ISO 31000 Lead Risk Manager key terms

The effect of uncertainty on objectives, where an effect is a deviation from what is expected, either positive or negative, and can be described by its sources, potential consequences and likelihood.

A deficiency of information related to understanding or knowledge of an event, its consequence or likelihood. It is the state that risk expresses the effect of.

Coordinated activities to direct and control an organization with regard to risk. It covers the principles, framework and process that together create and protect value.

The foundational characteristics that effective risk management should exhibit, including integrated, structured and comprehensive, customized, inclusive, dynamic, using best available information, considering human and cultural factors, and continual improvement.

A set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization.

A formal statement of the organization's overall intentions, direction and commitment regarding risk management, including its objectives and its relationship to strategy and other policies.

The systematic application of management policies, procedures and practices to the activities of communication and consultation, establishing context, and assessing, treating, monitoring and reviewing risk.

Top management's explicit endorsement, leadership and allocation of resources for risk management, which is a prerequisite for the framework to be established and sustained.

The visible, active role of top management in directing risk management, ensuring its integration into governance and decision-making, and providing the authority and resources it needs.

The system by which an organization is directed, controlled and held to account, within which risk management is positioned and aligned with strategic objectives.

The obligation of a named role or person to answer for risk decisions and outcomes, distinct from responsibility for carrying out risk activities, and it cannot be delegated away.

Clearly defined and communicated duties for establishing, operating and improving risk management, assigned to governing bodies, management, risk owners and other relevant parties.

The person or entity with the accountability and authority to manage a particular risk, including approving treatment decisions and accepting residual risk.

The amount and type of risk that an organization is willing to pursue or retain in order to meet its objectives, expressed in a way that guides decision-making.

The maximum amount of risk an organization is able to bear, determined by its resources, capital, and legal or regulatory constraints, independent of its willingness.

The readiness of an organization or stakeholder to bear risk in relation to a specific objective or threshold, often used to set operational limits within overall appetite.

An organization's approach to assessing and eventually pursuing, retaining, taking on or turning away from risk, shaped by its culture and values.

The shared values, beliefs, norms and behaviors within an organization that determine how risk is perceived and how people act on it day to day.

The behavioral, organizational and cultural influences that shape how individuals and groups identify, interpret and respond to risk, and which risk management must take into account.

Continual and iterative processes to provide, share or obtain information and to engage in dialogue with stakeholders about risk, its management and related decisions.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision, activity or risk.

Defining the external and internal parameters to be considered when managing risk and setting the scope and risk criteria for the remaining process.

The external environment (social, regulatory, economic, competitive) and internal environment (objectives, culture, capabilities, governance) in which the organization operates and manages risk.

The boundaries that define which objectives, activities, organizational units, timeframes and interfaces are covered by a particular application of the risk process.

The terms of reference against which the significance of a risk is evaluated, including how consequences and likelihood are measured and how levels of risk are prioritized.

The overall process of risk identification, risk analysis and risk evaluation, performed to provide the basis for risk treatment decisions.

The process of finding, recognizing and describing risks, including their sources, events, causes and potential consequences, and recording them in a risk register.

An element which alone or in combination has the potential to give rise to risk, such as a process, a system, a natural event or a human action.

The process of comprehending the nature of a risk and determining its level, considering uncertainties, consequences, likelihood and the effectiveness of existing controls.

The process of comparing the results of risk analysis with risk criteria to determine whether the risk and its magnitude are acceptable or tolerable and whether treatment is required.

The chance that something will happen, which may be defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or frequencies.

The outcome of an event affecting objectives, expressed qualitatively or quantitatively, and which can be certain or uncertain and have positive or negative effects.

The occurrence or change of a particular set of circumstances, which may be one or more occurrences and can have several causes and several consequences.

The magnitude of a risk or combination of risks, expressed in terms of the combination of consequences and their likelihood.

The level of risk that exists before any controls or treatment measures are applied, sometimes called gross risk and used as a baseline for comparing treatment effect.

The risk remaining after risk treatment has been implemented and controls are in place, which must itself be evaluated against risk criteria and accepted or further treated.

A measure that maintains and/or modifies risk, including policies, procedures, devices, practices or other actions that reduce likelihood, consequence or both.

The process of selecting and implementing options to address risk, such as avoiding, taking, removing the source, changing likelihood or consequence, sharing or retaining it.

A specific choice for modifying risk, including avoiding the risk, taking or increasing it to pursue opportunity, removing the source, changing likelihood or consequence, sharing, or retaining.

A form of risk treatment in which another party bears or shares part of the risk, for example through contracts, insurance or joint ventures, without transferring accountability.

The movement of risk from one party to another, often through insurance or contractual arrangements, which changes who bears the financial or operational effect but not the underlying source.

The informed acceptance of a risk and its consequences, either because treatment is not justified or because the residual level falls within the organization's risk criteria.

A formal decision by an authorized party to retain a risk, documented with justification and subject to periodic review as context and criteria change.

A record that captures identified risks, their owners, analysis results, treatment plans, status and review dates, serving as the operational tool for tracking risk.

The documenting of risk management activities and outcomes, including identified risks, analysis, treatment decisions and monitoring results, to support traceability and reporting.

The formal and informal process of communicating risk information to internal and external stakeholders in a timely, accurate and understandable way to support decisions and accountability.

The continual checking, supervising, critically observing or determining the status of risk management activities, controls and the environment to identify change.

A planned or triggered examination of risk management arrangements and results to determine whether they remain suitable, adequate and effective against objectives.

A metric used to track changes in the level of exposure to a risk over time, providing early warning that risk may be rising or that controls are failing.

The recurring activity to enhance risk management performance, including through monitoring, review, learning from events and adapting the framework and process to change.

Information required to be controlled and maintained by the organization, and the medium on which it is contained, used as evidence of risk management activities and decisions.