CISR Risk Management key terms

The combination of the likelihood that an uncertain event will occur and the consequences that event would produce, measured against the objectives of the organization or individual exposed to it.

A state in which the outcome of a future event cannot be predicted with confidence, whether because information is missing or because the outcome is inherently variable.

A situation offering only the possibility of loss or no loss, with no chance of gain, such as fire, liability, or employee injury. It is the traditional focus of risk management and insurance.

A situation that may produce a loss, no change, or a gain, such as investing in a new product line or entering a foreign market. It is usually managed rather than insured.

Exposure arising from property damage, liability claims, or employee injury and other accidental causes. It is generally insurable and managed through loss control and risk financing.

The possibility of loss from failed internal processes, people, systems, or external events, including fraud, cyber failure, supply disruption, and human error in day-to-day operations.

Exposure to loss or missed objectives caused by business decisions, competitive shifts, regulatory change, or misalignment between strategy and the environment in which the organization operates.

The structured process of identifying, analyzing, controlling, financing, and administering exposures in order to protect an organization's people, assets, earnings, and reputation at an acceptable cost.

The repeating cycle of establishing objectives, identifying exposures, analyzing them, selecting control and financing techniques, implementing the chosen approach, and monitoring results with periodic review.

A company-wide approach that treats all risks across the organization as a single portfolio, aligning risk tolerances with strategy rather than managing exposures in isolated departmental silos.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative statements or quantitative limits that guide decision-making throughout the entity.

The specific, measurable amount of variation or loss an organization or individual can absorb in a given area without threatening objectives, often expressed as a dollar limit or percentage.

The systematic effort to discover and document exposures facing an organization before they produce losses, using tools such as inspections, flowcharts, financial statements, questionnaires, and loss histories.

Any person, property, activity, income stream, or legal obligation that could be affected by a loss event. Exposure units are the individual items counted when measuring and pricing risk.

A single measurable item used to count and rate risk, such as one vehicle, one building, one employee, or one square foot of floor space, allowing frequency and severity to be compared across accounts.

A condition or circumstance that increases either the chance a peril will occur or the severity of the resulting loss, such as oily rags, icy steps, poor lighting, or a careless driver.

The actual cause of a loss, such as fire, windstorm, flood, theft, collision, or employee negligence. Policies typically list covered perils and exclude others by name.

A condition in which a person behaves more carelessly or dishonestly because insurance will pay for the consequences, or deliberately causes a loss to collect benefits.

Carelessness or indifference toward loss that arises because insurance exists, such as leaving a door unlocked or ignoring safety rules, without any intent to cause a loss.

A working document that lists identified risks with owners, likelihood and impact ratings, existing controls, and planned responses, kept current so the organization can track and prioritize exposures.

The possibility of financial loss from a specific exposure, described by the peril involved, the assets or liabilities at risk, the financial consequences, and the time period considered.

The evaluation of identified exposures to estimate how often losses will occur and how large they may be, so that control and financing decisions can be made on an informed basis.

The number of losses expected within a defined period for a given exposure, often expressed as a probability or as losses per exposure unit, and used to judge the predictability of claims.

The size or financial impact of an individual loss, ranging from small nuisance claims to catastrophic events, and a key driver of how much risk an organization can safely retain.

The worst loss that could occur under the most unfavorable circumstances, assuming no protective measures succeed, used to test whether retention and insurance limits are adequate.

The largest loss reasonably expected assuming that protective systems such as sprinklers, alarms, or fire walls function as designed, a more practical planning figure than the theoretical worst case.

A grid that plots likelihood against impact so exposures can be ranked and compared, helping managers decide which risks need immediate treatment and which can be accepted.

The set of techniques that reduce the chance of loss or limit its size, including avoidance, loss prevention, loss reduction, separation, and duplication, applied before and after a loss event.

A control technique that eliminates an exposure entirely by not undertaking the activity that creates it, which works well for severe hazards but may also eliminate the benefits of the activity.

Measures taken to reduce the probability that a loss will occur at all, such as safety training, equipment maintenance, background checks, or fire code compliance.

Measures that lessen the severity of a loss once it has begun or occurred, such as sprinkler systems, emergency response plans, backup generators, or contractual indemnity provisions.

The techniques used to fund the losses that remain after control measures, through retention of risk, commercial insurance, contractual transfer, or capital market instruments.

Accepting the financial consequences of a risk rather than transferring it, either deliberately because losses are predictable and affordable, or passively because the exposure was never recognized.

Shifting the financial burden of a loss to another party through insurance, hold-harmless agreements, leases, or outsourcing, while the underlying activity and its hazards usually continue.

A contract in which an insurer, for a premium, agrees to indemnify the policyholder for covered losses, pooling many similar exposures so that the few who suffer loss are made whole.

The amount of each loss the policyholder must absorb before the insurer pays, used to eliminate small claims, reduce premiums, and give the insured a financial stake in loss control.

A formal retention program in which an organization sets aside funds and administers claims for a defined exposure instead of purchasing a conventional policy, often with excess insurance above a chosen level.

The ongoing management of the risk program, covering policy wording, premium allocation, claims coordination, recordkeeping, vendor and broker relationships, and communication with stakeholders.

A formal written statement approved by senior leadership that sets the organization's risk philosophy, objectives, authority levels, and responsibilities, giving the risk program a mandate and direction.

The continuing review of exposures, claims, premiums, and control performance against plan, so that changes in operations or the insurance market trigger timely adjustments to the program.