ISO 31000 Lead Risk Manager flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Effect of uncertainty

The ISO 31000 definition of risk: uncertainty on objectives produces effects that are deviations from the expected, and these deviations can be positive or negative.

Risk criteria

Terms of reference against which the significance of risk is evaluated. They derive from internal and external context and from legal, regulatory, and stakeholder obligations.

Risk source

An element which alone, or in combination with others, has the intrinsic potential to give rise to risk. It may be tangible, such as equipment, or intangible, such as culture.

Likelihood vs consequence

Likelihood is the chance of something happening, expressed qualitatively or quantitatively. Consequence is the outcome of an event affecting objectives. Both characterize risk together.

Risk management principles

ISO 31000 principles: integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, and continual improvement. They guide framework design.

Control definition

A measure that maintains or modifies risk. Controls may be preventive, detective, or corrective, and their effectiveness must be evaluated rather than assumed.

Risk management framework

A set of components providing the foundations and organizational arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management throughout the organization.

Framework components

Leadership and commitment, integration, design, implementation, evaluation, and improvement. These components support but are distinct from the risk management process itself.

Risk management policy

A statement of the organization's commitment to risk management that links it to objectives and strategy and provides the basis for setting risk criteria and allocating resources.

Accountability vs responsibility

Accountability is held by the person or body with authority and cannot be fully delegated. Responsibility for specific activities can be assigned to others.

Integration of risk management

Embedding risk management into purpose, governance, leadership, strategy, objectives, and operations so it is part of normal work rather than a separate activity.

Framework evaluation

Judging whether the framework supports organizational objectives using metrics and indicators. Findings feed improvement actions that adapt the framework to internal and external change.

Gap analysis

A technique comparing current framework arrangements with a target or standard to identify missing components. Outputs inform framework improvement, not individual risk treatment plans.

Establishing context

Defining the external and internal parameters and the risk criteria to be considered when managing risk. It precedes risk identification and sets the boundaries of the assessment.

External context

The environment in which the organization operates, including legal, regulatory, market, competitive, cultural, and social factors that shape objectives and risk criteria.

Internal context

The organization's governance, structure, capabilities, culture, information systems, and relationships that influence how risk is managed and what criteria are appropriate.

Risk identification

The process of finding, recognizing, and describing risks that may help or prevent achievement of objectives, including their causes, consequences, and potential opportunities.

Risk analysis

Determining the nature, level, and characteristics of risk, including likelihood, consequence, complexity, velocity, and interactions, to inform evaluation and treatment decisions.

Risk evaluation

Comparing risk analysis results with risk criteria to determine whether a risk is acceptable or tolerable and whether treatment is required, and to prioritize treatment.

Bow-tie analysis

A diagram-based technique linking multiple causes through a top event to multiple consequences, with preventive controls on causes and mitigative controls on consequences.

SWIFT technique

Structured What If Technique: a facilitated workshop using prompt words to identify risks in a process or system. It is qualitative and relies on participant knowledge.

Monte Carlo simulation

A quantitative technique that repeatedly samples probability distributions for input variables to produce a distribution of possible outcomes, supporting likelihood and consequence estimation.

Risk treatment options

Avoid, take or increase to pursue opportunity, remove the source, change likelihood or consequence, share, or retain by informed decision. Selection balances cost, benefit, and stakeholder views.

Residual risk

The risk remaining after treatment. It is compared with risk criteria to decide whether treatment is adequate or must be revised.

Secondary risk

A new risk created by a treatment action itself. It must be identified and evaluated alongside the treated risk so the net effect of treatment is understood.

Risk owner

The person or entity with accountability and authority to manage a risk, including approving and resourcing treatment and monitoring changes in exposure.

Treatment plan

A record specifying selected treatment options, responsible parties, resources, performance measures, timing, and expected outcomes, integrated into management plans and budgets.

Risk sharing

Transferring some financial or operational consequence of a risk to another party through insurance, contracts, or partnerships, without transferring accountability for the risk.

Risk register

A record of identified risks with description, cause, consequence, likelihood, impact, rating, controls, residual rating, owner, treatment actions, and review dates.

Tailored risk reporting

Reporting adapted to the audience: operational detail for front-line managers, tactical summaries for middle management, and strategic aggregate views for the board.

Monitoring definition

Continual checking, supervising, critically observing, or determining the status of a process, system, or activity to identify change from the performance expected.

Key risk indicator

A metric providing early warning of increasing risk exposure, linked to risk appetite and having defined thresholds and predetermined response actions when breached.

Communication vs consultation

Communication shares information to promote awareness and understanding. Consultation seeks informed stakeholder input before decisions are made. ISO 31000 treats them as distinct but complementary.