, to identify gaps and duplication across the risk universe.

Monitoring versus review

Monitoring is continuous checking of the risk environment and control performance. Review is periodic reassessment of whether the framework remains suitable, adequate, and effective.

PDCA improvement cycle

Plan, Do, Check, Act. Applied to risk management, it structures iterative improvement of the framework, criteria, and control design after monitoring results.

ISO 31000 characteristics

It provides principles, a framework, and a process for managing risk. It is guidance only, is not certifiable, and does not prescribe specific risk techniques.

COSO ERM 2017 structure

Five components and twenty principles linking risk management to strategy and performance: governance and culture, strategy and objective-setting, performance, review and revision, and information and communication.

ISO 22301

A certifiable standard for business continuity management systems. It requires a business impact analysis, recovery objectives, and tested continuity arrangements.

Contingency versus management reserve

Contingency reserve covers identified risks, the known-unknowns, and is derived from risk analysis. Management reserve covers unidentified risks, the unknown-unknowns.

Expected monetary value

EMV equals probability multiplied by impact for a risk event. Summing EMVs across a project supports reserve sizing and decision tree comparison of options.

Opportunity response strategies

Exploit, share, enhance, and accept. These mirror threat responses of avoid, transfer, mitigate, and accept, but aim to realize positive uncertain outcomes.

Recovery time objective

The maximum tolerable time to restore a critical activity or system after disruption. It is set by business impact analysis and drives continuity and resilience design.

Organizational resilience capacities

Absorptive capacity resists and absorbs shocks, adaptive capacity adjusts to change, and restorative capacity recovers. ISO 22316 provides guidance on building them.