SAMRA key terms

The effect of uncertainty on objectives, where the effect is a deviation from what is expected and can be positive or negative. It is usually described by a cause, a potential event, and its consequences.

A lack of complete knowledge about an outcome, its likelihood, or its consequences. It is the raw condition that risk management tries to understand, reduce, or accommodate rather than eliminate entirely.

The level of risk that exists before any controls or mitigation measures are applied. It is used as a baseline for judging how much protection existing controls actually provide and where treatment is most justified.

The risk that remains after existing controls and treatment actions have been applied. Comparing it with inherent risk shows control effectiveness and whether further action or formal acceptance is needed.

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives. It is set by senior leadership and shapes which risks are accepted, reduced, or avoided.

The practical deviation from risk appetite that an organization can accept for a specific objective or category. It translates a broad appetite statement into measurable limits that operational staff can apply.

The chance that a given event or scenario will occur within a stated period or context. It is one of the two dimensions, alongside consequence, used to estimate the level of a risk.

The outcome or impact on objectives if an event occurs, expressed in financial, operational, safety, legal, or reputational terms. It describes how bad or good the effect would be, independent of how likely it is.

The combined significance of a risk, usually derived by combining likelihood and consequence. Levels such as low, medium, or high help prioritize which risks need treatment or escalation.

A tool that plots likelihood against consequence on a grid to assign risk levels and priorities. Its scales and thresholds must be defined clearly, because poor design can hide serious risks.

The defined terms of reference used to judge the significance of a risk, including scales, thresholds, and appetite limits. They make evaluations consistent and comparable across different parts of an organization.

The process of finding, recognizing, and describing risks that could affect objectives, including their sources, causes, and potential events. It is the foundation for all later analysis and treatment work.

The process of understanding the nature of an identified risk and determining its level by examining causes, likelihood, consequences, and existing controls. It provides the evidence needed for evaluation and treatment decisions.

The process of comparing analysis results with risk criteria to decide whether a risk is acceptable or needs treatment. It turns analysis into a judgment about significance and priority.

A structured record of identified risks, usually capturing description, owner, causes, controls, ratings, and treatment actions. It is the main working document for tracking and reporting the risk profile.

The person accountable for managing a specific risk, including approving treatment plans and monitoring changes in its level. Clear ownership prevents risks from being identified but left unmanaged.

The process of selecting and implementing options to modify risk, such as avoiding, reducing, transferring, or accepting it. The chosen option should be proportionate to the risk level and aligned with appetite.

A treatment option that removes the activity or exposure generating the risk altogether. It can eliminate a threat but may also forfeit opportunities, so it is usually reserved for unacceptable risks.

A treatment option that lowers either the likelihood or the consequence of a risk through controls or changes to the activity. It is the most common response and usually leaves some residual risk.

A treatment option that shifts the financial or contractual burden of a risk to another party, such as an insurer or supplier. It does not remove the underlying risk, and some responsibility often remains.

A treatment decision to retain a risk without further action, made knowingly and within approved authority. Acceptance is only valid when the residual level sits within tolerance and is formally recorded.

A measure that modifies risk, either by preventing an event, detecting it, or limiting its consequences. Controls can be preventive, detective, or corrective, and their effectiveness must be verified rather than assumed.

A judgment of how well a control performs in practice, including its design and whether it operates as intended. Weak effectiveness means residual risk is higher than the design suggests.

A measurable metric that signals rising or falling exposure to a specific risk before losses occur. Good indicators are linked to a risk driver, have defined thresholds, and trigger a response when breached.

The exchange of risk information between stakeholders so that they understand exposure and can make informed decisions. It must be timely, accurate, and tailored to the audience's needs and expertise.

The formal process of providing decision-makers with structured information on risk levels, trends, and treatment progress. Effective reports are concise, comparable over time, and focused on what requires action.

The shared values, attitudes, and behaviors that determine how an organization identifies and responds to risk. A healthy culture encourages open reporting of bad news rather than hiding it.

Any person or group that can affect, be affected by, or perceive itself to be affected by a decision or risk. Identifying them early shapes communication and treatment priorities.

The ongoing checking of risks, controls, and treatment progress to detect changes and confirm that plans are working. It relies on indicators, reviews, and audit activity rather than a one-off assessment.

A periodic or triggered reassessment of the risk profile to confirm that ratings, controls, and treatment plans remain valid. Reviews are essential when context changes, such as a new project phase or external shock.

The recurring effort to strengthen the risk management framework and its outputs based on performance data, incidents, and feedback. It keeps the process relevant as the organization and its environment evolve.

Knowledge captured from past projects, incidents, or near misses and used to improve future decisions. It is most valuable when stored accessibly and actively applied, not merely recorded after closure.

The system of direction and oversight by which an organization sets objectives, assigns accountability, and monitors performance, including risk management. It defines who decides, who reports, and how assurance is obtained.

A structure that separates management, risk and compliance oversight, and independent internal audit into distinct roles. It clarifies accountability and reduces gaps or duplication in assurance.

Independent or objective evidence that controls and risk processes are working as intended. It can come from internal audit, external audit, testing, or certification and supports governing bodies in their oversight.

The set of principles, structures, processes, and responsibilities that guide how risk is managed across an organization. It provides consistency and links risk activity to strategy and decision-making.

A measure of how embedded, systematic, and effective an organization's risk management practices are. Higher maturity means risk information is used proactively in decisions rather than produced for compliance only.

The application of risk processes to a defined project, covering scope, schedule, cost, quality, and benefits uncertainty. It must be integrated with project planning and reviewed at each phase gate.

Risk arising from a group of related projects and the coordination between them, including dependency and benefit-realization risk. It differs from project risk because it concerns the wider portfolio of change.

A risk that is new, increasing, or newly visible and whose impact is not yet well understood. It requires early scanning and scenario thinking because historical data may not reveal its likelihood or scale.

The systematic search for signals of change, threats, and opportunities that could affect the organization in future. It feeds emerging risk identification and long-term strategic planning.

The capacity of an organization to anticipate, absorb, adapt to, and recover from disruption while continuing to deliver its objectives. It combines risk management, business continuity, and adaptive leadership.

The capability to keep critical activities running, or restore them quickly, during and after disruption. It depends on impact analysis, recovery priorities, and tested response plans.