IRM International Certificate flashcards
IRM International Certificate · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Risk
- The effect of uncertainty on objectives. The effect is a deviation from what is expected, and it can be positive or negative, strategic or operational.
- Risk management
- Coordinated activities to direct and control an organisation with regard to risk, including the framework that supports them and the process applied to individual risks.
- Risk appetite
- The amount and type of risk an organisation is willing to pursue or retain in order to meet its objectives, usually expressed in a statement approved by the board.
- Risk tolerance
- The acceptable variation around the risk appetite, often expressed as measurable thresholds, limits or ranges within which business units are permitted to operate.
- Risk attitude
- The organisation's approach to assessing and eventually pursuing, retaining, taking on or turning away from risk, shaped by culture, experience and bias.
- Inherent risk
- The level of risk assessed before taking account of the effect of existing controls, used as a baseline to show how much protection current controls provide.
- Residual risk
- The level of risk remaining after existing controls have been applied and their effectiveness assessed, and the figure normally compared with risk tolerance.
- Target risk
- The level of risk the organisation is willing to accept for a particular activity, used as the benchmark against which residual risk is judged.
- Aleatory uncertainty
- Irreducible randomness or natural variability in a system, such as the outcome of a die roll, which cannot be reduced by gathering more information.
- Epistemic uncertainty
- Uncertainty arising from lack of knowledge or incomplete information, which can in principle be reduced through research, data collection and expert input.
- Three lines model
- A governance structure where the first line owns risk, the second provides oversight and challenge, and the third, internal audit, gives independent assurance to the board.
- Risk criteria
- The terms of reference against which the significance of a risk is evaluated, covering how likelihood and consequence are expressed and where the acceptable boundary lies.
- Risk owner
- The person or entity with the accountability and authority to manage a risk, including approving and monitoring treatment actions and reporting changes in exposure.
- Risk source
- An element which alone or in combination has the potential to give rise to risk, such as a supplier, a process, a market condition or a human behaviour.
- Control
- A measure that maintains and/or modifies risk, including any process, policy, device, practice or other action that reduces likelihood or consequence.
- Risk identification
- The process of finding, recognising and describing risks, including their sources, causes, events and potential consequences, using techniques such as workshops and checklists.
- Risk analysis
- The process of comprehending the nature of a risk and determining its level, considering causes, consequences, likelihood and the effectiveness of existing controls.
- Risk evaluation
- The process of comparing the results of risk analysis with risk criteria to determine whether the risk and its magnitude are acceptable or tolerable.
- Risk treatment
- The process of selecting and implementing options to address risk, choosing among avoiding, reducing, transferring or accepting, and planning and executing the chosen actions.
- Bow-tie analysis
- A diagram with a top event at the centre, threats and preventive controls on the left, and consequences and mitigating controls on the right, showing both sides of risk.
- SWIFT analysis
- Structured What-If Technique: a facilitated workshop using a standard prompt set ('what if...') applied systematically to a process or system to identify risks.
- HAZOP
- Hazard and Operability study: a systematic team-based technique applying guide words such as no, more, less and reverse to process parameters to find deviations.
- FMEA
- Failure Mode and Effects Analysis: a bottom-up technique listing component failure modes, their effects and causes, and ranking them by severity, occurrence and detection.
- Fault tree analysis
- A top-down deductive technique starting from an undesired top event and using Boolean logic gates to trace the combinations of basic events that could cause it.
- Hierarchy of controls
- A ranking of control effectiveness from most to least reliable: eliminate, substitute, engineering controls, administrative controls, and finally personal protective equipment.
- Risk register
- A record of identified risks with their causes, consequences, owners, inherent and residual ratings, controls, treatment actions and review dates, used to track exposure.
- Risk matrix
- A tool plotting likelihood against consequence to give a risk score and priority band; cells map to treatment decisions, but scores are ordinal, not cardinal.
- Key risk indicator
- A forward-looking metric with defined thresholds that signals whether risk exposure is rising or falling, enabling action before losses occur.
- Business impact analysis
- An analysis identifying critical activities and the consequences of their disruption over time, used to set recovery time and recovery point objectives for continuity planning.
- Recovery time objective
- The target time within which an activity or system must be restored after a disruption; it must not exceed the maximum tolerable period of disruption.
- Risk transfer
- A treatment option that shifts the financial or contractual consequence of a risk to another party, for example through insurance, outsourcing or contractual indemnities.
- Risk monitoring and review
- The continuous or periodic process of tracking identified risks, testing controls and checking indicators, escalating when residual risk moves outside tolerance.