CIMA P3 Risk Management key terms

A structured, organisation-wide approach to identifying, assessing, and managing risks that could affect strategic objectives, integrating risk considerations into decision-making rather than treating risk as a compliance exercise.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively and approved by the board.

The acceptable variation around a specific risk appetite level, often expressed as a limit or range within which business units may operate without escalation.

The maximum level of risk an organisation can bear before breaching its financial, operational, or regulatory constraints, independent of its stated appetite.

A structured inventory of all significant risks facing an organisation, used to scope risk assessments, allocate resources, and ensure no material exposure is overlooked.

A living document recording identified risks, their causes, potential impacts, likelihood, owners, and agreed responses, used to monitor and report risk status.

The individual accountable for managing a specific risk, including implementing agreed responses and reporting changes in exposure to the appropriate governance body.

A governance framework separating management (first line), risk and compliance oversight (second line), and independent assurance (third line) to clarify accountability for risk management across the organisation.

A widely used principles-based framework linking risk management to strategy and performance through five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.

An international standard providing principles, a framework, and a process for managing risk that can be adapted to any organisation, sector, or type of risk.

The overall process of risk identification, risk analysis, and risk evaluation, used to understand exposures and inform decisions about whether and how to treat them.

The probability or frequency with which a risk event is expected to occur within a defined period, often expressed as a rating or percentage.

The consequence or severity of a risk event on objectives, measured in financial, operational, reputational, or regulatory terms.

A grid plotting likelihood against impact to prioritise risks into categories such as low, medium, or high, guiding the allocation of management attention.

A visual representation of risks plotted by likelihood and impact, often colour-coded, used to communicate the risk profile to boards and senior management.

The level of risk before any controls or mitigating actions are applied, providing a baseline against which the effectiveness of controls can be assessed.

The level of risk remaining after existing controls and risk responses have been applied, representing the actual exposure the organisation currently faces.

A summary description of the aggregate risk exposures facing an organisation at a point in time, often compared against risk appetite to identify gaps.

A strategic technique identifying an organisation's internal strengths and weaknesses and external opportunities and threats, often used as a starting point for strategic risk identification.

A framework examining political, economic, social, technological, legal, and environmental factors that may create opportunities or threats in an organisation's external environment.

A technique exploring plausible future states and their implications for strategy and risk, helping organisations prepare for uncertainty and stress-test decisions.

A quantitative technique applying severe but plausible adverse scenarios to a portfolio or business model to assess resilience and identify vulnerabilities.

The process of selecting and implementing measures to modify risk, including avoiding, reducing, transferring, or accepting it, based on cost-benefit considerations.

A risk response that eliminates the activity or exposure giving rise to a risk, appropriate when the risk exceeds appetite and cannot be adequately mitigated.

A risk response that lowers either the likelihood or impact of a risk through controls, process changes, or diversification, without eliminating the exposure entirely.

A risk response shifting the financial consequences of a risk to another party, typically through insurance, hedging, or contractual arrangements, without eliminating the underlying exposure.

A risk response distributing exposure between parties, such as through joint ventures, outsourcing, or partnership agreements, so that no single party bears the full consequence.

A deliberate decision to retain a risk without further treatment, justified when the exposure is within appetite or the cost of treatment exceeds the benefit.

The policies, procedures, and practices designed to provide reasonable assurance that objectives are achieved, risks are managed, and operations are effective and compliant.

An assessment of whether a control is designed appropriately and operating as intended, often rated as effective, partially effective, or ineffective.

A widely adopted framework for designing and evaluating internal control over financial reporting and operations, organised around five components including control environment, risk assessment, and monitoring activities.

A metric tracked to provide early warning of increasing risk exposure, enabling proactive management before a risk event occurs.

The ongoing process of tracking identified risks, control performance, and changes in the internal and external environment to ensure risk management remains effective.

The structured communication of risk information to internal and external stakeholders, enabling informed decision-making and accountability at board and management level.

A committee of non-executive directors responsible for overseeing the organisation's risk management framework, risk appetite, and material risk exposures on behalf of the board.

The framework of roles, responsibilities, and processes by which the board and management direct and oversee risk management, ensuring accountability and alignment with strategy.

The shared values, beliefs, and behaviours within an organisation that determine how risks are identified, discussed, and managed in day-to-day decision-making.

The ethical and risk management example set by senior leadership, which strongly influences whether a strong risk culture develops throughout the organisation.

The risk of financial loss, operational disruption, or reputational damage from failures in information security, including data breaches, ransomware, and system outages.

An organisation's ability to prevent, withstand, recover from, and adapt to cyber incidents, maintaining critical operations and minimising harm to stakeholders.

The process of developing and maintaining plans and capabilities to ensure critical business functions can continue or be restored quickly after a disruptive event.