MoR Practitioner cheat sheet

Risk is the combination of the probability of an event and its consequence; uncertainty that matters either way (threat or opportunity).

Risk = f(likelihood, impact). Exposure = likelihood × impact; use it to rank, not to predict a single outcome.

Inherent risk is assessed before controls; residual risk after controls; target risk is the acceptable level the organisation aims for.

Risk appetite is the amount and type of risk an organisation is willing to seek or retain; risk tolerance is the acceptable variation around that appetite.

Three lines model: first line owns and manages risk, second line sets framework and oversight, third line gives independent assurance.

Threat exploits a vulnerability to produce an impact on an asset; a control reduces likelihood, impact, or both.

Risk can be positive (opportunity) as well as negative (threat); both are managed through the same process with different responses.

Gross versus net: gross risk ignores controls, net risk includes control effectiveness; control effectiveness is judged by design and operating evidence.

Risk owner is accountable for a specific risk; risk action owner is accountable for delivering a specific response.

Framework components: mandate and commitment, framework design, risk management process, and continual improvement - the four elements of ISO 31000-style frameworks.

A risk management policy states objectives, scope, accountabilities, appetite, and reporting requirements; it is approved at governing-body level.

The framework must be proportionate to the organisation's size, sector, and complexity; a small entity uses simpler artefacts than a large one.

Risk architecture (roles, committees, escalation routes) is distinct from risk process (identify, assess, respond, monitor) and from risk protocol (meetings, reports, templates).

Escalation rules define thresholds: risks above appetite or above a defined exposure score go to the next governance tier.

Risk taxonomy provides a consistent set of categories (strategic, operational, financial, compliance, reputational) so risks are comparable across units.

A risk register records risk description, cause, event, consequence, owner, inherent/residual scores, controls, and response actions with dates.

Three-point or range estimates are preferred over single-point estimates when assessing uncertain impacts.

Framework review cadence is set in the policy; annual review plus event-driven review after incidents or major change is typical.

Process sequence: establish context → identify → analyse → evaluate → treat → monitor and review → communicate and consult (communication is continuous, not a final step).

Establishing context sets scope, objectives, stakeholders, external and internal factors, and the risk criteria (appetite, thresholds) used later to evaluate.

Identification techniques include workshops, interviews, SWOT, PESTLE, bow-tie analysis, fault tree, FMEA, and scenario analysis; use more than one.

A well-formed risk statement follows cause → event → consequence, e.g. 'Because X may occur, Y could happen, leading to Z'.

Analysis separates likelihood and impact ratings using a defined scale; the matrix must be calibrated so the same score means the same thing everywhere.

Evaluation compares analysed risk against criteria to decide: accept, treat, or escalate; it is a decision step, not another assessment.

Treatment options: avoid, reduce (mitigate), transfer (share, e.g. insurance), accept (retain), and exploit or enhance for opportunities.

Residual risk after treatment is compared with target risk; if residual exceeds tolerance, further treatment or escalation is required.

Bow-tie links threats and consequences through a top event, with preventive controls on the left and mitigating controls on the right.

Embedding means risk is part of normal decision-making (strategy, projects, procurement, change), not a separate compliance exercise.

Indicators: risk appears in board and management agendas, in business cases, and in performance objectives; owners can explain their risks without prompting.

Key risk indicators (KRIs) are leading metrics with defined thresholds that signal rising exposure; key control indicators (KCIs) evidence control health.

Maturity models describe progression (e.g. ad hoc → repeatable → defined → managed → optimised); use them to plan improvement, not to score for its own sake.

Assurance mapping shows which controls are covered by which assurance source (management, compliance, internal audit) and where gaps or duplication exist.

Training and communication must be role-specific: boards need appetite and oversight, managers need assessment and treatment, staff need reporting routes.

Review triggers: scheduled cycle, incidents and near misses, audit findings, regulatory change, mergers, new systems, and shifts in appetite.

Risk culture is evidenced by escalation without fear, challenge of assumptions, and incentives that do not reward unmanaged risk-taking.

Performance measures for risk management should include timeliness of action closure and quality of risk information, not only counts of risks logged.