Enterprise Risk Management cheat sheet

Key terms

Risk (ISO 31000)

The effect of uncertainty on objectives. Three words carry the definition. Effect is a deviation from the expected, which may be positive or negative. Uncertainty is a deficiency of information about an event, its consequence or its likelihood. Objectives anchors the whole thing: without a stated objective there is no risk, because there is nothing to deviate from.

Risk (COSO ERM 2017)

The possibility that events will occur and affect the achievement of strategy and business objectives. COSO separates risk from opportunity in a way ISO does not, and places both against strategy.

Hazard

A source of potential harm. A hazard is a condition; a risk is the combination of that condition with a likelihood and a consequence against an objective.

Uncertainty

A state of deficiency of information. Distinguished from risk in the classical treatment because a risk can be assigned a probability distribution and pure uncertainty cannot, which matters when a model reports a number for something that was never measurable.

Peril and exposure

The peril is the cause of a loss, such as fire; the exposure is what stands to be lost, such as the warehouse. The pair is inherited from insurance and remains useful for describing a risk precisely.

Inherent and residual risk

Inherent risk is the exposure before controls; residual risk is what remains after them. The pair is what demonstrates whether controls are doing anything, and a register showing identical inherent and residual ratings is evidence that the assessment was not done.

Risk appetite

The amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives. Set by the board, expressed for the enterprise as a whole.

Risk tolerance

The acceptable variation around a specific objective or risk type. Appetite is strategic and qualitative; tolerance is operational and normally quantified, which is the distinction examiners test.

Risk capacity

The maximum risk the organisation could bear before it fails, given its capital, liquidity and resources. Appetite must sit below capacity, and the gap between them is the margin of safety.

Risk profile

The description of any set of risks, at whatever level. An enterprise risk profile is the aggregated picture the board actually sees.

Risk owner

The person accountable for managing a risk and with the authority to do so. Accountability without authority is the commonest defect in a risk register.

Key risk indicator

A metric that gives early warning that exposure is changing, as distinct from a key performance indicator, which reports what has already happened.