MoR Practitioner key terms

The combination of the probability of an event and its consequences, where consequences may be positive or negative. In management practice it is the uncertainty that matters to objectives, both threats and opportunities.

The coordinated activities that direct and control an organisation with regard to risk. It covers identifying, assessing, responding to and monitoring risk so that objectives are more likely to be achieved.

A state of incomplete knowledge about an outcome, its likelihood or its consequences. It is the raw material of risk; where outcomes are certain there is no risk to manage.

A risk with a potentially negative consequence that could damage objectives, assets or reputation. Threats are usually the focus of mitigation and control activity.

A risk with a potentially positive consequence that could help achieve or exceed objectives. Good practice treats opportunities alongside threats rather than managing only downside.

The amount and type of risk an organisation is willing to seek or retain in pursuit of its objectives. It is set at a high level and shapes decisions throughout the organisation.

The level of variation an organisation is prepared to accept around a specific objective or risk threshold. It converts broad appetite into practical limits that managers can apply day to day.

The maximum risk an organisation can bear before its viability, finances or reputation are seriously threatened. Capacity is a hard limit, whereas appetite is a chosen preference within that limit.

The level of risk that exists before any controls or responses are applied. It gives a baseline against which the value of controls can be judged.

The risk that remains after existing controls and responses have been applied. It is the figure normally compared with tolerance to decide whether further action is needed.

The chance that a given event or outcome will occur, expressed as a probability, frequency or qualitative rating. It is one of the two dimensions normally used to assess a risk.

The size of the effect an event would have on objectives if it occurred, often measured in money, time, safety or reputation. It forms the second dimension of a typical risk assessment.

The set of components that provide the foundations and arrangements for designing, implementing, monitoring, reviewing and improving risk management across the organisation. It includes policy, roles, processes and culture.

A formal statement of the organisation's commitment to managing risk, setting out principles, responsibilities and the mandate for the framework. It gives authority to the approach and is usually approved by senior management.

The arrangement of roles, responsibilities, reporting lines and committees that govern how risk is managed. It defines who owns risk, who oversees it and how escalation works.

The person accountable for managing a particular risk, including selecting and monitoring its response. Ownership should sit with someone who has the authority and resources to act.

The person responsible for delivering a specific response or control action, as distinct from the overall owner of the risk. Clear separation prevents actions falling between roles.

A governance structure in which operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance. It clarifies accountability and avoids duplicated or conflicting duties.

The system by which an organisation is directed, controlled and held to account, including the way risk decisions are authorised and overseen. Good governance links risk information to strategy and performance.

The systematic sequence of activities applied to risks, typically communication and consultation, establishing context, assessment, treatment, and monitoring and review. It is applied repeatedly at many levels of the organisation.

Defining the external and internal parameters, objectives and scope within which risk is assessed and treated. It sets the boundaries so that later assessment is relevant and comparable.

The terms of reference against which the significance of a risk is evaluated, such as thresholds, scales and appetite statements. Clear criteria make assessments consistent and decisions defensible.

The process of finding, recognising and describing risks, including their sources, events, causes and potential consequences. It aims to produce a comprehensive list before any evaluation takes place.

The overall process of risk identification, risk analysis and risk evaluation. Its purpose is to give decision-makers an informed basis for deciding whether and how to treat a risk.

Examining the nature and characteristics of a risk to understand its causes, consequences and likelihood, and the effectiveness of existing controls. It may be qualitative, semi-quantitative or quantitative.

Comparing the results of risk analysis with risk criteria to decide whether the risk is acceptable or needs treatment. It is the decision point between assessment and response.

The action chosen to address an assessed risk, such as avoiding, reducing, transferring, sharing or accepting it. The choice should be proportionate to the risk and consistent with appetite.

The process of selecting and implementing measures to modify risk, including controls and financing arrangements. It turns the chosen response into planned, owned and resourced actions.

A response that removes the activity or exposure that creates the risk altogether. It can eliminate the threat but also forgoes any associated opportunity or benefit.

A response that distributes part of a risk to another party, for example through insurance, outsourcing or joint ventures. Accountability usually remains with the original risk owner.

A form of risk sharing in which the financial consequence of a risk is moved to a third party, typically an insurer. The underlying event and its operational effects are not removed.

An informed decision to retain a risk without further treatment, usually because it falls within appetite or treatment is not cost-effective. Acceptance should be documented and reviewed.

A measure that modifies risk by reducing likelihood, impact or both, and that is designed, implemented and monitored. Controls may be preventive, detective or corrective in nature.

A record of identified risks with their assessment, owners, responses and status. It is the main working tool for monitoring and reporting risk at a given level of the organisation.

A measure used to monitor changes in the level of exposure to a risk and to give early warning that it is moving outside tolerance. It should be measurable, timely and linked to a specific risk.

The continuing checking and surveillance of risks, controls and the risk management process itself. It confirms that responses remain effective and that the risk profile is still as reported.

Communicating risk information to stakeholders in a form suited to their decisions, covering exposure, movements and treatment progress. Good reporting is timely, comparable and focused on what matters.

A periodic or event-driven re-examination of risks, controls and the framework to check they are still valid and effective. Reviews feed lessons learned back into improvement.

Independent or objective confirmation that risk management and controls are operating as intended. It gives governing bodies confidence that reported information can be relied upon.

The shared values, attitudes and behaviours that determine how people identify, discuss and act on risk. It shapes whether risk management is embedded in daily decisions or treated as paperwork.

Integrating risk thinking into everyday activities, processes and decision-making so it becomes part of normal work. It is achieved through leadership, training, incentives and alignment with planning and performance.

The extent to which people understand the risks relevant to their work and their role in managing them. It is a precondition for a healthy risk culture and effective embedding.

The ongoing effort to enhance the risk management framework and process through monitoring, review, lessons learned and corrective action. It keeps the approach fit for changing circumstances.

A structured scale describing progressive levels of risk management capability, from ad hoc to optimised. It helps an organisation benchmark itself and plan realistic improvement steps.