MoR Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk (MoR definition)

An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. It links probability of occurrence with impact on objectives.

Issue versus risk

A risk has not yet happened and may or may not occur. An issue has already occurred and must be managed now, so it is tracked separately from the risk register.

Threat and opportunity

A threat is a risk whose effect on objectives would be negative. An opportunity is a risk whose effect would be positive. MoR manages both through the same process.

MoR framework components

MoR combines principles that express intent, perspectives that locate risk ownership, an eight-step process describing activity, and embedding and reviewing activity that sustains practice over time.

Purpose of risk management

To support better decision-making under uncertainty by identifying, assessing, and responding to uncertain events, protecting value and enabling informed risk-taking rather than eliminating all uncertainty.

Risk management creates value

A MoR principle stating that risk management contributes to objectives and performance. It is justified by improved decisions and protected value, not by document production.

Integral part of processes

A MoR principle requiring risk management to be built into planning, delivery, and operational processes rather than added afterwards as a separate compliance activity.

Best available information

A MoR principle stating that risk decisions should use timely, relevant data and informed judgement, acknowledging the limits and uncertainty of the information available.

Tailored, human-aware principles

MoR requires risk management to be tailored to the organization's context and to take human and cultural factors such as bias and behaviour into account.

Transparent and inclusive

A MoR principle requiring appropriate involvement of stakeholders and open sharing of risk information, so that those affected understand risks and contribute to their management.

Risk appetite

The amount and type of risk an organization is willing to seek or accept in pursuit of its objectives. It is expressed in the approach and made measurable through tolerances.

Risk tolerance

The measurable boundary or limit applied to a specific objective, category, or level, translating the broader risk appetite into thresholds that trigger escalation or treatment.

Risk capacity

The maximum level of risk the organization could bear before its viability or objectives are seriously threatened. Appetite should be set below capacity.

Risk management approach document

A document setting out scope, objectives, appetite and tolerances, roles, process, scales, reporting, and escalation routes, showing how principles apply in that organization.

Tailoring risk management

Adapting scales, formality, tooling, and reporting frequency to the size, complexity, and significance of the context, while still meeting the intent of the principles.

Estimate step

The process step that assesses each identified risk in terms of probability, impact, proximity, and velocity, producing a comparable rating used for evaluation.

Evaluate step

The process step comparing estimated risk against defined tolerances to decide whether it is acceptable, requires a response, or must be escalated to a higher level.

Threat response options

The standard set of responses to negative risks: avoid by removing the cause, reduce by mitigating probability or impact, transfer to a third party, or accept and monitor.

Opportunity response options

The standard set of responses to positive risks: exploit to realize the opportunity, enhance to raise probability or impact, share with a partner, or accept.

Residual risk

The level of risk remaining after planned responses have been implemented. It is recorded during implementation and compared again against tolerance.

Communication and consultation

A process activity running throughout all steps, ensuring stakeholders understand risks, responses, and decisions, and can contribute information and challenge.

Embedding risk management

Making risk management part of normal working practice so it informs everyday decisions, evidenced by active owners, standing agenda items, and use in business cases.

Review triggers

Events that prompt an unscheduled review of risk management, such as major change, a significant issue, a failed assumption, or a shift in strategic objectives.

Process versus culture maturity

A distinction in review: process maturity asks whether the process is followed, culture maturity asks whether risk information is valued and actually used in decisions.

Strategic perspective

The perspective concerned with risks to the organization's overall objectives, reputation, and long-term viability, owned at executive or board level.

Programme perspective

The perspective concerned with risks to delivering a group of related projects and realizing their benefits, including cross-project dependencies and shared resources.

Project perspective

The perspective concerned with risks to producing the project's products and meeting its objectives within agreed time, cost, quality, and scope constraints.

Operational perspective

The perspective concerned with risks in day-to-day service delivery and business-as-usual processes, where recurring risks are managed through standard procedures and controls.

Risk aggregation and escalation

Aggregation combines related lower-level risks for higher-level reporting without double counting; escalation moves a risk to the level where it can best be managed.

Risk owner

The person accountable for managing a specific risk, including its assessment, response plan, and monitoring. Ownership should sit where authority to act exists.

Risk action owner

The person responsible for completing a specific response action for a risk. Several action owners may exist, but each risk should have one accountable risk owner.

Risk health check

A structured assessment of current risk management practice against the principles, approach, and process, producing evidence-based findings and prioritized improvement actions.