IAI SA7 key terms

A structured, organisation-wide approach to identifying, assessing, managing, monitoring and reporting the full range of risks that could affect an entity's objectives, strategy and capital, replacing management of risks in isolated silos.

The amount and type of risk an organisation is willing to seek or accept in pursuit of its strategic objectives, expressed in a board-approved statement supported by tolerances, limits and metrics.

The maximum variation from the stated risk appetite that an organisation will accept for a particular risk before escalation and corrective action are triggered; some frameworks treat tolerance and appetite as interchangeable.

The maximum risk an organisation could bear, given its capital, liquidity, earnings, operational capability and stakeholder expectations, before it breaches obligations or becomes unviable.

A quantified boundary, derived from risk appetite and tolerance, that caps an exposure or the level of a monitored risk metric, with any breach escalated and remedied through an agreed process.

A maintained record of identified risks showing causes, potential impacts, owners, existing controls, assessed likelihood and severity, planned treatments and review dates.

A consistent hierarchical classification of risk types and sub-types used across an organisation so that risks are identified completely, aggregated sensibly and reported comparably over time.

The assessed level of a risk before controls, mitigation or hedging are applied, providing the baseline against which the effectiveness and value of risk management actions are measured.

The assessed level of a risk that remains once existing controls, mitigation and transfers are taken into account; it is normally compared with the risk appetite and limit structure.

A process in which business units review, grade and evidence the design and operating effectiveness of the controls for which they are responsible, feeding results into the risk register and audit planning.

A governance model in which business units own and manage risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance to the board.

The executive accountable for the ERM framework, for aggregating and reporting risk across the organisation, and for challenging commercial decisions that conflict with the approved risk appetite.

The named individual accountable for managing a particular risk, keeping its controls effective, reporting changes and completing agreed treatment actions within stated timescales.

A monitored metric chosen because its movements provide early warning of changes in the likelihood or severity of a risk, with pre-agreed trigger and escalation levels.

Own Risk and Solvency Assessment: an insurer's forward-looking, entity-specific evaluation of its risks, the capital needed to cover them and its ability to remain solvent under stressed conditions, reported to the supervisor.

The capital estimated as necessary to absorb unexpected losses over a chosen horizon and confidence level, derived from the firm's own risk profile rather than from regulatory formulas.

The division of total capital, usually based on contribution to economic capital or risk-adjusted returns, among business units, products or risks so that pricing and performance can be judged fairly.

Risk-adjusted return on capital: a ratio comparing risk-adjusted profit with the economic capital consumed by an activity, used to compare businesses with differing risk and capital intensity.

The loss expected to be exceeded only with a specified small probability over a defined time horizon; simple to communicate but uninformative about how large losses beyond it may be.

The average loss given that losses exceed the Value at Risk threshold; a coherent tail measure that captures the severity, rather than only the probability, of extreme outcomes.

The risk of extreme outcomes in the far tail of a loss distribution, low in probability but potentially catastrophic, and frequently understated when thin-tailed distributions are assumed.

Quantifying the effect of specified severe but plausible adverse scenarios on capital, earnings and liquidity, providing a complement to probabilistic modelling that does not rely on historical frequencies.

Working backwards from the point of business failure or capital exhaustion to identify which combinations of adverse events, or how large a loss, would cause it.

Structured exploration of plausible future states, often combining expert judgement with modelling, to assess risks whose likelihood cannot be reliably estimated from historical data.

The risk of financial loss or poor decisions caused by errors or weaknesses in model design, data, assumptions, implementation or use, controlled through validation, documentation, governance and monitoring.

A numerical method that draws many random scenarios from assumed distributions, and aggregates the results, to build a distribution of losses, capital needs or other uncertain outcomes.

A mathematical function that combines separate marginal distributions into a joint distribution, allowing dependence between risks to be modelled beyond simple linear correlation.

A body of statistical methods that model the tail of a distribution using asymptotic results, enabling estimation of very rare but very large losses beyond the range of observed data.

The reduction in aggregate risk and required capital that arises because exposures are imperfectly correlated, so the whole is less risky than the sum of its parts.

Combining exposures and capital figures across risk types, legal entities and business units, taking account of dependence, to produce an organisation-wide view of risk and capital needs.

Risk of disproportionately large loss from excessive exposure to one counterparty, sector, geography, product, asset class or event type, so that a single shock is damaging.

Risk of loss from failed or inadequate internal processes, people, systems or external events, including fraud, legal and cyber losses, but usually excluding strategic and reputational risk.

Risk that the firm's behaviour towards customers or markets produces unfair outcomes, breaches regulatory expectations and causes detriment, redress costs and reputational damage.

Risk of loss, data compromise, business interruption or reputational harm arising from attacks on, or failures of, information technology systems and networks.

A newly arising or fast-changing risk whose impact is uncertain and poorly captured by historical data, managed through horizon scanning, expert judgement and early warning indicators.

Risk from physical effects of climate change and from the transition to a low-carbon economy, operating through policy, technology, market and liability channels over long horizons.

The shared values, attitudes and behaviours that shape how people identify, discuss, escalate and act on risk within an organisation, including openness about failures.

Shifting the financial consequences of a risk to another party through insurance, reinsurance, derivatives or contractual arrangements, while accountability for managing the underlying exposure usually remains.