PRM key terms

A firm's ability to prevent, absorb, adapt to, and recover from operational disruptions so that critical services keep running and harm to customers and markets stays within tolerance.

The maximum tolerable level of disruption to a business service, expressed as a quantified harm threshold that the firm sets in advance and uses to judge whether a severe but plausible scenario is survivable.

An end-to-end activity delivered to customers or markets, such as payments or lending, composed of people, processes, technology, and third parties, and mapped so that dependencies and failure points are visible.

The target elapsed time within which a process, system, or service must be restored after disruption, used to test whether recovery capability is consistent with impact tolerances.

The maximum acceptable amount of data loss measured in time, indicating how far back a restored system may return, and therefore how much transaction or record loss the firm can bear.

Documented procedures that specify how staff, systems, and facilities will be maintained or restored during and after disruption, including roles, escalation paths, alternate sites, and manual workarounds.

A stress event that is extreme yet credible for the firm, chosen to test whether impact tolerances hold under compound failures such as cyberattack plus third-party outage plus staff unavailability.

Exercising response and recovery against defined severe but plausible events, using tabletop, simulation, or live failover, to produce evidence of capability rather than paper assurance.

An external provider whose failure or disruption would threaten a firm's business services beyond impact tolerance, attracting enhanced due diligence, contractual requirements, and ongoing monitoring.

The risk arising when many services, functions, or data flows depend on a single provider, technology, location, or market utility, so one failure propagates widely across the firm or the financial system.

Risk created by a critical third party's own subcontractors and suppliers, which the firm may not contract with directly yet which can interrupt service delivery and complicate oversight and incident coordination.

A documented, tested route to replace or terminate a third-party arrangement, covering data retrieval, transition services, cost, timing, and the substitutability of the service in the market.

A component, person, supplier, or dependency whose loss alone halts or severely degrades a business service, identified through dependency mapping and removed or mitigated where feasible.

A structured post-incident or post-exercise assessment that identifies root causes, control gaps, and remediation actions with owners and deadlines, then tracks them to closure.

The coordinated process for detecting, classifying, escalating, containing, and communicating a disruption, including defined severity levels, decision authority, and customer and regulator notification.

A modeling approach that learns a mapping from inputs to known labeled outcomes, used for tasks such as default prediction, fraud classification, and probability of default estimation.

A model's tendency to fit noise and idiosyncrasies of training data so that performance on new data degrades, often detected by a widening gap between training and out-of-sample error.

A penalty or constraint added to model training that discourages excessive complexity, such as L1 or L2 penalties, shrinkage, or early stopping, improving out-of-sample stability.

A resampling technique that splits data into folds, trains on some and tests on others repeatedly, to estimate generalization error and support model selection without leaking test information.

The search for configuration settings not learned from data, such as tree depth or learning rate, performed on validation data or nested folds to avoid optimistic performance estimates.

The design and transformation of input variables, including ratios, aggregations, and categorical encoding, that determines how much signal a model can extract from available data.

The accidental use of information in training that would not be available at prediction time, such as future outcomes or post-default attributes, producing inflated backtest performance.

Independent assessment of a model's conceptual soundness, data quality, performance, and limitations, confirming it is fit for its intended use and within risk appetite before and after deployment.

The potential for adverse consequences, including financial loss or poor decisions, from errors in model design, implementation, data, or use, or from models applied outside their intended scope.

Degradation of model performance over time as relationships, populations, or behavior change, monitored through stability and performance indicators that trigger recalibration or redevelopment.

The degree to which a model's outputs can be understood and justified to users, auditors, and regulators, supported by techniques such as feature importance, partial dependence, and reason codes.

Comparing model predictions or risk estimates against realized outcomes over historical periods to assess accuracy, including statistical tests of exception counts for risk measures.

A quantile-based estimate of the loss that will not be exceeded over a given horizon at a stated confidence level, widely used but silent about the size of losses beyond that quantile.

The average loss conditional on losses exceeding a chosen quantile, a coherent risk measure that captures tail severity and is less sensitive than Value at Risk to the exact confidence level.

Evaluating portfolio or firm solvency and liquidity under specified adverse scenarios, such as severe recession or market shock, to reveal vulnerabilities that statistical models may understate.

The risk that a borrower or counterparty fails to meet contractual obligations, measured through exposure, probability of default, loss given default, and maturity.

The long-run average credit loss computed as probability of default times loss given default times exposure at default, used for pricing, provisioning, and capital planning.

The likelihood that an obligor will fail to meet its obligations within a defined horizon, often estimated from statistical models, ratings, or market signals and used in expected loss and capital calculations.

The risk that the firm cannot meet obligations as they fall due without incurring unacceptable losses, arising from maturity mismatches, market depth, or sudden withdrawal of funding.

The risk of loss from movements in prices, rates, spreads, or volatility across traded positions, managed through limits, hedging, and quantitative measures of sensitivity and tail loss.

The identity verification and due diligence process applied before and during a customer relationship, forming the basis for monitoring, risk rating, and suspicious activity reporting.

The framework of laws, controls, and monitoring designed to detect and prevent the disguising of criminal proceeds, including customer due diligence, recordkeeping, and reporting of suspicious transactions.

Automated surveillance of customer activity against expected behavior and typologies, generating alerts that analysts investigate and escalate where suspicion is substantiated.

Regulated sharing of customer account data with authorized third parties through standardized interfaces and customer consent, enabling aggregation, payment initiation, and competing services.

A defined interface letting software systems exchange data and trigger functions, central to fintech integration and to third-party dependency and security risk in financial services.

A shared, replicated record of transactions maintained by multiple participants with cryptographic verification, underpinning digital asset settlement and some tokenized financial market infrastructure.

Self-executing code deployed on a distributed ledger that enforces and automates agreed terms, introducing risks from coding defects, immutability, and unclear legal enforceability.