Enterprise Risk Management glossary

A source of potential harm. A hazard is a condition; a risk is the combination of that condition with a likelihood and a consequence against an objective.

Taught in Introduction to enterprise risk management

Inherent risk is the exposure before controls; residual risk is what remains after them. The pair is what demonstrates whether controls are doing anything, and a register showing identical inherent and residual ratings is evidence that the assessment was not done.

Taught in Introduction to enterprise risk management

A metric that gives early warning that exposure is changing, as distinct from a key performance indicator, which reports what has already happened.

Taught in Introduction to enterprise risk management

The peril is the cause of a loss, such as fire; the exposure is what stands to be lost, such as the warehouse. The pair is inherited from insurance and remains useful for describing a risk precisely.

Taught in Introduction to enterprise risk management

The possibility that events will occur and affect the achievement of strategy and business objectives. COSO separates risk from opportunity in a way ISO does not, and places both against strategy.

Taught in Introduction to enterprise risk management

The effect of uncertainty on objectives. Three words carry the definition. Effect is a deviation from the expected, which may be positive or negative. Uncertainty is a deficiency of information about an event, its consequence or its likelihood. Objectives anchors the whole thing: without a stated objective there is no risk, because there is nothing to deviate from.

Taught in Introduction to enterprise risk management

The amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives. Set by the board, expressed for the enterprise as a whole.

Taught in Introduction to enterprise risk management

The maximum risk the organisation could bear before it fails, given its capital, liquidity and resources. Appetite must sit below capacity, and the gap between them is the margin of safety.

Taught in Introduction to enterprise risk management

The person accountable for managing a risk and with the authority to do so. Accountability without authority is the commonest defect in a risk register.

Taught in Introduction to enterprise risk management

The description of any set of risks, at whatever level. An enterprise risk profile is the aggregated picture the board actually sees.

Taught in Introduction to enterprise risk management

The acceptable variation around a specific objective or risk type. Appetite is strategic and qualitative; tolerance is operational and normally quantified, which is the distinction examiners test.

Taught in Introduction to enterprise risk management

A state of deficiency of information. Distinguished from risk in the classical treatment because a risk can be assigned a probability distribution and pure uncertainty cannot, which matters when a model reports a number for something that was never measurable.

Taught in Introduction to enterprise risk management