IRM International Certificate cheat sheet

Risk is the effect of uncertainty on objectives; effects are deviations from the expected, positive or negative, and objectives can be strategic, operational, financial or compliance-related.

ISO 31000 defines risk as the effect of uncertainty on objectives; the older probability-times-consequence view (ISO Guide 73) is a measurable special case, not the general definition.

Risk management is coordinated activities to direct and control an organisation with regard to risk; the framework provides the foundations and arrangements, while the process is applied to individual risks.

The ISO 31000 process steps in order are: establishing scope, context and criteria; risk identification; risk analysis; risk evaluation; risk treatment; and monitoring and review with recording and reporting throughout.

Inherent risk is assessed before controls; residual risk after controls; target risk is the level the organisation is willing to accept, and the gap between residual and target drives treatment decisions.

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain; risk tolerance is the acceptable variation around that appetite, often expressed as measurable thresholds or limits.

Risk attitude is the organisation's approach to assessing and eventually pursuing, retaining, taking on or turning away from risk; it is influenced by conscious and subconscious biases.

Three lines model: the first line owns and manages risk in the business, the second line provides oversight, guidance and challenge, the third line (internal audit) provides independent assurance.

Uncertainty has two dimensions: aleatory (irreducible randomness or variability) and epistemic (reducible lack of knowledge); only epistemic uncertainty can be reduced by gathering information.

Risk identification techniques include brainstorming, structured interviews, Delphi, SWIFT (structured what-if), HAZOP, FMEA, fault tree and event tree analysis, scenario analysis and bow-tie analysis.

The risk matrix plots likelihood against consequence; risk score = likelihood x consequence, and the matrix's cells map to treatment priorities, but scores are ordinal and should not be summed across different risks.

The 4Ts of hazard response: Tolerate (accept and monitor), Treat (apply controls to reduce likelihood or impact), Transfer (insurance, contracts, outsourcing) and Terminate (avoid the activity).

The hierarchy of controls, most to least effective, is: eliminate, substitute, engineering controls, administrative controls, then personal protective equipment.

Bow-tie analysis links causes (threats) through preventive controls to a top event, and from the top event through mitigating controls to consequences; it makes control effectiveness visible on both sides.

Key risk indicators are forward-looking metrics with defined thresholds (often amber and red) that signal rising exposure; they are leading indicators, unlike loss data which is lagging.

A risk register typically records risk ID, description, cause, consequence, owner, inherent and residual ratings, existing controls, treatment actions, due dates and review dates; a risk owner is accountable for managing the risk.

Business continuity uses a business impact analysis to set recovery time objectives (RTO) and recovery point objectives (RPO); the RTO must not exceed the maximum tolerable period of disruption.

Monitoring and review is continuous: controls are tested, indicators tracked, and the register refreshed at defined intervals, with escalation triggered when residual risk exceeds tolerance.