ORM Designation key terms

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed in qualitative statements and quantitative limits that guide decision-making and constrain business activity.

The acceptable variation around a risk appetite statement, setting the practical threshold at which escalation or corrective action is triggered for a specific risk category or business unit.

The maximum level of risk an organisation can absorb before breaching capital, liquidity, or solvency constraints, representing the absolute boundary beyond which survival is threatened.

A hard quantitative boundary assigned to a defined risk exposure, such as a maximum position size or counterparty exposure, which must not be exceeded without formal approval.

A governance structure separating risk ownership in the business, independent risk oversight and compliance, and internal audit assurance, clarifying accountability for managing and challenging risk.

A board or management committee with delegated authority to oversee the risk management framework, approve appetite and limits, and review significant exposures and emerging risk issues.

The senior executive accountable for the independent risk function, responsible for the framework, aggregation and reporting of risk across the organisation and for challenging business risk-taking.

The risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events, including legal risk but typically excluding strategic and reputational risk.

A structured process in which business owners identify risks in their processes, assess likelihood and impact, and evaluate the design and effectiveness of the controls intended to mitigate them.

A living record of identified risks with owners, assessed likelihood and impact, existing controls, residual ratings, and agreed actions, used to monitor and report the risk profile.

The level of risk exposure before taking account of any controls or mitigants, providing a baseline that shows how much protection current controls actually deliver.

The risk remaining after existing controls and mitigants have been applied, and the figure that should be compared against appetite and tolerance when deciding on further action.

Any action, policy, device, practice, or system that reduces the likelihood or impact of a risk event, classified by type such as preventive, detective, or corrective.

A control whose failure would materially increase a significant risk, therefore warranting more frequent testing, documented evidence, and named ownership.

Independent examination of whether a control operates as designed and consistently over time, using sampling, reperformance, or observation to support an effectiveness conclusion.

A forward-looking metric that tracks changes in the level of a specific risk, chosen for its predictive link to loss events and monitored against defined thresholds.

A measure of business achievement such as volume, growth, or profitability, which should be read alongside risk indicators because strong performance can conceal accumulating exposure.

An incident that produces an actual financial loss, such as fraud, processing error, system outage, or legal settlement, captured in a loss database for analysis and capital modelling.

An incident that could have caused loss but did not, recorded because it reveals control weaknesses and provides learning value without the distortion of an actual loss amount.

A structured investigation to identify the underlying process, behavioural, or organisational failures that allowed an incident to occur, rather than stopping at the immediate error.

A hierarchical classification of risk types and sub-types used to organise risk identification, aggregate exposures consistently, and compare loss data across business lines.

A visual display, often a heat map, plotting risks by likelihood and impact or by frequency and severity, so that relative priorities are easy to see and communicate.

The assessed probability or frequency that a risk event will occur within a defined period, expressed as a rating scale or quantitative estimate feeding into risk prioritisation.

The assessed magnitude of loss or harm if a risk event occurs, measured in financial terms or against other criteria such as customer harm, regulatory breach, or disruption.

The selection and implementation of a response to a risk, such as avoiding, reducing, transferring, or accepting it, with the choice documented and approved at the right authority level.

Shifting the financial consequences of a risk to another party, typically through insurance, outsourcing, or contractual indemnity, without eliminating the underlying exposure or its reputational effects.

A treatment decision to cease the activity that creates a risk entirely, appropriate where exposure cannot be reduced to within appetite at acceptable cost.

Actions taken to reduce the likelihood or impact of a risk, such as adding controls, redesigning a process, or diversifying exposures, thereby lowering residual risk toward tolerance.

The amount of capital held to absorb unexpected operational losses, calculated under regulatory approaches or internal models based on loss history and exposure indicators.

The discipline of preparing for and recovering from disruptive events, covering business impact analysis, recovery objectives, and tested plans to maintain critical operations.

A study identifying critical business processes, their dependencies, and the financial and operational consequences of disruption over time, used to set recovery priorities and objectives.

The maximum acceptable duration for restoring a process or system after disruption, driving the design of continuity arrangements and the cost of resilience investment.

A forward-looking technique that constructs plausible severe events and estimates their impact and likelihood, used to challenge historical data and inform capital and contingency planning.

Evaluating the effect of extreme but plausible adverse conditions on exposures, earnings, or capital, commonly used to test whether resilience holds beyond normal operating experience.

A newly developing or changing exposure whose impact is not yet fully understood or quantified, such as technology, climate, or conduct-related risks, requiring early monitoring and assessment.

The exposure created when a third party performs a process on the organisation's behalf, including service failure, loss of control, concentration, and reputational consequences of vendor conduct.

The exposure arising from reliance on vendors, suppliers, agents, or counterparties, managed through due diligence, contractual standards, ongoing monitoring, and exit planning.

The danger of excessive dependence on a single counterparty, supplier, system, product, or market, so that one failure produces disproportionate loss.

The exposure to intentional deception for financial gain by internal or external parties, addressed through segregation of duties, monitoring, whistleblowing channels, and culture.

A preventive control that divides incompatible responsibilities, such as authorising, executing, and recording a transaction, among different people to reduce error and fraud.

A protected channel through which staff can report suspected misconduct, malpractice, or control breaches without retaliation, providing early warning of conduct and operational failures.

The shared values, attitudes, and behaviours that determine how people identify, discuss, and act on risk, including willingness to escalate bad news and challenge authority.

The potential for adverse consequences from decisions based on incorrect or misused model outputs, arising from design flaws, poor data, or inappropriate application.

A failure in execution, judgment, or attention by an individual, frequently a contributing cause of operational losses and addressed through design, training, and error-tolerant processes.

A post-incident assessment that identifies what failed, what worked, and what should change, then tracks the resulting actions to completion to prevent recurrence.