III IC-86 cheat sheet

Risk = uncertainty that matters; it has two measurable components: probability (or likelihood) of occurrence and impact (severity of consequence) on objectives.

Risk management process order: establish context → identify risks → analyze risks → evaluate risks → treat risks → monitor and review → communicate and consult. Communication and monitoring are continuous, not single end-of-cycle steps.

Qualitative analysis ranks risks by likelihood × impact using scales or a matrix; quantitative analysis assigns monetary or numeric values (EMV, Monte Carlo, decision trees) to compare risks and options.

Expected Monetary Value (EMV) = probability × monetary impact. For a risk with 20% chance of a $50,000 loss, EMV = 0.20 × (−50,000) = −$10,000; sum EMVs of all risks in a branch to compare alternatives.

Risk response strategies for threats: avoid (eliminate the cause), transfer (shift financial consequence, e.g., insurance, contracts), mitigate (reduce probability or impact), accept (retain, active acceptance funds a contingency reserve).

Risk response strategies for opportunities: exploit, share, enhance, accept. Selecting a response is a decision rule: choose the option whose cost is less than the expected reduction in exposure.

Risk register records: risk ID, description, cause, potential effect, probability, impact, risk score, owner, response plan, residual risk, status, and trigger/early-warning indicator.

Residual risk is exposure remaining after treatment; secondary risk is a new risk created by the response itself. Both must be re-entered and monitored in the register.

Risk appetite is the amount of risk an organization is willing to pursue or retain; risk tolerance is the acceptable measurable variation around that appetite. Thresholds beyond tolerance trigger escalation.

Contingency reserve covers known-unknowns (identified risks) and sits under the owner's control; management reserve covers unknown-unknowns and requires higher-level approval to release.

Risk breakdown structure (RBS) organizes risk categories hierarchically (technical, external, organizational, commercial) to ensure identification covers all sources rather than only obvious ones.

Risk audit compares actual response effectiveness against the plan; variance and trend analysis track how risk exposure changes over time using the risk register's score history.

A risk trigger is a defined condition or event signaling that a risk is about to occur; its detection activates the contingency plan.

Probability-impact matrix zones: high-probability/high-impact risks require immediate action; low-probability/low-impact risks are typically placed on a watch list rather than actively treated.

Risk owner is accountable for managing a specific risk and its response; risk action owner executes individual response actions. Accountability is not delegated with the action.

Inherent risk is exposure before controls; residual risk is exposure after controls. Control effectiveness = (inherent − residual) / inherent, expressed as a percentage of risk removed.

Four treatment options in a general risk framework: tolerate (accept), treat (mitigate), transfer, terminate (avoid). Selection depends on whether residual risk falls within tolerance.

Key risk indicators (KRIs) are leading metrics with defined thresholds; breaching a threshold escalates the risk. Key performance indicators measure outcomes, not exposure.

Three lines model: operational management owns risk (first line), risk/compliance functions monitor and advise (second line), internal audit provides independent assurance (third line).

Risk heat map plots likelihood against impact; position determines priority, and the map is refreshed after each treatment cycle to show residual exposure.

Risk register review cadence is set by risk velocity: fast-moving risks (regulatory, cyber) are reviewed more frequently than slow-moving strategic risks.

Monte Carlo simulation runs many iterations of input distributions to produce a probability distribution of outcomes; output supports confidence-level estimates (e.g., P80 cost).

Decision tree expected value = sum over branches of (branch probability × branch outcome value); choose the branch with the highest expected value, then subtract option cost.

Sensitivity analysis (tornado diagram) ranks which variables most affect the outcome; it identifies the drivers worth monitoring rather than predicting a single result.

Value at Risk (VaR) states the maximum loss at a given confidence level over a defined horizon; it does not describe the size of losses beyond that threshold (tail risk).

Risk reporting to governance should state exposure against appetite, trend direction, top risks with owners, and the status of treatment actions - not just a list of risks.

Risk velocity = impact per unit time to occurrence; a high-velocity risk needs pre-approved response plans because there is no time to design a response after the trigger fires.

Identification techniques: brainstorming, Delphi (anonymous consensus rounds), interviews, checklist analysis, assumption analysis, SWOT, and root-cause analysis of prior incidents.

Assumption analysis surfaces risks hidden in unvalidated project or business assumptions; each invalid assumption is a potential risk with its own probability and impact.

Risk score = probability rating × impact rating on a defined scale (e.g., 1–5); scores are comparable only within the same scale and matrix definition.

Risk categorization by cause enables portfolio-level aggregation: many individually small risks in one category can combine into a material exposure.

Documented risk criteria (scales, thresholds, appetite) must be set before analysis; otherwise scoring is subjective and rankings are not comparable across assessments.

Risk management is iterative: new risks emerge as scope, environment, or controls change, so identification and assessment repeat at defined intervals and at stage gates.

Risk appetite statements should be specific and measurable (e.g., maximum acceptable loss per event) so that escalation decisions are rule-based rather than judgmental.

Lessons-learned from closed risks feed back into identification checklists; recurring risk causes indicate a control design failure, not bad luck.

Integration rule: risk treatment decisions are made against objectives, so a response that removes risk but blocks the objective is not a valid treatment.

Risk aggregation across units requires a common scale and taxonomy; without a shared risk breakdown structure, portfolio totals double-count or omit exposures.

Preventive controls reduce probability; detective controls reduce impact by finding events sooner; corrective controls restore after an event. Map each response to its control type.

Control testing evidence: design effectiveness (does the control address the risk?) and operating effectiveness (did it work over the period?). Both are needed to claim risk reduction.

Segregation of duties, approval limits, and reconciliation are classic preventive controls; monitoring alerts and audits are detective controls.

Risk acceptance requires documented authority at the level matching the exposure; acceptance above tolerance must be escalated to the accountable governance body.

Insurance and contractual indemnities transfer financial consequence but not all risk: reputational and operational disruption usually remain with the organization.

Stress testing applies extreme but plausible scenarios to test whether exposure stays within tolerance; it complements probability-based analysis, which underweights rare events.

Scenario analysis defines a plausible future state, then traces its consequences through the risk register to identify correlated or cascading risks.

Correlation matters: risks that usually occur together (e.g., supplier failure and transport disruption) must be assessed jointly, because summing individual EMVs understates combined exposure.

Business impact analysis ranks processes by maximum tolerable downtime and recovery point objective; these thresholds set the required risk response for continuity risks.

Single points of failure are identified by mapping dependencies; a dependency with no alternate path converts a low-probability event into a high-impact one.

Escalation rule: if residual risk exceeds the tolerance threshold for the owner's authority level, escalate to the next level with the assessment and proposed response.

Risk owner accountability includes monitoring triggers, executing the response, and reporting status changes; an unassigned risk is an unmanaged risk.

Risk-adjusted decision making compares options on expected value net of treatment cost, not on gross exposure alone.

Trend reporting compares current risk scores with prior periods; a stable score with rising KRI values signals that the current controls are losing effectiveness.

Near-miss and incident data are leading inputs to risk identification; capturing them converts operational experience into updated probability estimates.

Risk is often expressed as consequence × likelihood; ISO-style definitions separate risk source, event, consequence, and likelihood so each can be assessed and treated distinctly.

Inherent, current, and target risk are three distinct states: before controls, with controls as they operate today, and the level the treatment plan intends to reach.

Risk criteria are the terms of reference for evaluating significance: they define scales, thresholds, and what counts as acceptable, and are set by governance before assessment.

Risk treatment plan states the action, owner, due date, cost, and expected residual risk; a response without an owner and date is only an intention.

Risk communication must be timely and tailored to the audience: operational detail for owners, aggregate exposure and trend for governance bodies.

Monitoring and review checks whether controls remain effective, whether assumptions still hold, and whether new risks have emerged; outputs update the register and the treatment plan.

Risk review triggers include stage gates, significant change, incidents, audit findings, and scheduled intervals - whichever comes first.

Recording the rationale for accepted risks preserves accountability and supports later re-evaluation when conditions or appetite change.

Risk maturity progression: ad hoc → repeatable → defined → managed → optimized; each level adds standard criteria, aggregation, and quantitative analysis.

Post-event review compares actual impact with the assessed probability and impact; systematic underestimation indicates a calibration problem in the assessment scales.

Avoid is preferred when the activity's risk exceeds appetite and the objective can be met another way; it is the only strategy that removes the exposure rather than shifting it.

Mitigation is preferred when the cost of the control is lower than the expected loss it prevents (probability reduction × impact).

Transfer is appropriate when another party can bear the consequence more efficiently; it usually adds a cost (premium) and may leave residual operational risk.

Acceptance is valid only when residual risk is within tolerance and the acceptance is documented with authority; acceptance of an unassessed risk is not a decision.

Opportunity responses follow the same logic in reverse: exploit when the organization can capture the benefit, share when capability is missing, enhance when probability or benefit can be increased.

Data quality determines risk estimate reliability: historical frequency, expert judgment, and external benchmarks each carry different confidence and should be labeled as such.

Expected loss = frequency × average severity; for a portfolio, total expected loss is the sum across risk categories after adjusting for correlation.

Confidence level in a distribution (e.g., P90) means the outcome is expected to be at or below that value in 90% of simulated iterations - not a guarantee.

Risk limit and risk tolerance differ: a limit is a hard boundary that triggers action; tolerance is the acceptable range of variation within the appetite.

Quantified risk statements pair a probability estimate with a consequence estimate and a time horizon; a probability without a horizon is not actionable.

Establishing context defines external and internal parameters (objectives, stakeholders, constraints, criteria) that bound the risk assessment; changing context invalidates prior scoring.

Stakeholder analysis identifies whose objectives define impact; the same event can be low impact for one stakeholder and severe for another.

Risk culture determines whether risks are reported early; metrics such as escalation rates and near-miss reporting volume indicate reporting health.

Third-party risk is assessed on the same probability-impact basis as internal risk, with added concentration analysis for dependencies on a single supplier.

Risk appetite cascades: enterprise appetite sets thresholds for business units, which set operational limits for individual processes and owners.

Contingency plan is activated by a trigger and defines the specific actions, resources, and owner; it is prepared in advance for accepted risks with material impact.

Fallback plan is used when the primary response fails; it is a distinct, pre-approved alternative rather than an improvised reaction.

Workaround is an unplanned response to an occurred risk; it should be documented and later converted into a planned response if the risk recurs.

Residual risk after treatment must be re-scored and re-entered into the register; the treatment plan is not complete until residual exposure is recorded.

Response cost-benefit test: implement the control only if expected loss reduction exceeds the control's total cost of ownership.

Independent assurance (internal audit, external review) tests whether reported risk and control status matches reality; it does not own or manage the risk.

Board or equivalent body sets appetite and receives aggregate reporting; management executes within limits; the two roles must not be merged.

Risk committee reviews top risks, treatment progress, and breaches of limits; its decisions are recorded with owners and dates.

Escalation should include the assessment, the options considered, the recommended response, and the residual exposure if no action is taken.

Reporting integrity rule: aggregate risk figures must use a consistent taxonomy and scale, or the total will misstate exposure.

Root-cause analysis (e.g., 5 Whys, fishbone) identifies the underlying source of a risk; treating the symptom leaves the probability unchanged.

Checklist and prompt-list identification reduces omission but does not surface novel risks; combine with brainstorming and scenario analysis.

Delphi technique converges expert estimates anonymously over rounds, reducing dominance by senior voices; output is a probability and impact estimate.

Assumption-based identification: list every assumption the plan depends on and rate the consequence if it proves false.

Historical incident and near-miss logs are the most reliable source of frequency data for recurring operational risks.

Risk evaluation compares analyzed risk against criteria to decide whether treatment is required; analysis describes, evaluation decides.

Prioritization combines score with velocity and detectability: a moderate-score risk that is fast and hard to detect can outrank a higher-scoring slow risk.

Risk proximity is the time until a risk could occur; near-term risks take precedence over equal-score risks further out.

Risk clusters and correlated risks are prioritized as a group; treating them individually can leave aggregate exposure above tolerance.

Watch-list rule: risks below the treatment threshold are monitored with defined triggers rather than actively treated.

Each treatment action is tracked like any deliverable: owner, due date, cost, dependency, and completion evidence.

Treatment effectiveness is verified after implementation by re-measuring the probability or impact; an unimplemented or untested control provides no risk reduction.

Secondary risks created by a response are identified and assessed before the response is approved.

Residual risk acceptance is recorded at the appropriate authority level with the rationale and review date.

If treatment fails to bring residual risk within tolerance, the remaining options are further treatment, transfer, avoidance, or formal escalation.

KRI thresholds have three states: green (normal), amber (warning, investigate), red (breach, escalate and act).

Leading indicators predict future exposure (e.g., control test failures); lagging indicators record past events (e.g., losses incurred).

Loss-event data feeds frequency and severity estimates; the absence of recorded events is not evidence of low risk if reporting is weak.

Control self-assessment lets process owners rate control effectiveness; results are validated by independent testing.

Monitoring output must close the loop: every breach produces an action, an owner, and a date, recorded in the register.

If probability cannot be reduced economically, reduce impact (detection, contingency, transfer); if neither can be reduced, avoid the activity or escalate acceptance.

Choose the response with the lowest total cost of risk: expected residual loss plus cost of control plus cost of any transfer premium.

Do not treat a risk whose expected loss is below the cost of the cheapest effective control; monitor it instead.

When two risks are correlated, evaluate the combined exposure; treating one may not reduce the aggregate below tolerance.

Document the decision and its rationale whenever risk is accepted above the owner's authority, or when a recommended treatment is rejected.

Hazard is a source of potential harm; risk is the combination of the likelihood of harm and its consequence. A hazard exists even when risk is low.

Issue is a risk that has already occurred and is now managed as a problem; it moves from the risk register to the issue log.

Risk vs uncertainty: risk has assessable probability and impact; uncertainty is unquantified and is managed through reserves and flexibility.

Control is any measure that modifies risk; a control that is not documented, owned, and tested cannot be relied on in residual risk estimates.

Assurance is independent verification of control effectiveness; it supports but does not replace management's own monitoring.

Portfolio risk aggregates risks across units using a common taxonomy and scale; correlation adjustments prevent over- or under-statement of total exposure.

Concentration risk arises when many exposures share one driver (single supplier, single platform, single regulator); it is assessed at the driver level.

Diversification reduces aggregate risk only when exposures are not perfectly correlated; it does not reduce risk within a single correlated cluster.

Portfolio limits cap aggregate exposure by category and are monitored against the same thresholds used for individual risks.

Top-risk reporting selects by score, velocity, and proximity, not by score alone, so fast-moving exposures are not hidden.

Risk register review frequency is set by risk velocity and volatility of the environment, not by a fixed annual cycle.

Stage gates and major change events trigger a full re-identification and re-evaluation of risks.

Incident and near-miss reviews produce updated probability estimates and, where causes recur, a control redesign.

Appetite and criteria are reviewed periodically; if they change, all prior evaluations must be re-tested against the new criteria.

Assurance findings are tracked to closure with owners and dates; open findings above tolerance are escalated.

Expected Monetary Value decision rule: choose the alternative with the highest expected value after including the cost of each option.

Decision trees handle sequential decisions: compute expected values from the terminal branches backward to each decision node.

Monte Carlo outputs a distribution; report the confidence level alongside the value (e.g., P80 = 80% chance of not exceeding the figure).

Sensitivity analysis isolates the variables with the largest effect on the outcome; those variables become monitoring priorities.

VaR is horizon- and confidence-specific; comparing VaR figures computed with different horizons or confidence levels is invalid.

A complete response plan states the action, the owner, the trigger, the resources required, the expected residual risk, and the review date.

Contingency reserve is sized from the expected value or a confidence level of identified risks, and is released only by the risk owner.

Management reserve is held outside the risk register for unidentified risks and released by senior authority.

Fallback plans are prepared for responses that may fail; they are pre-approved so action is not delayed.

Workarounds for occurred risks are logged and reviewed so recurring causes become planned responses.

Early reporting is encouraged when escalation carries no blame; suppressed reporting raises undetected exposure.

Risk ownership is assigned to the person who controls the activity that creates the risk, not to the risk function.

Incentives that reward only outcomes without risk adjustment encourage excessive risk-taking; risk-adjusted measures correct this.

Near-miss reporting volume is a health indicator: rising reports with stable incidents suggest improving detection.

Governance effectiveness depends on decision rights: who may accept which level of risk must be defined in advance.

Risk management sequence: context, identification, analysis, evaluation, treatment, monitoring and review, communication and consultation throughout.

Qualitative analysis ranks; quantitative analysis prices. Use quantitative methods when the decision involves material cost or comparison of options.

Residual risk within tolerance → accept and monitor; above tolerance → treat, transfer, avoid, or escalate.

Every risk needs an owner, a score, a response, a trigger, and a review date; missing any one leaves the risk unmanaged.

Correlated risks are assessed jointly; independent summing understates aggregate exposure.

Audit findings are risks in their own right until remediated; they are entered into the register with an owner and date.

Design effectiveness asks whether the control, as designed, addresses the risk; operating effectiveness asks whether it worked over the period tested.

Sampling and testing evidence supports the residual risk estimate; unsupported estimates are assumptions, not measurements.

Repeat findings indicate a control environment weakness rather than an isolated failure, and require escalation.

Assurance coverage should target high-score, high-velocity risks first; low-risk areas need less frequent independent testing.

Risk statement format: cause → event → consequence, with probability and impact attached; this structure makes the risk testable and assignable.

Risk appetite (willingness to pursue) and risk tolerance (acceptable variation) together define the thresholds used in evaluation.

Treatment cost-benefit rule: act when expected loss reduction exceeds the total cost of the control.

Monitoring closes the loop: re-score residual risk, verify control effectiveness, and update the register after every treatment.

Escalation is rule-based: residual risk above the owner's authority is escalated with the assessment, options, and recommendation.