IRM International Certificate key terms

The effect of uncertainty on objectives, where that effect can be positive or negative. It combines the likelihood of an event with the consequences if it occurs.

A lack of complete knowledge about an outcome, its timing, or its cause. It exists whether or not anyone has measured or described the possible results.

A specific result an organisation or individual intends to achieve, expressed in measurable terms. Risk is always assessed relative to such goals, because impact only has meaning against them.

A source or situation with the potential to cause harm, damage, or loss. It is the origin of a threat rather than a measure of how likely or severe the resulting harm is.

A person, group, natural force, or circumstance that could exploit a vulnerability and cause harm. Threats are the actors or events behind an adverse outcome.

A favourable possibility arising from uncertainty that could help achieve objectives if recognised and pursued. Risk management covers upside as well as downside effects on goals.

The chance that a defined event or outcome will occur within a stated period or context. It is usually described qualitatively or estimated as a probability or frequency.

The consequence or effect on objectives if an event occurs, measured in financial, operational, safety, legal, or reputational terms. It may be expressed as a range rather than a single figure.

The level of risk that exists before any controls or mitigation are applied. It shows the exposure an organisation would carry if it did nothing to manage the risk.

The risk that remains after existing controls and treatments have been applied. It is compared with the target risk level to decide whether further action is needed.

The amount and type of risk an organisation is willing to pursue or retain in order to meet its objectives. It is set at the top and guides decisions across the business.

The acceptable variation around a specific objective or risk limit that the organisation is prepared to live with. It translates broad appetite into practical thresholds for day-to-day decisions.

The maximum level of risk an organisation can absorb before its solvency, reputation, or ability to operate is seriously threatened. It is a hard constraint that appetite should never exceed.

The origin of a risk, such as a physical, human, technological, legal, or market factor. Identifying sources helps analysts understand what drives exposure before controls are designed.

A weakness in processes, systems, people, or physical assets that makes it easier for a threat to cause harm. Controls usually target vulnerabilities rather than the threat itself.

The set of principles, governance arrangements, and processes an organisation uses to manage risk systematically. It links risk activity to strategy, decision-making, and reporting.

A formal statement of the organisation's commitment to managing risk, its objectives, and the responsibilities of staff. It gives authority and direction to the wider framework.

The way authority, accountability, and oversight for risk are assigned and exercised across an organisation. It defines who decides, who monitors, and who reports on risk.

The person with the authority and accountability to manage a particular risk, including approving and monitoring its treatment. Ownership ensures every significant risk has a named responsible individual.

A governance structure in which operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance. It separates doing, monitoring, and assurance.

The process of finding, recognising, and describing risks that could affect objectives. It draws on workshops, checklists, data analysis, and expert judgement to build a complete risk register.

The overall process of identifying risks, analysing their likelihood and impact, and evaluating whether they are acceptable. It provides the evidence for prioritising treatment decisions.

The part of risk assessment that examines causes, sources, consequences, and the likelihood of identified risks. It produces an understanding of the level of risk and its main drivers.

Comparing the results of risk analysis with the organisation's criteria to decide whether a risk is acceptable or needs treatment. It turns analysis into a decision.

The standards, thresholds, and reference points used to judge the significance and acceptability of a risk. They may cover financial loss, safety, legal limits, or reputational damage.

A score or category assigned to a risk, usually by combining likelihood and impact on a matrix or through a formula. It helps rank risks and set priorities for action.

A grid that plots likelihood against impact to produce a risk level for each combination. It supports consistent, visual comparison of risks across a portfolio.

A record of identified risks together with their causes, owners, ratings, controls, and planned treatments. It is a living document used to track and report on risk over time.

A measure that modifies the likelihood or impact of a risk, such as a procedure, safeguard, or system. Controls may be preventive, detective, or corrective in nature.

The process of selecting and implementing measures to address a risk, often by avoiding, reducing, transferring, or accepting it. Each option is weighed for cost and effectiveness.

A treatment option that removes the activity or exposure that creates a risk. It eliminates the risk but may also forgo the benefits the activity would have delivered.

Shifting the financial consequences of a risk to another party, for example through insurance, outsourcing, or contracts. The underlying risk may remain even though the loss is shared.

Accepting a risk and its consequences without transferring or avoiding it, often because the exposure is small or the cost of treatment outweighs the benefit. Retention may be deliberate or unintentional.

A deliberate decision to live with a risk without further treatment, taken with full knowledge of its level. It is only valid when the risk falls within agreed tolerance.

A measure that tracks changes in exposure or control effectiveness and gives early warning of rising risk. Good indicators are forward-looking, measurable, and linked to a specific risk.

The ongoing process of tracking risks, controls, and indicators to detect changes and confirm that treatment is working. It feeds reporting and triggers action when limits are approached.

Communicating information about risk levels, trends, and treatment progress to decision-makers and other stakeholders. Effective reporting is timely, relevant, and matched to the audience.

An independent function that evaluates the design and effectiveness of risk management and controls. It provides assurance to the board rather than managing risk itself.

A capability that prepares an organisation to keep critical activities running, or restore them quickly, during disruption. It covers planning, testing, and recovery arrangements.