III IC-86 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk

The combination of the likelihood of an uncertain event and its consequence on objectives; it is assessed, evaluated, and treated rather than assumed away.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives, set by governance before assessment begins.

Risk tolerance

The acceptable measurable variation around the risk appetite; breaching a tolerance threshold requires escalation and action rather than continued monitoring.

Residual risk

The exposure that remains after treatment actions are applied and controls operate; it must be re-scored and recorded in the register.

Inherent risk

The level of exposure before any controls or treatment are applied; comparing it with residual risk shows how much risk the controls actually remove.

Secondary risk

A new risk created by the response itself, such as a new dependency introduced by a mitigation; it is identified and assessed before the response is approved.

Expected Monetary Value

Probability multiplied by monetary impact, summed across branches; used to compare alternatives on a common financial basis after subtracting option costs.

Contingency reserve

Funds set aside for identified risks (known-unknowns), sized from expected value or a confidence level and released by the risk owner when a trigger occurs.

Management reserve

Funds held for unidentified risks (unknown-unknowns), outside the risk register and released only with senior authority approval.

Risk register

The record of each risk's description, cause, effect, probability, impact, score, owner, response, residual risk, trigger, and status.

Risk breakdown structure

A hierarchical categorization of risk sources, such as technical, external, organizational, and commercial, used to make identification systematic rather than ad hoc.

Risk owner

The person accountable for managing a specific risk, monitoring its trigger, executing the response, and reporting changes; accountability is not delegated with the action.

Risk trigger

A defined condition or event indicating that a risk is about to occur; its detection activates the pre-approved contingency plan and owner actions.

Risk response: avoid

Eliminating the activity or cause that creates the threat; the only strategy that removes exposure rather than shifting or reducing it.

Risk response: transfer

Shifting the financial consequence to another party through insurance or contract; reputational and operational disruption usually remain with the organization.

Risk response: mitigate

Reducing the probability or impact of a threat through controls; justified when the expected loss reduction exceeds the control's total cost of ownership.

Risk response: accept

Retaining the risk, either actively with a contingency reserve or passively with no action; valid only when residual risk is within tolerance and documented with authority.

Opportunity responses

Exploit, share, enhance, and accept; the mirror of threat strategies, applied to increase the probability or benefit of a favorable uncertain event.

Qualitative risk analysis

Ranking risks by likelihood and impact using defined scales or a matrix; it prioritizes risks but does not assign monetary values.

Quantitative risk analysis

Assigning numeric or monetary values through EMV, decision trees, or Monte Carlo simulation to compare risks and response options on a common basis.

Monte Carlo simulation

Running many iterations of input probability distributions to produce a distribution of outcomes, supporting confidence-level estimates such as a P80 figure.

Decision tree

A diagram of sequential decisions and chance branches; expected values are computed backward from terminal branches to choose the best alternative.

Sensitivity analysis

Testing how changes in individual variables affect the outcome, often shown in a tornado diagram, to identify which drivers deserve monitoring priority.

Value at Risk

The maximum expected loss at a stated confidence level over a defined horizon; it does not describe the size of losses beyond that threshold.

Key risk indicator

A leading metric with defined green, amber, and red thresholds; an amber reading prompts investigation and a red reading triggers escalation and action.

Risk velocity

The speed at which a risk's impact would materialize after it occurs; high-velocity risks need pre-approved response plans rather than after-the-fact design.

Risk proximity

How soon a risk could occur; among risks with equal scores, nearer-term risks are prioritized because there is less time to respond.

Risk heat map

A matrix plotting likelihood against impact to show relative priority; it is refreshed after treatment to display residual rather than inherent exposure.

Three lines model

Operational management owns risk, risk and compliance functions monitor and advise, and internal audit provides independent assurance to governance.

Control effectiveness

The reduction in risk achieved by controls, calculated as inherent minus residual divided by inherent, expressed as a percentage of risk removed.

Preventive versus detective control

Preventive controls reduce the probability of an event occurring; detective controls reduce impact by identifying events sooner so corrective action can follow.

Stress testing

Applying extreme but plausible scenarios to check whether exposure remains within tolerance, complementing probability-based analysis that underweights rare events.