Principles of Risk and Risk Management
Domain 1 tests precise risk vocabulary and how risk management is governed: definitions, the risk/uncertainty distinction, appetite, tolerance and capacity, risk categories, the ISO 31000 principles and board oversight.
Core rules
- ISO 31000:2018 defines risk as the effect of uncertainty on objectives. Effects can be positive (opportunity) or negative (threat); risk is not simply loss.
- Risk is not uncertainty: risk can be estimated with probabilities, uncertainty cannot. Risk also differs from a hazard (a source of harm) and an issue (a risk that has occurred).
- Risk management is coordinated activities to direct and control an organisation with regard to risk. It is iterative, not a one-off project.
- Appetite is the amount and type of risk an organisation is willing to pursue or retain. Tolerance is acceptable deviation for a specific objective. Capacity is the maximum risk it can bear before failure, such as breaching a covenant.
- Categories - strategic, operational, financial, compliance/regulatory and reputational - aid ownership but overlap.
- ISO 31000 principles: integrated, structured and comprehensive, customised, inclusive, dynamic, best available information, human and cultural factors, continual improvement.
- The board sets appetite and oversees the framework. The IIA Three Lines Model separates management (first line), risk and compliance oversight (second) and independent internal audit (third). Culture - tone at the top, incentives and speak-up - decides whether this works.
Worked example
A £50m-turnover retailer plans an online launch abroad. The board accepts up to £2m one-off loss and no data-protection breach; its covenant fails at £5m, and a 10% budget overrun is tolerated. The cyber-breach risk is compliance and reputational; currency exposure is financial; new revenue is an opportunity. The country director owns the risk, not the risk manager. Appetite (£2m), tolerance (10% overrun) and capacity (£5m) are different measures.
Traps
Don't confuse appetite with tolerance or capacity; don't define risk as probability × impact rather than effect on objectives; don't treat risk as only downside; don't say risk management eliminates risk; don't assume the risk manager owns every risk.