ICSAN Admin Risk key terms

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed in qualitative statements and quantitative limits approved by the board.

The acceptable variation around a risk appetite limit, defining how far actual exposure may deviate before escalation or corrective action is triggered by management.

The maximum risk an organisation can bear before suffering unacceptable loss or failure, determined by capital, liquidity, people and operational strength rather than by preference.

A governance structure in which operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the board.

A board or management committee that oversees the risk framework, approves risk appetite, reviews significant exposures and advises the board on risk matters.

A structured record of identified risks, each with an owner, causes, consequences, likelihood and impact ratings, existing controls and agreed treatment actions.

The named individual accountable for managing a specific risk, including maintaining controls, monitoring exposure and reporting changes in the risk profile.

The level of risk exposure before any controls or mitigating actions are applied, used as a baseline for judging whether controls are worthwhile.

The risk that remains after existing controls and mitigations have been applied, and the figure normally compared against risk appetite limits.

A visual grid plotting risks by likelihood and impact, often colour-coded, to help committees prioritise exposures and compare profiles over time.

The assessed probability or frequency that a risk event will occur within a defined period, usually expressed on a graded scale or as a percentage.

The assessed consequence if a risk event occurs, measured in financial loss, disruption, legal penalty, reputational damage or harm to people.

The person responsible for designing, operating and evidencing a specific control, distinct from the risk owner who is accountable for the overall risk.

A control designed to stop an error, fraud or breach from occurring, such as segregation of duties, authorisation limits or access restrictions.

A control that identifies problems after they occur, such as reconciliations, exception reports or management review of variance analysis.

Splitting incompatible tasks among different people so no single person can initiate, approve, record and reconcile a transaction without detection.

A requirement that two authorised individuals review and approve a transaction or decision before it proceeds, reducing error and fraud risk.

Examining whether a control is designed appropriately and operates consistently over a period, using walkthroughs, sampling, reperformance or observation.

The degree to which a control achieves its intended objective in practice, rated as effective, partially effective or ineffective and feeding residual risk ratings.

A forward-looking metric tracked against thresholds to give early warning of rising exposure, such as staff turnover, error rates or overdue reconciliations.

The structured provision of risk information to management and the board, covering exposures, breaches, incidents and emerging issues in a timely, decision-useful format.

A concise visual summary of key risk metrics, limits and trends used by senior committees to monitor the risk profile at a glance.

The risk of loss from inadequate or failed internal processes, people, systems or external events, including administrative error and process breakdown.

Documenting each step, handoff, system and decision point in an administrative process to expose bottlenecks, control gaps and single points of failure.

A missing, poorly designed or inconsistently operated control that leaves a process exposed to error, fraud or non-compliance beyond the accepted level.

An event that could have caused loss or harm but did not, recorded and investigated because it reveals weaknesses in controls or processes.

The process for logging, classifying, escalating, investigating and resolving operational or compliance incidents, and for capturing lessons learned.

A control that is essential to keeping a significant risk within appetite, so that its failure would materially increase exposure and must be tested regularly.

The risk of legal or regulatory sanction, financial loss or reputational damage from failure to comply with applicable laws, rules, codes and internal policies.

A maintained inventory mapping each applicable legal or regulatory requirement to the responsible owner, the controls in place and the evidence of compliance.

Ongoing or periodic checking that business activities and controls meet regulatory obligations and internal policies, with findings tracked to resolution.

A model explaining fraud through three conditions: pressure or incentive, opportunity created by weak controls, and rationalisation that justifies the act.

Deliberate deception by an employee or insider for personal gain, such as false invoicing, expense manipulation, data theft or payment diversion.

A protected channel through which staff can report suspected wrongdoing confidentially and without retaliation, forming a key detective control against fraud.

An environment where employees feel safe raising concerns about conduct, risk or wrongdoing, supported by leadership tone and non-retaliation policies.

A study identifying critical activities, their dependencies and the maximum tolerable disruption, used to set recovery priorities and continuity requirements.

The maximum acceptable time to restore a process or system after disruption, derived from the business impact analysis and driving continuity design.

The maximum acceptable amount of data loss measured in time, determining how frequently backups or replication must occur for a critical system.

Documented procedures for maintaining or restoring critical activities during and after disruption, including roles, resources, workarounds and communication arrangements.

A pre-designated group with defined roles that coordinates response, decision-making and stakeholder communication during a severe disruptive event.

Independent or objective evaluation of whether controls and risk management are working as intended, provided by audit, compliance or external reviewers.

An independent function reporting to the board or audit committee that evaluates risk management, control and governance, and recommends improvements.

The signals sent by senior leaders through their behaviour, decisions and communications about the importance of ethics, risk management and compliance.

A formal statement of expected ethical and professional behaviour, covering conflicts of interest, gifts, confidentiality and fair dealing, binding on staff.

A situation where personal, financial or other interests could improperly influence professional judgement, requiring disclosure, recusal or other safeguards.

Selecting and applying a response to a risk: avoid, reduce, transfer or accept it, with an owner, timeline and expected effect on residual exposure.

A time-bound action plan assigning responsibility for closing a control gap or audit finding, with milestones and evidence of completion tracked to closure.