M_o_R 4 Practitioner flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk management principles

Eight enduring statements describing what effective risk management looks like: alignment with objectives, fit with context, stakeholder involvement, clear guidance, informed decisions, continual improvement, supportive culture, and measurable value.

Aligns with objectives

The principle that risk activity is driven by and judged against the organisation's stated goals, rather than performed as a standalone compliance or documentation exercise.

Fits the context

The principle requiring risk practice to be tailored to the organisation's size, complexity, sector, regulatory environment, and risk appetite, rather than copied unchanged from elsewhere.

Supportive culture principle

The principle that leadership visibly backs risk management, near misses are reported without blame, and staff are encouraged to raise concerns and take appropriate, informed risks.

Measurable value principle

The principle that risk management must demonstrate tangible benefit, such as better decisions, fewer surprises, or reduced losses, rather than being judged by the volume of paperwork produced.

Involves stakeholders principle

The principle that people affected by or able to influence a risk are identified and engaged proportionately, so that their knowledge, concerns, and interests shape the risk response.

Risk management policy

The documented statement of the organisation's risk objectives, mandate, accountabilities, and appetite, forming the top-level authority under which all risk work is carried out.

Risk appetite

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, ideally expressed as measurable thresholds and limits usable in escalation decisions.

Risk capacity

The maximum level of risk the organisation could bear before breaching its obligations or failing; appetite should sit at or below capacity.

Risk management strategy

The document describing how the policy will be delivered: the approach, techniques, roles, reporting lines, and resources used to manage risk across the organisation.

Tailoring the approach

Adjusting the depth, techniques, and reporting of risk management to the organisation's scale, complexity, maturity, and sector, rather than adopting a uniform standard unchanged.

Escalation thresholds

Pre-agreed exposure levels or appetite breaches that require a risk to be referred upward to the level holding authority to accept it or fund a response.

Risk management health check

A review testing whether the risk process is being applied as designed, identifying gaps in practice and feeding corrective actions into the improvement plan.

Identify risks step

The process step that surfaces risks together with their causes and effects, using workshops, prompt lists, interviews, SWOT, and review of past incidents and lessons learned.

Assess risks step

The process step that estimates probability and impact to derive an exposure rating, then considers proximity and velocity to determine how urgently a response is needed.

Risk response options

The available treatments: avoid the activity, reduce probability or impact, transfer to a third party, accept and monitor, and for opportunities exploit or share the upside.

Residual risk

The exposure remaining after a planned response has been applied; it is compared against risk appetite to confirm the risk is tolerable or requires further action.

Risk owner

The named individual accountable for managing a specific risk, including approving the response, monitoring exposure, and escalating when thresholds are breached.

Risk actionee

The person assigned to carry out the specific actions in a risk response plan, reporting progress to the risk owner, who retains overall accountability for the risk.

Probability-impact grid

A qualitative tool plotting likelihood against consequence to assign an exposure rating, enabling risks to be ranked, compared, and prioritised for response.

Risk proximity

How soon a risk is expected to materialise; a near-term risk usually demands faster action than a distant one with the same exposure rating.

Risk velocity

The speed at which a risk would cause harm once triggered; high-velocity risks need faster detection, shorter review cycles, and pre-agreed contingency.

Implement and review step

The process step confirming responses were executed as planned, reassessing residual exposure, and identifying new risks arising from change or from the response itself.

Embedding risk management

Making risk thinking part of everyday decision-making in business cases, projects, procurement, and performance reviews, rather than a separate compliance activity.

Risk maturity model

A framework describing progression from ad hoc practice through repeatable and defined stages to managed and optimised risk management, used to plan improvement.

Key risk indicator

A metric monitored against agreed thresholds that provides early warning that a risk is increasing, triggering action before the impact is realised.

Continual improvement loop

The cycle in which lessons from incidents, audits, health checks, and assurance reviews are captured and used to update the approach, techniques, and training.

Strategic perspective

The risk context concerned with long-term direction, reputation, and viability of the whole organisation, owned at executive and board level.

Programme perspective

The risk context concerned with achieving benefits across a set of interdependent projects, including transition risks between projects and the business.

Project perspective

The risk context concerned with delivering defined outputs within agreed time, cost, and quality constraints, owned by the project manager and project board.

Operational perspective

The risk context concerned with day-to-day service delivery, process failure, and compliance with internal and external requirements, owned by line management.

Assurance versus risk ownership

Assurance and audit independently examine and challenge how risks are managed, but accountability for managing each risk stays with the business owner.