PECB ISO 31000 Foundation key terms

The effect of uncertainty on objectives, where an effect is a deviation from what is expected and can be positive, negative, or both. It is often expressed as a combination of consequences and their likelihood.

A deficiency of information related to understanding or knowledge of an event, its consequence, or its likelihood. Risk arises from this gap between what is known and what would be needed to predict outcomes reliably.

A result or outcome that an organization, function, or process aims to achieve. Objectives give risk its direction, because a risk only matters in relation to something an entity is trying to accomplish.

The deviation from expectations caused by unknown or partially known factors. It may be favorable or unfavorable and may create or destroy value, which is why ISO 31000 treats risk as neutral rather than purely harmful.

A positive effect of uncertainty on objectives, where a deviation from expectations creates favorable outcomes. Treating opportunity alongside threat is central to the ISO 31000 view of risk.

The outcome of an event affecting objectives, expressed qualitatively or quantitatively. It can be certain or uncertain and may be described by its magnitude, type, and the assets or people affected.

The chance of something happening, whether described qualitatively (such as rare or probable) or quantitatively as a probability or frequency. It is combined with consequence to characterize the level of a risk.

An occurrence or change in a particular set of circumstances. Events can be certain or uncertain, single or multiple, and may have several causes and several consequences for objectives.

An element which alone or in combination has the potential to give rise to risk. It identifies where risk comes from, such as a process, a person, a system, or an external condition, before analyzing its effects.

Reference values, thresholds, and terms used to evaluate the significance of a risk. They reflect the organization's objectives, obligations, and appetite, and they determine when a risk is acceptable, tolerable, or unacceptable.

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives. It sets the boundary within which risk-taking is considered acceptable and guides decisions at each level.

The organization's approach to assessing and eventually pursuing, retaining, or avoiding risk. It shapes how risk is perceived and handled and may differ across functions, projects, and individuals.

The practical degree of variation from the desired level of risk that an organization is prepared to accept. It translates appetite into operational limits used by managers in day-to-day decisions.

Coordinated activities to direct and control an organization with regard to risk. It includes establishing the framework, applying the process, and integrating these into governance, strategy, planning, and operations.

A set of components that provide the foundations and arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management throughout the organization. It connects principles, mandate, and process into a coherent system.

The systematic application of management policies, procedures, and practices to the activities of communicating, consulting, establishing context, and identifying, analyzing, evaluating, treating, monitoring, and reviewing risk. It is iterative and supports decision-making.

The active involvement of top management in directing and supporting risk management, including setting policy, allocating resources, and integrating risk into decision-making. It is a precondition for the framework to function.

A statement of the organization's overall intentions, direction, and commitment regarding risk management. It typically establishes the mandate, defines responsibilities, and links risk management to organizational objectives.

The embedding of risk management into all significant organizational processes, including governance, strategy, planning, and operations. It ensures risk information is part of normal decision-making rather than a separate activity.

The stage of building the framework, covering understanding the organization and its context, articulating commitment, assigning roles and responsibilities, allocating resources, and establishing communication and reporting arrangements.

The stage of putting the risk management framework and process into practice, including developing a plan, assigning accountability, and ensuring the necessary capability and resources are in place.

The ongoing checking of the framework and process to confirm they remain effective and appropriate. It measures performance against plans, detects changes, and provides input for improvement.

The recurring activity to enhance the suitability, adequacy, and effectiveness of the framework and process. It uses monitoring results, reviews, and lessons learned to adapt risk management over time.

The external and internal environment in which the organization operates, including legal, social, cultural, and economic factors as well as its structure, capabilities, and strategy. Understanding it is the starting point for designing the framework.

The process step of defining the external and internal parameters to be considered when managing risk, and setting the scope and criteria for the remaining activities. It ensures risk work is aligned with objectives.

The overall process of risk identification, risk analysis, and risk evaluation. It produces the information needed to decide whether and how risk should be treated.

The process of finding, recognizing, and describing risks, including their sources, events, causes, and potential consequences. It aims to build a comprehensive list of risks relevant to the objectives in scope.

The process of comprehending the nature of a risk and determining its level. It considers causes, consequences, likelihood, and the effectiveness of existing controls, and it supports evaluation and treatment decisions.

The process of comparing the results of risk analysis with risk criteria to determine whether a risk is acceptable or tolerable. It informs the decision to treat, retain, or reconsider the activity.

The process of selecting and implementing options to address risk, such as avoiding, reducing, transferring, or retaining it. It includes planning, obtaining approval, and confirming that treatment achieves the intended effect.

A documented scheme specifying the chosen treatment options, the people accountable for them, the resources required, expected performance measures, and the timelines for completion and review.

The risk that remains after risk treatment has been applied. It must be compared with risk criteria and accepted by the appropriate authority, since treatment rarely eliminates risk entirely.

The person or entity with the accountability and authority to manage a particular risk. Clear ownership ensures decisions about treatment and monitoring are made and acted upon.

The planned, ongoing process of sharing and exchanging risk information with stakeholders and involving them in decisions. It improves understanding, builds trust, and helps ensure that different perspectives are considered.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Identifying them is essential for setting context and planning communication.

The continuous checking, supervising, or critical observation of the status of a risk or of risk management activities. It detects changes in risk levels and the performance of controls so that action can be taken.

An activity undertaken to determine the suitability, adequacy, and effectiveness of the subject matter to achieve established objectives. In the risk process it examines whether identification, analysis, and treatment remain valid.

The process of documenting risk management activities and their outcomes, and communicating that information to decision-makers and stakeholders. It supports accountability, traceability, and informed decisions.