ISO 31000 RM key terms

The effect of uncertainty on objectives. That effect is a deviation from what is expected and can be positive or negative, and the objectives may relate to any area of an organization's activity.

A state of not having enough information about an event, its consequences or its likelihood, so that knowledge and understanding of a situation remain incomplete.

Coordinated activities an organization carries out to direct and control itself with regard to risk, covering both the framework that supports it and the process applied day to day.

The result a person, team or organization intends to achieve. Risk is always judged by how uncertain events could affect these intended results.

An element that, alone or together with other elements, has the potential to give rise to risk. Sources may be internal or external and tangible or intangible.

An occurrence or a change in a particular set of circumstances. Events may be certain or uncertain and can have several causes and several consequences.

The outcome of an event that affects objectives. Consequences can be expressed as certain or uncertain, positive or negative, and may range from minor to severe.

The chance of something happening. It is a broad term covering probability, frequency or plausibility, whether described qualitatively or measured quantitatively.

The magnitude of a risk, expressed by combining the consequences that could result with the likelihood that those consequences occur.

The terms of reference used to judge how significant a risk is, covering how consequences and likelihood are expressed, what is acceptable and how treatment decisions are made.

The amount and type of risk that an organization is willing to pursue or keep in order to achieve its objectives.

The maximum amount of risk an organization is able to bear, for example financially or operationally, before it can no longer absorb losses or disruption.

An organization's approach to assessing risk and then deciding whether to pursue it, keep it, take it on or turn away from it.

The person or entity with the accountability and authority to manage a particular risk, including deciding and overseeing how that risk is treated.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or an activity.

A measure that keeps risk within desired limits or otherwise changes it, such as a physical barrier, a procedure, a check or an organizational arrangement. Controls may not work as intended.

The risk that remains after risk treatment has been applied and its effects have been taken into account; it should be documented and monitored.

The core ideas that make risk management effective: it is integrated, structured and comprehensive, customized, inclusive, dynamic, based on the best available information, considers human and cultural factors, and improves continually.

A principle requiring risk management to be part of governance and of all organizational activities, rather than a separate task performed in isolation by a specialist team.

A set of components that gives an organization the foundations and arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the whole organization.

The person or group of people with ultimate authority and accountability for the organization's strategy, direction and oversight, such as a board of directors.

The person or group of people that directs and controls an organization at the highest level and provides leadership and commitment for risk management.

A statement of the organization's overall direction, intent and commitments regarding risk management, which guides how risk is handled across the organization.

A scheme within the framework that specifies the approach, the components of risk management and the resources to be applied to managing risk in a particular part of the organization.

The state of being answerable for decisions, actions and results, including for managing risks, to higher levels of authority and ultimately to the governing body.

The shared values, beliefs, attitudes and behaviours in an organization that shape how people identify, discuss and respond to risk.

A recurring activity to enhance performance, in which the framework and the process are repeatedly assessed and adjusted so that risk management becomes stronger over time.

The systematic application of policies, procedures and practices to communication and consultation, establishing context, and assessing, treating, monitoring, reviewing, recording and reporting risk.

Defining the external and internal parameters to be considered when managing risk, and setting the scope and the risk criteria for the rest of the process.

The overall process of risk identification, risk analysis and risk evaluation, carried out to understand risks and decide what should be done about them.

The process of finding, recognizing and describing risks, including their sources, causes, potential events and consequences.

The process of understanding the nature of a risk and determining its level, considering causes, consequences, likelihood, existing controls and any uncertainty involved.

The process of comparing the results of risk analysis with established risk criteria to decide whether a risk is acceptable or tolerable and whether treatment is needed.

The process of selecting and implementing options to modify risk, then checking whether the treatment achieved its intended result and whether the remaining risk is acceptable.

Ways of modifying risk: avoiding it, taking it to pursue an opportunity, removing its source, changing likelihood, changing consequences, sharing it, or retaining it by informed decision.

Continual checking, supervising or critical observation of the status of a risk, a control or the risk management framework, so that changes and emerging issues are detected.

An activity undertaken to determine whether risk management arrangements, controls or treatments are suitable, adequate and effective, and to identify where changes are needed.

Continual and iterative processes to provide, share or obtain information and to engage in dialogue with stakeholders about risk and its management.

Documenting risk management activities and their outcomes, and sharing that information with stakeholders through agreed channels, formats and timeframes.

A tool used to record identified risks together with their owners, assessed levels, existing controls, planned treatments and the status of actions.