Risk Management Glossary

Acceptance: An informed decision to retain a risk within stated conditions and authority.
Action owner: The person responsible for delivering a specific treatment action.
Appetite: The amount and type of risk an organization is willing to pursue or retain in support of objectives.
Assurance: Evidence and evaluation that provide confidence about governance, controls, or risk information.
Bow-tie analysis: A visual method linking threats and preventive controls to a top event, then consequences and recovery controls.
Cause: A condition or source that can contribute to a risk event.
Consequence: The effect of an event on objectives.
Contingency: A planned response, resource, or allowance used if specified conditions occur.
Control: A measure that modifies risk by prevention, detection, correction, mitigation, or recovery.
Control owner: The person accountable for the design, performance, and evidence of a control.
Emerging risk: A new, changing, or newly understood risk with developing evidence or exposure.
Escalation: Moving information and decision authority to the appropriate level when thresholds or authority limits are reached.
Event: An occurrence or change in a set of circumstances.
Exposure: The extent to which objectives are affected by uncertainty.
Impact: The magnitude or nature of a consequence for objectives.
Inherent risk: Exposure before considering the effect of controls.
Issue: A condition or event that has already occurred and requires management.
Key risk indicator (KRI): A measurable signal associated with changing risk exposure.
Likelihood: The chance or frequency of an event within a defined context and period.
Mitigation: Action intended to reduce likelihood, impact, or both.
Near miss: An event that did not create the full consequence but provides evidence about risk and controls.
Opportunity: Uncertainty that could have a beneficial effect on objectives.
Residual risk: Exposure remaining after current controls are considered.
Risk: The effect of uncertainty on objectives.
Risk aggregation: The combined effect of multiple risks across a portfolio, system, or organization.
Risk assessment: The process of identification, analysis, and evaluation.
Risk category: A grouping used to organize risks with similar sources or characteristics.
Risk criteria: Terms of reference used to evaluate the significance of risk.
Risk culture: Shared behaviours, incentives, norms, and decisions that influence how risk is understood and managed.
Risk governance: The authority, accountability, oversight, challenge, and information arrangements for risk decisions.
Risk matrix: A grid that combines likelihood and impact ratings to support comparison.
Risk owner: The person accountable for understanding, monitoring, and managing a risk.
Risk register: A structured record of risks, assessments, owners, controls, actions, and review information.
Risk statement: A concise description of cause, uncertain event, and consequence for objectives.
Risk treatment: The process of selecting and implementing options to modify risk.
Scenario analysis: Exploration of plausible conditions and their implications for objectives and decisions.
Tolerance: Permitted variation around an objective, target, appetite, or limit.
Top event: In bow-tie analysis, the point at which control over a hazard or uncertainty is lost.
Transfer: Allocation of specified consequences or responsibilities to another party without removing the underlying risk.
Velocity: How quickly a risk can develop and require response.
Weak signal: Early, incomplete, or ambiguous evidence that may indicate an emerging change or risk.