MoR Practitioner flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk definition

The effect of uncertainty on objectives; measured as a combination of the likelihood of an event and its consequence, and covering both threats and opportunities.

Inherent risk

The level of risk assessed before taking account of the effect of existing controls, used as a starting point to judge how much protection controls actually provide.

Residual risk

The level of risk remaining after existing controls are taken into account; it is compared with target risk and appetite to decide whether further treatment is needed.

Risk appetite

The amount and type of risk an organisation is willing to seek or retain in pursuit of its objectives, expressed in qualitative statements or quantitative thresholds approved by the governing body.

Risk tolerance

The acceptable variation or deviation from risk appetite that an organisation can live with before escalation or corrective action is triggered.

Risk exposure

A ranking value derived from combining likelihood and impact ratings, used to compare and prioritise risks rather than to predict a precise outcome.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides oversight and framework, and internal audit gives independent assurance.

Risk owner

The named person accountable for managing a specific risk, including approving its assessment and ensuring an appropriate response is delivered and monitored.

Risk framework

The set of components providing the foundations and arrangements for managing risk: mandate and commitment, framework design, the risk process, and continual improvement.

Risk management policy

A governing-body-approved statement of risk management objectives, scope, accountabilities, appetite and reporting requirements that authorises and directs the framework.

Risk architecture

The arrangement of roles, responsibilities, committees and escalation routes that determines who does what with risk information and at which level decisions are made.

Risk taxonomy

A defined set of risk categories, such as strategic, operational, financial, compliance and reputational, that allows risks from different units to be compared and aggregated consistently.

Risk register

A record of identified risks showing description, cause, consequence, owner, controls, inherent and residual ratings, and response actions with target dates.

Escalation threshold

A pre-agreed exposure level or criterion above which a risk must be reported to a higher governance tier for decision or oversight.

Risk criteria

The terms of reference against which the significance of a risk is evaluated, including appetite, thresholds, legal requirements and stakeholder expectations set when establishing context.

Proportionate framework

A framework designed to match the organisation's size, sector and complexity, so that artefacts and controls are sufficient without imposing unnecessary bureaucracy.

Risk process steps

Establish context, identify risks, analyse risks, evaluate against criteria, treat risks, then monitor and review, with communication and consultation running continuously throughout.

Establishing context

Defining the external and internal environment, objectives, stakeholders, scope and risk criteria that frame how risks will later be identified and evaluated.

Risk statement

A structured description linking cause, event and consequence, so that the risk can be assessed and an appropriate response identified.

Risk analysis

The step that develops an understanding of each risk by considering its causes, consequences, likelihood and existing controls, producing a rating used for evaluation.

Risk evaluation

The decision step comparing analysed risk against established criteria to determine whether the risk is acceptable or requires treatment or escalation.

Risk treatment options

The response choices of avoid, reduce, transfer or share, and accept for threats, with exploit or enhance used for opportunities; each changes likelihood, impact or both.

Bow-tie analysis

A diagram linking multiple threats and consequences through a single top event, with preventive controls on the threat side and mitigating controls on the consequence side.

FMEA

Failure mode and effects analysis: a structured technique that lists how a process or component could fail, the effects, and a priority based on severity, occurrence and detection.

Target risk

The level of risk the organisation intends to achieve after treatment, set with reference to appetite and used to judge whether residual risk is acceptable.

Embedding risk management

Integrating risk considerations into normal strategy, project, procurement and change decisions so it becomes routine practice rather than a separate compliance activity.

Key risk indicator

A leading metric with defined thresholds that provides early warning of increasing risk exposure, allowing action before the risk materialises.

Key control indicator

A metric providing evidence that a specific control is designed and operating as intended, used to judge control health rather than risk level.

Assurance mapping

A technique showing which controls are covered by which assurance sources, such as management review, compliance testing and internal audit, revealing gaps and duplication.

Risk maturity model

A staged description of risk management capability, typically from ad hoc through repeatable and defined to managed and optimised, used to plan improvement actions.

Risk culture

The shared values and behaviours around risk, evidenced by willingness to escalate bad news, challenge assumptions, and incentives that discourage unmanaged risk-taking.

Review triggers

Events that prompt a review of the risk framework or register, including incidents, audit findings, regulatory change, restructuring, new systems and shifts in appetite.

Risk reporting quality

The extent to which risk information is timely, relevant, comparable and decision-useful for its audience, from operational teams through to the governing body.