IFoA SP9 key terms

A structured, organisation-wide process for identifying, assessing, managing, monitoring and reporting risks so that risk-taking supports the entity's objectives and strategy.

The arrangements by which a board and executive set risk strategy, assign accountability, oversee controls and ensure risk decisions align with the organisation's purpose and regulatory obligations.

A governance model separating management ownership of risk and controls (first line), independent risk and compliance oversight (second line), and independent assurance (third line), with governing body oversight.

A committee of non-executive directors that oversees the enterprise risk framework, reviews top risks and risk appetite, and challenges management on risk management and control effectiveness.

A senior executive accountable for leading the risk function, advising the board on risk matters, coordinating ERM and challenging business decisions that could breach risk appetite.

The amount and types of risk an organisation is willing to accept in pursuit of its strategic objectives, expressed through qualitative statements and quantitative boundaries approved by the board.

The acceptable variation around risk appetite, often expressed as a range or threshold, that a business may operate within before escalation or corrective action is triggered.

The maximum risk an organisation can bear without threatening its solvency, regulatory compliance or strategic viability, given its capital, liquidity, earnings and stakeholder expectations.

A specific, measurable constraint on risk-taking, such as a maximum exposure or capital usage, designed to keep actual risk within the approved risk appetite and tolerance.

A formal document that articulates the organisation's appetite for major risk categories, sets boundaries and escalation triggers, and explains how risk-taking supports strategy.

A structured record of identified risks, their causes, potential impacts, likelihood, controls, owners and current status, used to prioritise and monitor risk management activity.

A classification scheme that groups risks into consistent categories and subcategories, enabling common language, aggregation and comparison across the organisation.

The systematic process of finding and documenting sources of uncertainty that could affect objectives, including internal and external drivers, before assessing and treating them.

The level of risk that would exist without considering the effect of controls or risk mitigation, used as a starting point for assessing control value.

The level of risk remaining after existing controls and mitigation have been applied, which is compared with risk appetite and used to decide further action.

A named individual accountable for managing a risk, including maintaining its assessment, ensuring controls operate and escalating when exposure exceeds agreed thresholds.

A policy, process, system or action that reduces the likelihood or impact of a risk, or detects and corrects problems when they occur.

A structured process in which business teams review and rate the design and operation of their controls, often using workshops or questionnaires, to identify gaps and improvement actions.

A metric that provides early warning of increasing risk exposure, chosen because it is linked to a risk driver and has defined thresholds for escalation.

An assessment based on expert judgement and descriptive scales, such as high/medium/low, used when data are limited or when understanding causes and controls matters more than precise measurement.

An assessment that uses numerical data, models and statistical methods to estimate the likelihood and impact of risks, often producing distributions or capital estimates.

A visual matrix that plots risks by likelihood and impact, often colour-coded, to help compare exposures and prioritise risk responses.

A computational technique that repeatedly samples from input probability distributions to produce a distribution of possible outcomes for a risk or portfolio.

A process that constructs plausible future states, often severe but credible, and examines their consequences and implications for strategy, capital and risk management.

A technique that applies specified adverse shocks or scenarios to a portfolio or business model to assess vulnerability, capital adequacy and management actions under severe conditions.

A statistical measure of the maximum loss expected over a defined horizon at a given confidence level; it does not describe losses beyond that threshold.

The average loss in the worst outcomes beyond a chosen VaR confidence level, giving a more complete view of tail risk than VaR alone.

The amount of capital an organisation estimates it needs to absorb unexpected losses at a chosen confidence level, based on its own risk profile rather than regulatory formulas.

The minimum capital required by supervisors to support an insurer's or bank's risks, calculated under prescribed rules and used to protect policyholders or depositors.

A regulated insurer process that assesses the adequacy of its risk management, capital needs and solvency position under normal and stressed conditions, and reports conclusions to supervisors.

A performance measure that compares profit or return to the economic capital consumed by a risk, helping evaluate whether risk-taking is adequately rewarded.

The process of assigning an organisation's capital, including economic or regulatory capital, to business units, portfolios or risks to support performance measurement and strategic decisions.

The risk that an organisation's available capital and liquid resources are insufficient to meet its obligations as they fall due, including regulatory capital requirements.

The risk of adverse consequences from decisions based on incorrect or misused models, arising from data errors, flawed assumptions, implementation faults or inappropriate application.

The shared values, beliefs and behaviours that determine how people identify, discuss, escalate and act on risk, including whether challenges to authority are welcomed.

The risk that business practices or employee behaviour cause unfair customer outcomes, market harm or regulatory breaches, damaging trust and reputation.

The regular provision of risk information to boards, committees, regulators and other stakeholders, designed to be clear, timely, comparable and decision-useful.

A risk that is new, changing or not yet fully understood, with potential for significant future impact, requiring early scanning, scenario analysis and adaptive response.

The risk that strategic objectives, major decisions or business model assumptions prove wrong or become misaligned with the external environment, threatening long-term viability.

Integrating risk information, appetite and performance measures into strategy, investment, pricing and operational decisions so risk management changes what the organisation actually does.