CERP key terms

A structured, firm-wide approach to identifying, assessing, managing and reporting the full range of risks that could affect an organisation's objectives, applied consistently across business units rather than in isolated silos.

A governance structure in which business units own and manage risk day to day, an independent risk and compliance function sets frameworks and monitors, and internal audit provides objective assurance to the board.

A committee of non-executive directors that oversees the organisation's risk framework, appetite and exposures, and challenges management on how risks are identified, measured and controlled.

The named individual accountable for managing a specific risk, including approving its assessment, ensuring controls operate and escalating material changes to the appropriate committee.

The amount and type of risk an organisation is willing to accept in pursuit of its strategy, expressed in qualitative statements and quantitative limits that guide decision-making.

The acceptable variation around a risk appetite limit, forming a threshold beyond which exposure triggers escalation, remediation or a decision to reduce the position.

The maximum level of risk an organisation can bear before breaching capital, liquidity or regulatory constraints, and before its viability is threatened.

A formal document setting out the organisation's risk appetite, the categories it applies to, the metrics and limits used, and the governance for approving and monitoring them.

The shared norms, attitudes and behaviours of an organisation's people that determine how risks are actually identified, discussed and acted upon in daily decisions.

The signals senior leaders send through their words, decisions and personal example about how seriously risk and ethical conduct should be taken throughout the organisation.

Designing remuneration, targets and promotion criteria so that individual and business rewards reflect risk-adjusted outcomes and do not encourage excessive or unintended risk-taking.

A structured, mutually exclusive classification of risk categories and sub-categories used consistently across the organisation to identify, aggregate and report exposures.

A maintained record of identified risks, each with an owner, cause, potential impact, likelihood, existing controls and planned actions, used to track and report the risk profile.

The level of risk that exists before any controls or mitigants are applied, providing the baseline against which the effectiveness of controls is judged.

The level of risk remaining after existing controls and mitigants have been taken into account, and the figure normally compared against appetite.

The process of combining exposures across business lines, risk types and legal entities to produce a firm-wide view, taking account of correlations and diversification effects.

A forward-looking metric tracked against set thresholds to give early warning that a risk is increasing, so management can act before losses or incidents occur.

The estimated likelihood that a borrower will fail to meet a contractual payment obligation within a defined horizon, usually twelve months.

The share of an exposure expected to be lost if a borrower defaults, after allowing for recoveries, collateral and workout costs.

The estimated amount outstanding and owed at the moment a borrower defaults, including undrawn commitments expected to be drawn before default.

The risk of loss arising from too much exposure to a single counterparty, sector, product or region, so that one adverse event can cause disproportionate damage.

A statistical estimate of the maximum loss a portfolio is likely to suffer over a set holding period at a given confidence level, under normal market conditions.

A measure of a bond's or portfolio's price sensitivity to interest rate changes, expressed in years and approximating the weighted average time to receive cash flows.

A regulatory metric comparing a bank's stock of high-quality liquid assets with its projected net cash outflows over a thirty-day stress period.

The difference between assets and liabilities that reprice within a given time bucket, used to estimate how net interest income changes when rates move.

The risk of loss from inadequate or failed internal processes, people, systems or external events, including legal and compliance failures but excluding strategic and reputational risk.

A structured exercise in which business units assess their own risks and the design and performance of related controls, feeding the results into the risk register.

The risk that an external provider's failure, misconduct or disruption harms the organisation's operations, customers, data or reputation, including over-reliance on critical vendors.

The discipline of planning and testing how essential services will keep running or be restored during and after a disruption, using recovery time and recovery point objectives.

The risk of legal or regulatory sanctions, financial loss or reputational damage from failing to comply with applicable laws, rules, regulations and internal standards.

The risk that the organisation's behaviour or treatment of customers, counterparties or markets causes harm, regulatory action or loss of trust, even where rules are technically met.

The risk that strategic choices, competitive moves or shifts in the business environment undermine the organisation's ability to achieve its long-term objectives.

The risk that stakeholders' negative perceptions damage the organisation's ability to attract customers, talent, capital or partners, often arising as a consequence of other risk events.

A risk that is new, growing or changing in a way that makes it hard to quantify, requiring early scanning and monitoring before it becomes material.

A technique that applies severe but plausible scenarios to a portfolio or the whole firm to estimate losses, capital and liquidity needs beyond normal conditions.

The amount of capital an organisation estimates it needs to absorb unexpected losses at a chosen confidence level over a defined horizon, based on its own risk models.

Exposures adjusted by regulatory or internal risk weights so that different assets can be compared and translated into minimum capital requirements.

The risk of adverse consequences from decisions based on incorrect, misapplied or poorly understood models, including data errors and inappropriate assumptions.

A concise visual summary of key risk metrics, limits and trends presented to management or the board to support oversight and timely decisions.

A defined process for reporting an exposure that exceeds an approved limit to the responsible committee within set timeframes, with required remediation and a record of actions.