MoR Foundation key terms

An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. It is measured by combining the probability of occurrence with the impact it would cause.

A lack of certainty about an outcome or future state, arising from incomplete knowledge or variability. It is the raw material of risk, since without uncertainty there would be nothing to manage.

An uncertain event that, if it occurred, would have a negative effect on one or more objectives. Threats are the downside of risk and are usually the focus of mitigation activity.

An uncertain event that, if it occurred, would have a positive effect on objectives. Managing opportunity means exploiting favourable uncertainty rather than only defending against loss.

A defined, measurable result that an organisation, project, or activity is trying to achieve. Risk only has meaning relative to objectives, because effect is judged against them.

The systematic process of identifying, assessing, planning responses to, and monitoring uncertainty in order to improve the likelihood of achieving objectives. It is a continuous activity, not a one-off exercise.

A structured set of principles, approach, process, and roles for managing risk across an organisation. It provides a common language and repeatable steps so risk work is consistent rather than ad hoc.

The enduring, high-level rules that shape how risk management is designed and carried out. They guide behaviour and decision-making, and are meant to remain stable even as processes and tools change.

The shared values, attitudes, and behaviours that determine how people in an organisation actually treat risk. A healthy culture encourages early reporting of uncertainty rather than concealment.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. It sets boundaries for decision-making and informs how much response effort is proportionate.

The specific, measurable level of variation an organisation will accept around a particular objective or risk. It translates broad appetite into practical thresholds that trigger action when breached.

The maximum risk an organisation could absorb if things went wrong, given its resources and reserves. Capacity is a hard limit, whereas appetite is a chosen preference within that limit.

The documented way an organisation chooses to implement risk management, covering scope, process tailoring, governance, and reporting. It explains how principles are put into practice in a given context.

The overall structure of principles, processes, roles, and supporting tools used to manage risk. It gives coherence to individual risk activities and links them to governance.

The internal and external environment in which risk management takes place, including objectives, stakeholders, constraints, and culture. Understanding context ensures risks are assessed against the right backdrop.

The ordered sequence of activities used to handle risk, typically identify, assess, plan, implement, and review. It is cyclical and repeated as circumstances and objectives change.

The activity of finding, describing, and recording sources of uncertainty that could affect objectives. Good identification is broad and uses multiple techniques to surface risks that are not obvious.

The combined activity of estimating the probability and impact of identified risks and evaluating their overall significance. It produces the information needed to prioritise response effort.

The estimated likelihood that a particular uncertain event will occur within a defined period. It is one of the two dimensions, alongside impact, used to size a risk.

The estimated effect on objectives if a risk event occurs, expressed in terms such as cost, time, quality, or reputation. Impact may be assessed before or after planned responses.

The planned action taken to address an assessed risk, such as avoiding, reducing, transferring, or accepting it. Responses should be proportionate, owned, and scheduled.

The level of risk that remains after planned responses have been applied. It must be compared with tolerance to decide whether further action or escalation is needed.

The named person accountable for managing a specific risk and its response, including monitoring and reporting. Ownership should sit with someone who has authority over the relevant work.

The person responsible for carrying out a particular response action, as distinct from accountability for the risk itself. Separating the two makes delivery of responses explicit.

A structured record of identified risks, their assessment, responses, owners, and status. It is the working tool that supports monitoring, reporting, and review of risk.

The communication of risk information to decision-makers and stakeholders in a form they can act on. Good reporting is timely, relevant, and matched to the audience's level of detail.

The work of making risk management part of everyday decision-making and behaviour rather than a separate compliance exercise. It succeeds when risk thinking is routine and supported by incentives and habits.

A measure of how developed and effective an organisation's risk management is, often described in progressive levels from ad hoc to optimised. It helps target improvement effort.

A structured review that assesses the quality and effectiveness of risk management practice against a reference model. It identifies gaps and informs improvement actions.

A viewpoint from which risk is considered, such as strategic, project, operational, or programme level. Different perspectives change which objectives, timescales, and stakeholders matter.

Risk arising from high-level choices about direction, markets, and long-term objectives. It is typically owned at senior level and assessed over longer horizons than operational risk.

Risk arising from day-to-day processes, people, systems, and external events affecting service delivery. It is usually managed close to the work where it occurs.

Uncertainty that could affect the delivery of a project's objectives, timescales, or budget. It is managed within the project's boundaries but must connect to wider organisational risk.

Any person or group with an interest in, or influence over, the objectives and the risks affecting them. Engagement with stakeholders shapes both identification and acceptance of risk.

The process of raising a risk to a higher level of authority when it exceeds local tolerance or needs wider decisions. Clear thresholds and routes prevent risks being stranded.

The software, templates, and techniques used to capture, analyse, and report risk information. Tools should support the process rather than drive it, and be simple enough to be used consistently.