PECB ISO 31000 Foundation flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of risk

The effect of uncertainty on objectives. The effect is a deviation from the expected and can be positive, negative, or both, and it can address, create, or result in opportunities and threats.

Definition of uncertainty

The state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence, or likelihood. It is distinct from risk itself.

Purpose of risk management

The creation and protection of value. Risk management improves performance, encourages innovation, and supports the achievement of objectives across the organization.

Integrated principle

Risk management is not a stand-alone activity separate from the main activities and processes of the organization. It is part of decision-making and integrated into governance and leadership.

Structured and comprehensive

A structured and comprehensive approach to risk management contributes to consistent and comparable results across the organization, avoiding fragmented or ad hoc practices.

Customized principle

The risk management framework and process are customized and proportionate to the organization's external and internal context related to its objectives.

Inclusive principle

Appropriate and timely involvement of stakeholders enables their knowledge, views, and perceptions to be considered, improving awareness and informed decision-making.

Dynamic principle

Risks can emerge, change, or disappear as the organization's external and internal context changes. Risk management anticipates, detects, acknowledges, and responds to these changes.

Best available information

Inputs to risk management are based on historical and current information plus future expectations. Information has limitations and uncertainties, so it is used with awareness of those limits.

Human and cultural factors

Human behavior and culture significantly influence risk management at all levels. Recognizing these factors improves the effectiveness and realism of the risk management process.

Continual improvement principle

Risk management is continually improved through learning and experience, so the framework and process evolve as the organization learns and its context changes.

Risk source

An element which alone or in combination has the potential to give rise to risk, such as a physical, social, or economic condition that could lead to an event.

Consequence

The outcome of an event affecting objectives. A consequence can be certain or uncertain, expressed qualitatively or quantitatively, and can be positive or negative.

Likelihood

The chance of something happening. It can be defined, measured, or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or frequency.

Risk criteria

Terms of reference against which the significance of risk is evaluated. Criteria derive from objectives, external and internal context, and legal or regulatory requirements.

Risk owner

A person or entity with the accountability and authority to manage a risk, responsible for ensuring the risk is appropriately treated and monitored.

Definition of control

A measure that maintains and/or modifies risk. Controls can include policies, procedures, practices, technologies, and organizational arrangements, and their effectiveness should be assessed.

Framework purpose

The risk management framework assists in integrating risk management into significant activities and functions. Its effectiveness depends on integration into governance and decision-making.

Leadership and commitment

A framework component where top management aligns risk management with strategy, establishes a risk management policy, and ensures resources and accountability are in place.

Integration component

The framework element ensuring risk management is integrated into organizational purpose, governance, leadership, strategy, objectives, and operations, rather than remaining separate.

Design of framework

Design covers understanding the organization and its context, articulating risk management commitment, assigning roles, responsibilities, and authority, and allocating resources.

Implementation component

Implementation involves applying the risk management framework across the organization, including developing a plan with timelines and resources, and engaging stakeholders.

Evaluation of framework

Evaluation measures framework performance against its purpose, plans, indicators, and expected behavior, to determine whether it remains suitable and effective.

Improvement of framework

Improvement adapts and enhances the framework and process to address changes in the external and internal context, and to close gaps identified during evaluation.

Scope, context, criteria

A process step defining the scope of risk management activities and understanding external and internal context, then establishing risk criteria against which risk is evaluated.

Communication and consultation

Iterative process activities that provide, share, or obtain information and engage stakeholders at every stage, supporting understanding of risk and informed decisions.

Risk assessment

The overall process of risk identification, risk analysis, and risk evaluation. It provides the basis for decisions on treatment and priorities.

Risk identification

The process of finding, recognizing, and describing risks, including risk sources, events, causes, and potential consequences, using techniques such as brainstorming and interviews.

Risk analysis

A process to comprehend the nature of risk and determine its level, considering likelihood, consequences, and the effectiveness of existing controls.

Risk evaluation

The process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable and whether treatment is needed.

Risk treatment

A process to select and implement options for addressing risk, such as avoiding, removing the source, changing likelihood or consequence, sharing, or retaining the risk.

Monitoring and review

Planned and periodic activities to verify controls and the process are effective, obtain further information, and learn lessons, feeding results back into the process.

Recording and reporting

Process activities that document the risk management process and its outcomes, providing evidence, supporting communication, and enabling traceability of decisions and treatments.