CIMA P3 Risk Management flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk appetite

The amount and type of risk an entity is willing to accept in pursuit of its objectives, expressed at portfolio level and approved by the board.

Risk tolerance

The acceptable variation in performance around a specific objective, applied at the level of an individual objective rather than the whole entity.

Risk capacity

The maximum risk an entity can bear before breaching constraints such as capital adequacy, liquidity or regulatory limits; appetite must sit below capacity.

Inherent versus residual risk

Inherent risk is exposure before controls are applied; residual risk is exposure remaining after controls operate. The difference measures control effectiveness.

Three lines model

First line owns and manages risk, second line monitors and advises on risk and compliance, third line internal audit gives independent assurance to the board.

Expected loss

The probability of an event multiplied by its financial impact, giving the average loss over time and used to price risk and set provisions.

Key risk indicator

A metric that predicts rising risk exposure before loss events occur, with a defined threshold that triggers escalation to a risk owner.

Risk owner

The named individual accountable for managing a specific risk and its response, distinct from the actionee who performs the control activity.

PESTLE analysis

A macro-environment scan of political, economic, social, technological, legal and environmental factors that shape strategic options and threats.

Porter's five forces

An industry attractiveness model using supplier power, buyer power, new entrant threat, substitute threat and competitive rivalry to assess profitability.

Ansoff matrix

A growth grid of market penetration, product development, market development and diversification, where diversification carries the highest strategic risk.

Scenario analysis

Modelling several internally consistent plausible futures to test strategy robustness, rather than relying on a single point forecast.

Sensitivity analysis

Varying one input at a time to identify which assumptions most affect the outcome; it ignores correlations between variables.

Monte Carlo simulation

Varying many inputs simultaneously from probability distributions to generate a distribution of outcomes, confidence intervals and loss probabilities.

Value at risk

The maximum loss expected over a defined horizon at a stated confidence level; it is silent on the severity of losses beyond that threshold.

Strategic drift

A widening gap between the realised strategy and environmental change, arising when incremental adaptation lags the pace of external shifts.

Real options

The value of managerial flexibility to defer, expand, contract or abandon a project, which increases with uncertainty and decision responsiveness.

Risk-adjusted discount rate

A required return raised above the risk-free rate to reflect project risk, reducing present value; adjusting cash flows too would double-count risk.

Stress testing

Applying extreme but plausible scenarios to quantify survival and capital adequacy, focusing on tail events that probability models underweight.

TARA responses

The four risk responses of transfer, avoid, reduce and accept, chosen by comparing residual exposure against appetite and control cost.

Risk transfer limits

Transfer shifts financial consequence through insurance, hedging or outsourcing but leaves accountability, reputational and contractual exposure with the entity.

Segregation of duties

A preventive control separating initiation, authorisation, recording and reconciliation so no single person controls a transaction end to end.

Control self-assessment

Process owners evaluate their own controls; cheaper than independent testing but exposed to self-reporting bias and optimism.

Key control

A control whose failure would materially increase risk, and which therefore requires full documentation, ownership and independent operating effectiveness testing.

Recovery time objective

The maximum acceptable time to restore a process after disruption; it drives business continuity design and is validated through testing.

Hedging basis risk

The risk that a hedging instrument does not move perfectly with the hedged exposure, leaving residual price risk despite the hedge.

Control cost justification

A control is justified when the marginal reduction in expected loss exceeds the marginal cost of operating that control.

Board risk accountability

The board sets appetite and approves the risk framework and cannot delegate this accountability, monitoring exposure through its risk committee.

Tone at the top

The signals senior management send through decisions, incentives and tolerated behaviour, which shape actual culture more than written values.

Speak-up culture

A risk culture where staff escalate bad news and near misses without fear, supported by independent whistleblowing channels and psychological safety.

Cyber kill chain

The attack stages from reconnaissance through weaponisation, delivery, exploitation, installation, command and control to actions on objectives.

Defence in depth

Layering independent security controls so that failure of any single control does not expose the asset, assuming every control may fail.

Third-party cyber risk

Exposure from suppliers and vendors handling data or systems, managed through due diligence, contractual security terms, audit rights and reassessment.

GDPR breach notification

Personal data breaches must generally be reported to the supervisory authority within 72 hours of awareness, and to individuals where risk is high.