Risk Management Glossary: Key Terms and Definitions from A to Z

Risk is the effect of uncertainty on objectives. Risk management is the set of coordinated activities an organization uses to direct and control itself with regard to risk. Both definitions come from ISO 31000, the international standard for risk management. This glossary defines the terms that follow from them, in plain English, and notes where ISO and COSO, the two frameworks most organizations use, define a term differently.

The definitions follow ISO 31073:2022, the risk management vocabulary that replaced ISO Guide 73 in 2023; COSO's Enterprise Risk Management: Integrating with Strategy and Performance (2017); and the Institute of Internal Auditors (IIA). They are paraphrased, not quoted; read the standards for the formal wording.

Where ISO and COSO differ

Jump to: A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · Q · R · S · T · U · V · W

A

Absolute risk: The probability that an event will occur, stated without comparison to another group or scenario.

Acceptable risk: A level of risk the organization has decided to bear because it falls within its risk appetite and tolerance.

Acceptance: A risk response in which the organization takes no further action and bears the consequences if the risk occurs. ISO calls it retaining the risk; the Four Ts call it tolerating it.

Active risk: In investment management, the part of a portfolio's risk that comes from the manager's decisions rather than from the benchmark.

ALARP (as low as reasonably practicable): A principle, common in health and safety law, that risks should be reduced until the cost of further reduction is grossly disproportionate to the benefit.

Assurance map: A table that shows, for each key risk, who provides assurance that it is controlled, how much, and where coverage is missing or duplicated. See how to build an assurance map.

Avoidance: A risk response that removes the risk by not starting, or by stopping, the activity that gives rise to it.

B

Baseline risk: See inherent risk.

Black swan: A rare, high-impact event that standard models do not predict and that people explain away after the fact. Nassim Nicholas Taleb popularized the term in The Black Swan (2007).

Business continuity planning (BCP): Preparing the organization to keep its critical functions running, or restore them quickly, during and after a disruption.

Business impact analysis (BIA): An analysis of how a disruption to each business function would affect the organization over time. It sets recovery priorities and recovery time objectives for the continuity plan.

C

Catastrophic risk: A risk whose impact, if it occurs, could threaten the organization's survival.

Causal analysis of risk: Describing a risk as a chain of cause, event and consequence, so controls can be placed at each link. The bow-tie diagram is a common format.

Combined assurance: Coordinating the work of all assurance providers, such as management, risk, compliance, internal audit and external audit, so they cover the key risks together without gaps or duplication.

Committee charter: The document that sets out a board or management committee's purpose, authority and duties. Also called terms of reference.

Compliance risk: The risk of legal or regulatory sanctions, financial loss or reputational damage from failing to comply with laws, regulations, internal policies or ethical standards.

Contingency plan: A set of actions, agreed in advance, to take if a specific risk occurs.

Control: A measure that maintains or modifies risk, such as a policy, procedure, approval, reconciliation, system setting or physical safeguard.

Control assessment: A review of the controls over a process, covering both the controls in place and the controls that are missing, and whether they are designed and operating well.

Control framework: A structured set of control objectives and practices that an organization adopts as its standard, such as COSO's Internal Control: Integrated Framework (2013).

Corporate governance: The system of rules, practices and processes by which a company is directed and controlled.

COSO: The Committee of Sponsoring Organizations of the Treadway Commission. It publishes the most widely used frameworks for internal control (2013) and enterprise risk management (2017). See our guide to the COSO ERM framework.

Credit risk: The risk of loss when a borrower or counterparty fails to pay what it owes.

Cyber risk: The risk of loss, disruption or reputational damage from the failure or misuse of information systems. See our guide to cyber risk and insurance.

D

Disaster recovery plan (DRP): The plan for restoring IT systems and data after a disruption. It is one part of business continuity planning.

Downside risk: The possible loss in value, measured by the likelihood and size of negative outcomes.

Dynamic risk: A risk whose likelihood or impact changes over time as the economy, technology or regulation changes.

E

Emerging risk: A new or changing risk that is not yet well understood, often with uncertain likelihood and impact. See how to anticipate risk in a changing environment.

Emerging risk sensing: The activities an organization uses to spot emerging risks early, such as horizon scanning, expert panels and scenario planning.

Enterprise risk management (ERM): Managing risk across the whole organization as one portfolio, tied to strategy and objectives, rather than in separate silos. See the COSO definition in the table above, and our ERM reading list.

Environmental scanning: Systematically tracking trends in the external environment (political, economic, social, technological, legal and environmental) to anticipate their effect on the organization.

ERM policy: The document that sets out how the organization manages risk: principles, roles, appetite, methods and reporting. See our guide to ERM policies.

Event: An occurrence or change in circumstances. In ISO terms, an event can be a risk source's result, and can have several causes and consequences.

Exposure: The extent to which the organization is subject to a risk, often measured as the value at stake.

F

Financial risk: The risk of financial loss from market movements, credit defaults, liquidity shortfalls or errors in financial reporting.

Force majeure: A contract clause that excuses performance when extraordinary events beyond the parties' control, such as war or natural disaster, prevent it.

Four Ts: Four risk responses: terminate (avoid), treat (reduce), transfer (share) and tolerate (accept).

G

Gap analysis: Comparing the current state of a process or capability with the desired state to find what is missing.

Governance: The structures and processes by which an organization is directed, controlled and held to account.

Governance risk: The risk that weak oversight, unclear accountability or poor decision rights lead to loss or failure.

Governance, risk and compliance (GRC): An integrated approach to governance, risk management and compliance, and the software category that supports it.

Governing body: The group with ultimate authority over the organization: a board of directors, supervisory board, board of trustees, general partners or owner.

Gross risk: See inherent risk.

H

Hazard: A source of potential harm.

Hazard risk: A risk that can cause harm to people, property or the environment, such as fire, flood or injury. Hazard risks are usually insurable.

Hazardous event: A specific situation in which a hazard causes harm.

Heat map: A grid that plots risks by likelihood and impact, coloured from green to red. See what a risk heat map is and how to use it.

Hedging: Taking an offsetting position, often with derivatives, to reduce exposure to adverse price movements.

I

Impact: The effect of a risk on objectives if it occurs. ISO calls it consequence; COSO calls it severity.

Inherent risk: The level of risk before management takes any action to change its likelihood or impact. Also called gross or baseline risk.

Insurance: A contract that transfers the financial consequences of specified risks to an insurer in exchange for a premium.

Internal audit: An independent, objective assurance and advisory function that helps the organization achieve its objectives by evaluating governance, risk management and control. See how auditors use the enterprise risk model.

Internal control: The process, carried out by the board, management and staff, that provides reasonable assurance about the achievement of objectives in operations, reporting and compliance (COSO, 2013).

ISO 31000: The international standard that sets out principles, a framework and a process for managing risk. Its current edition was published in 2018.

ISO 31073: The international vocabulary for risk management terms, published in 2022. It replaced ISO Guide 73.

K

Key control: A control that, on its own, prevents or detects a material error or loss in a process. Auditors test key controls first.

Key control indicator (KCI): A metric that shows whether a key control is working, such as the percentage of access reviews completed on time.

Key performance indicator (KPI): A metric that shows progress toward an objective.

Key risk indicator (KRI): A metric that signals a change in the likelihood or impact of a risk, early enough to act. A rising rate of staff turnover in a critical team is an example.

L

Lagging indicator: A metric that records what has already happened, such as losses, incidents or audit findings.

Leading indicator: A metric that signals a change before it happens, such as a rising trend in customer complaints or near misses.

Likelihood: The chance that something will happen, whether described in words, as a frequency or as a probability.

Liquidity risk: The risk that the organization cannot meet its obligations as they fall due because it cannot raise cash quickly enough.

Loss: A negative outcome of a risk event, financial or otherwise.

M

Market risk: The risk of loss from movements in market prices, such as interest rates, exchange rates, commodity prices and equity prices.

Mitigation: See risk mitigation.

Moral hazard: The tendency of a party protected from a risk to take more of it than if it bore the full consequences.

Multidimensional risk assessment: Assessing risks on more dimensions than likelihood and impact, such as velocity, persistence and preparedness. See multidimensional risk assessments.

N

Near miss: An event that could have caused harm or loss but did not. Tracking near misses gives an early warning of control weaknesses.

Net risk: See residual risk.

Non-financial risk: Risks whose primary effect is not a market or credit loss, such as operational, compliance, conduct, cyber and reputational risk.

O

Operational risk: The risk of loss from inadequate or failed internal processes, people and systems, or from external events. This is the Basel Committee's definition, used across banking.

Opportunity: A favourable set of circumstances that, if acted on, could improve the organization's position. ISO's definition of risk includes opportunities as well as threats.

Opportunity risk: The risk of losing value by failing to pursue an opportunity.

P

PESTLE analysis: A framework for scanning the external environment under six headings: political, economic, social, technological, legal and environmental. Also written PEST or PESTEL.

Price risk: The risk that the value of assets or liabilities falls because market prices change. A component of market risk.

Probability: A measure of the chance of occurrence, expressed as a number between 0 and 1.

Product liability: The legal liability of manufacturers, distributors and sellers for injury or damage caused by their products.

Pure risk: A risk that can result only in loss or no loss, never gain, such as fire or theft. Contrast with speculative risk.

Q

Qualitative risk analysis: Rating risks on descriptive scales, such as low, medium and high, usually from expert judgment.

Quantitative risk analysis: Measuring risks in numbers, such as expected loss in dollars or the probability of missing a target, often with statistical models or simulation.

R

Reputational risk: The risk of loss from damage to how customers, investors, regulators or the public see the organization.

Residual risk: The risk that remains after risk responses are in place. Also called net risk. COSO distinguishes target residual risk (what management intends) from actual residual risk (what remains).

Resilience: The organization's ability to absorb disruption, adapt and keep delivering its objectives.

Risk: The effect of uncertainty on objectives (ISO 31000). An effect can be positive, negative or both. See the COSO definition in the table above.

Risk analysis: Understanding the nature of a risk, its sources, likelihood and consequences, and the effectiveness of existing controls. The second step of risk assessment.

Risk appetite: The types and amount of risk the organization is willing to accept in pursuit of its objectives. See our guide to risk appetite.

Risk appetite statement: The board-approved document that sets out the organization's risk appetite, usually with qualitative statements and quantitative limits for each risk category.

Risk assessment: The overall process of risk identification, risk analysis and risk evaluation (ISO 31000). See our guide to risk assessments.

Risk capacity: The maximum amount of risk the organization can absorb before it fails or can no longer pursue its strategy. Risk appetite should sit below it.

Risk champion: A person outside the risk function who promotes good risk practice among peers.

Risk communication: The exchange of information about risk between the organization and its stakeholders.

Risk criteria: The terms of reference against which the significance of a risk is judged, such as impact scales, likelihood scales and tolerance limits.

Risk culture: The shared values, beliefs and behaviours that determine how people in an organization identify, discuss and act on risk. See building a resilient risk culture.

Risk driver: A factor that strongly influences whether a risk occurs or how severe it is.

Risk evaluation: Comparing the results of risk analysis with risk criteria to decide whether a risk needs a response, and in what order. The third step of risk assessment.

Risk governance: The structures, roles and oversight through which the board and management direct risk management.

Risk identification: Finding, recognizing and describing risks that could help or hinder the achievement of objectives. The first step of risk assessment.

Risk management: Coordinated activities to direct and control an organization with regard to risk (ISO 31000).

Risk map: A visual summary of the organization's principal risks and how they relate to objectives and to each other. See the enterprise risk map guide.

Risk matrix: A grid of likelihood against impact used to rate and rank risks. The coloured version is the heat map.

Risk mitigation: Actions that reduce the likelihood or impact of a risk. See our guide to risk mitigation strategies.

Risk owner: The person accountable for managing a risk, with the authority to do so.

Risk perception: How a person or group judges a risk, which often differs from its measured likelihood and impact.

Risk portfolio: All of the organization's risks viewed together, including how they interact and concentrate.

Risk preference: A person's or organization's tendency to choose more or less risky options.

Risk prioritization: Ranking risks so that attention and resources go to the most important first. See strategies to prioritize risk.

Risk profile: A description of the set of risks an organization faces, with their ratings, at a point in time.

Risk register: The record of identified risks, with their causes, ratings, owners, controls and actions.

Risk response: The action chosen for a risk. COSO lists five: accept, avoid, pursue, reduce and share.

Risk tolerance: The acceptable variation in performance around an objective. Where appetite is broad, tolerance is specific and measurable. See our guide to risk tolerance.

Risk transfer: Shifting the financial consequences of a risk to another party, usually through insurance, contracts or hedging. ISO calls it sharing the risk.

Risk treatment: A process to modify risk (ISO 31073), by avoiding it, removing its source, changing its likelihood or consequences, sharing it or retaining it.

Risk velocity: How fast a risk affects the organization once it occurs.

Risk workshop: A facilitated session in which managers identify and assess risks together. See how to lead a risk management workshop.

Root cause: The underlying condition that, if removed, would prevent an event or its recurrence.

Root cause analysis: A structured method, such as the five whys or a fishbone diagram, for finding the root cause of an event or problem.

S

Scenario planning: Building several plausible pictures of the future to test strategy and spot emerging risks. Peter Schwartz's The Art of the Long View (1991) popularized the method.

Secondary control: A control that operates after a process, such as a review or reconciliation, and backs up a key control.

Sensitivity analysis: Changing one input at a time to see how much it moves the result.

Severity: COSO's term for the impact of a risk on objectives.

Speed of onset: The time between an event occurring and its effect being felt. See also risk velocity.

Speculative risk: A risk that can result in gain or loss, such as an investment or a product launch. Contrast with pure risk.

Stakeholder: A person or organization that can affect, be affected by, or believe itself affected by a decision or activity.

Strategic risk: The risk that the organization's strategy fails, from a poor choice, poor execution or a change in the environment.

Strategic risk management: Applying risk management to strategy itself: testing the assumptions behind it and the risks to its execution.

SWOT analysis: A review of internal strengths and weaknesses and external opportunities and threats.

Systemic risk: The risk that the failure of one institution or market spreads to the whole system.

T

Tabletop exercise: A discussion-based exercise in which a team walks through its response to a simulated risk event. See risk scenario tabletop exercises.

Tertiary control: A supplementary control that adds comfort but is not relied on to prevent or detect errors.

Third-party risk: The risk arising from suppliers, vendors, outsourcers and other partners.

Threat: A potential source of harm or loss.

Three Lines Model: The IIA's model (2020) for assigning risk roles: management (first line), risk and compliance functions (second line) and internal audit (third line), all accountable to the governing body.

Triage: Sorting risks or incidents by urgency and severity to decide what to deal with first.

U

Uncertainty: A lack of information about an event, its consequences or its likelihood.

Uncertainty analysis: Assessing how uncertainty in inputs and assumptions affects the results of a risk assessment.

Upside risk: The chance that the outcome is better than expected.

V

Vulnerability: A weakness that makes an asset, system or organization susceptible to a threat.

W

Worst-case scenario: The most severe plausible outcome, used to test plans and capital.

Other words for risk management

People search for synonyms of risk management. The closest are risk control, risk governance, enterprise risk management (ERM) and governance, risk and compliance (GRC). Each has a narrower or wider scope, defined above.

Frequently asked questions

What is the definition of risk in risk management?

ISO 31000 defines risk as the effect of uncertainty on objectives. COSO defines it as the possibility that events will occur and affect the achievement of strategy and business objectives. Both include upside as well as downside.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad amount and type of risk the organization is willing to take. Risk tolerance is the acceptable variation around a specific objective. Appetite is set by the board; tolerances turn it into limits managers can measure.

What is the difference between inherent and residual risk?

Inherent risk is the risk before any controls. Residual risk is what remains after them. The difference shows how much the controls are worth.

Which standards define risk management terms?

ISO 31073:2022 (vocabulary), ISO 31000:2018 (guidelines), COSO ERM (2017) and the IIA's Three Lines Model (2020). Banking adds the Basel Committee's definitions.