M_o_R 4 Practitioner key terms

An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. It is measured by combining the likelihood of the event with its potential impact.

The coordinated activities that direct and control an organisation with regard to risk. It covers setting direction, planning, executing, monitoring and improving how risks to objectives are handled.

The set of components that provide the foundations and arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout an organisation, including policy, objectives, accountabilities and supporting tools.

A formal statement of an organisation's overall intent, direction and commitment towards managing risk. It sets out why risk is managed, who is accountable and how the policy will be applied.

A high-level description of how risk management will be applied across an organisation, covering scope, approach, responsibilities, resources and the way the process will be tailored to organisational needs.

The amount and type of risk an organisation is willing to seek or accept in pursuit of its objectives. It is expressed qualitatively or quantitatively and guides decisions about which risks to take.

The specific, measurable level of deviation from risk appetite that an organisation is prepared to accept for a particular objective or category of risk. It translates appetite into practical thresholds and limits.

The maximum amount of risk an organisation is able to bear or absorb before its viability, finances or objectives are seriously threatened. It is a constraint on appetite rather than a choice.

A defined boundary or limit that indicates when a level of risk becomes unacceptable or requires escalation. Crossing a threshold typically triggers a defined management response.

The organisation's or individual's chosen position towards risk, shaped by perception, culture and context. It influences how risks are identified, judged and responded to in practice.

The way an individual or group interprets and judges a risk, influenced by experience, bias, values and context. Differing perceptions can lead to disagreement about the significance of the same risk.

The shared values, beliefs, behaviours and norms that determine how an organisation identifies, discusses and acts on risk. It shapes whether risk management is treated as a genuine discipline or a compliance exercise.

The systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing context and identifying, analysing, evaluating, treating, monitoring and reviewing risk.

Defining the external and internal parameters to be considered when managing risk, and setting the scope and criteria against which risk will be assessed. It aligns risk work with organisational objectives.

The terms of reference against which the significance of a risk is evaluated. Criteria may cover likelihood, impact, timescales, legal requirements and the level at which risk becomes acceptable.

The process of finding, recognising and describing risks, including their sources, causes and potential consequences. It produces a structured record of what could affect objectives before analysis begins.

An element, circumstance or driver that alone or in combination has the potential to give rise to risk. Sources may be internal, external, tangible or intangible.

A structured statement setting out a risk in terms of its source, events, causes, consequences and any relevant context. A clear description supports consistent analysis and treatment.

The event, condition or circumstance that gives rise to a risk and leads to a consequence. Identifying causes helps target treatment actions at the root rather than the symptom.

The outcome or effect of an event on objectives, which may be expressed qualitatively or quantitatively. Consequences may be positive as well as negative and can cascade over time.

The chance that a particular event or set of circumstances will occur. It may be described qualitatively, such as rare or likely, or estimated quantitatively as a probability or frequency.

The extent to which an event affects objectives, usually expressed in terms such as financial loss, time delay, reputational damage or harm to people. It is assessed in defined units or scales.

The combined measure of a risk derived from the likelihood of an event and the magnitude of its impact. It is used to compare risks and prioritise management attention.

The level of risk that exists before any controls or treatment actions are applied. It provides a baseline against which the value of controls can be judged.

The risk that remains after controls and treatment actions have been implemented. It is compared with risk tolerance to decide whether further action is required.

A measure that modifies a risk by reducing likelihood, reducing impact or both. Controls may be preventive, detective or corrective and should be proportionate to the risk they address.

An assessment of how well a control achieves its intended effect when operated as designed. Weak or unproven controls mean residual risk may be higher than assumed.

The process of comparing the results of risk analysis with risk criteria to determine whether a risk is acceptable or tolerable and whether treatment is required. It informs prioritisation and decisions.

The process of selecting and implementing options to address risk, such as avoiding, reducing, transferring, sharing or accepting it. Each option is assessed for cost, benefit and residual effect.

The chosen action taken to modify a risk in line with the organisation's appetite. The response is documented with an owner, actions, timescales and expected effect on exposure.

A documented plan describing the actions needed to implement a risk response, including responsibilities, resources, deadlines and how completion and effect will be monitored.

The person or entity with the accountability and authority to manage a particular risk, including approving and overseeing its response. Ownership should sit where the risk can best be influenced.

A record of identified risks and their analysis, including owners, responses, controls and status. It is a living tool for tracking and reporting risk, not a one-off document.

The continual checking and surveillance of risks, controls and the risk management process itself. It confirms that responses remain relevant and effective as circumstances change.

A periodic or event-driven examination of risks and the risk management framework to confirm they remain appropriate. Reviews may be triggered by change, incidents or scheduled cycles.

The formal communication of risk information to stakeholders in a form that supports decision-making. Good reporting is timely, relevant, comparable and tailored to the audience.

The process of raising a risk to a higher level of authority when it exceeds defined thresholds, cannot be managed locally or requires resources beyond the current owner's control.

Independent or objective confirmation that risk management arrangements and controls are working as intended. It provides confidence to governing bodies and supports continuous improvement.

A governance structure distinguishing management owning risk (first line), oversight functions providing challenge and support (second line), and independent assurance (third line). It clarifies accountability across the organisation.

A measure of how embedded and effective risk management is across an organisation, often described on a scale from ad hoc to optimised. It indicates where improvement effort should focus.

The work of making risk management part of everyday decision-making, processes and behaviour rather than a separate compliance activity. It is evidenced by consistent practice at all levels.

A state of incomplete knowledge or predictability about events, outcomes or their consequences. Risk management addresses uncertainty where it could affect the achievement of objectives.