Rims-Crmp

Front 1

Anything that has tangible or intangible value to the organization

Back 1

asset

Front 2

Systematic, independent, objective and documented process for obtaining, examining, verifying, and evaluating information relative to a set of criteria

Back 2

audit

Front 3

Process of evaluating the 1. competence, aptitude, and experience of people and the organization, 2. suitability of technology, and 3. application of processes for particular purposes to determine whether or not the expected output will fall within and acceptable range.

Back 3

capability analysis

Front 4

Organization or person that receives a product or service

Back 4

client

Front 5

Ongoing, iterative, and two-way processes for the exchange of information with and between stakeholders and decision-makers regarding the management of risk.

Back 5

communication and consultation

Front 6

A group of associated organization and people sharing common interests.

Back 6

community

Front 7

Consistency with a requirement.

Back 7

conformity

Front 8

Result or effect of an action, condition, or decision on achieving objectives and outcomes.

Back 8

consequence

Front 9

Ongoing processes to improve products, services, and management practices to enhance the ability to fulfill requirements.

Back 9

continual improvement

Front 10

Action to rectify the causes of a detected nonconformity or other undesirable circumstances.

Back 10

corrective action

Front 11

Of essential importance with respect to objectives and/ or outcomes.

Back 11

criticality

Front 12

A process designed to systematically identify, evaluate, and rank positive and negative impacts on an organization's stakeholders, assets, services, and activities based on the importance of its mission or function, or the significance of risks on the organization's ability to meet its objectives and expectations.

Back 12

criticality analysis

Front 13

A point, step, or process at which controls can be applied to modify risk.

Back 13

critical control point (CCP)

Front 14

An event that interrupts planned activities, operations, or functions, whether anticipated or unanticipated.

Back 14

disruptive event

Front 15

Information and supporting medium in any format.

Back 15

document

Front 16

Extent to which planned activities accomplish a purpose thereby producing the intended or expected outcomes.

Back 16

effectiveness

Front 17

Change occurring in an interval of time with the potential to alter outcomes.

Back 17

event

Front 18

The positive or negative effect on someone or something (see consequence).

Back 18

impact

Front 19

Process that identifies and evaluates the potential effects of change upon an organization. This may include an assessment of the pros and cons of pursing a course of action in light of its possible consequences, or the extent and nature of further change (intended or unintended) that such change may cause.

Back 19

impact analysis

Front 20

An event with consequences that has the capacity to cause gains or losses/ harm to objectives and/ or assets (e.g. tangible, intangible and human assets, the environment, and rights of stakeholders).

Back 20

incident

Front 21

Assuring the soundness, reliability, and completeness of tangible and intangible assets.

Back 21

integrity

Front 22

Change or probability of something happening.

Back 22

likelihood

Front 23

Framework of policies, processes, and procedures used to ensure that an organization can fulfill all tasks required to achieve its objectives.

Back 23

management system

Front 24

Ongoing scrutiny, oversight, evaluation, and situational awareness for determining the current status and to identify changes in the internal and external environments as well as performance.

Back 24

monitoring

Front 25

Failure to fulfill a requirement.

Back 25

nonconformity

Front 26

Process of identifying uncertainties that may be exploited and analyzing the organization's capability and readiness to exploit them. The process may include identifying unmet or undeserved customer/ client needs, identifying target markets, analyzing competitive advantages, as well as analyzing the organization's resource capacity to undertake an opportunity.

Back 26

opportunity analysis

Front 27

Group of people and facilities with an arrangement of responsibilities, authorities, and relationships.

Back 27

organization

Front 28

Part of a management process focused on setting objectives, projecting risks to these objectives, and ensuring resources and systems are in place to ensure objectives are achieved.

Back 28

planning

Front 29

Measures that enable an organization to avoid, preclude, or limit the impact of an undesired or potentially disruptive event.

Back 29

prevention

Front 30

Proactive change or improvement implemented to address a weakness that is not yet responsible for causing nonconformity.

Back 30

preventative action

Front 31

An established or specified way to conduct an activity or a process.

Back 31

procedure

Front 32

A document set down in writing or some other permanent form for later reference.

Back 32

record

Front 33

Remaining risk after risk treatment

Back 33

residual risk

Front 34

Adaptive capacity of an organization in a complex and changing environment.

Back 34

resilience

Front 35

Any asset (human, physical, information, or intangible), facilities, equipment, materials, products, or waste that has potential value and can be used.

Back 35

resources

Front 36

Activity undertaken to determine the suitability, adequacy, and effectiveness of the management system and its component elements to achieve established objectives.

Back 36

review

Front 37

Effect of uncertainty on the achievement of strategic, tactical, and operational objectives.

Back 37

risk

Front 38

Informed action of consenting to retain, receive, or undertake a particular risk.

Back 38

risk acceptance

Front 39

Process to characterize and understand the nature of risk and to define the level of risk.

Back 39

risk analysis

Front 40

The total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one or more desired and expected outcomes.

Back 40

risk appetite

Front 41

Overall and systematic process of evaluating the effects of uncertainty on achieving objectives.

Back 41

risk assessment

Front 42

Organization's or individual's view/perspective of the perceived qualitative or quantitative value that may be gained in comparison to the related potential loss or losses.

Back 42

risk attitude

Front 43

Terms of reference used to measure and evaluate the significance and effects of risk.

Back 43

risk criteria

Front 44

Event, individual(s), process, or trends having impact on the objectives of the organization.

Back 44

risk driver

Front 45

Process of equating the results of risk analysis with risk criteria to determine whether a particular risk level is within an acceptable tolerance or presents a potential opportunity.

Back 45

risk evaluation

Front 46

Process for determining what risks are anticipated, their characteristics, time dependencies, frequencies, duration period, and possible outcomes.

Back 46

risk identification

Front 47

A strategic business discipline that supports the achievement of an organization's objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio.

Back 47

risk management

Front 48

A compilation for all risks identified, analyzed, and evaluated in the risk assessment process.

Back 48

risk register

Front 49

A factor with the potential to create uncertainty in achieving objectives.

Back 49

risk source

Front 50

The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unit, a particular risk category, or for a specific initiative.

Back 50

risk tolerance

Front 51

Process of selecting and implementing measures to modify risk to achieve objectives.

e.g. avoiding, accepting, sharing, adapting internal or external parameters, exploiting a risk to pursue opportunity, etc.

Back 51

risk treatment

Front 52

The condition of being protected against hazards, threats, risks or loss.

Back 52

security

Front 53

Person or organization with an interest or concern.

Back 53

stakeholder

Front 54

A two-way relationship of organizations, people, activities, logistics, information, technology, and resources engaged in activities and creating value from point of origin to point of consumption, including transforming materials/ components to products and services for end users.

Back 54

supply chain

Front 55

Process of identifying and quantifying the potential cause of an unwanted event which may result in harm to individuals, assets, a system or organization, the environment, or the community.

Back 55

threat analysis

Front 56

Person or group of people responsible and accountable for formulating organizational goals, objectives, strategies, policies, and/ or allocating resources.

Back 56

top management

Front 57

Any event that has the potential to cause a negative impact on the achievement of objectives or assets whether tangible or intangible.

Back 57

undesirable event

Front 58

The series of functions, processes, or activities, from raw materials to the eventual end-user that creates and builds value at every step in order to delivery a product or service

Back 58

value chain

Front 59

A model for an overall risk assessment program or individual risk assessments that a) sets measurable policies, objectives and targets b) methodically implements the program c) monitors, measures, and evaluates progress d) identifies, prevents, or remedies problems e) assesses competence requirements and trains people working on org's behalf f) provides top mang with feedback and g) manages info within org.

Back 59

PDCA Model (Plan-Do-Check-Act)

Front 60

A technique used to determine what steps might need to be taken to improve an org's capacity to conduct a risk assessment to move from a current state to a desired, future state.

Back 60

gap analysis (Risk Assessment)

Front 61

List the three steps for gap analysis (risk assessment):

Back 61

1. Note currently available factors (abilities, competencies, time, performance levels) given current resource situation; 2. List success factors needed to achieve future, desired objectives; 3 Highlight gaps - the amount by which the need exceeds the resources

Front 62

Risk Portfolio Design Format - list four main areas:

Back 62

Strategic, Operations, Financial, External

-each area has categories and then may have sub-categories

Front 63

A systematic technique used to understand how risk estimates and risk-based decisions are dependent on variability and uncertainty in the factors contributing to risk.

Back 63

sensitivity analysis

Front 64

An analysis that considers the kind and quantity of error that may occur.

Back 64

error analysis

Front 65

A form of simulation used to determine reactions to different situations.

Back 65

stress analysis

Front 66

An analysis that considers impacts, timeframes, and factors that may prevent achievement of objectives.

Back 66

threat analysis

Front 67

An analysis that looks at the potential for change that an organization might undergo to improve its overall results.

Back 67

opportunity analysis

Front 68

Three types of threat tree analysis are (mapping, matrix techniques):

Back 68

asset tree, threat type tree, adversary tree

Front 69

An analysis that evaluates the efficacy of the risk measures in place (deliberate and/ or inherent) that will have an effect on the likelihood of a threat or opportunity materializing and the likelihood and extent of consequences.

Back 69

vulnerability/ capability analysis

Front 70

An analysis that provides a measure of impact of the risk event relative to achieving the org's objectives and the impact of losing a tangible or intangible asset, activity, or function will have on the operations of the org and its stakeholders, respectively.

Back 70

criticality and consequence (impact) analysis

Front 71

An analysis/ process to understand that nature and level of risk to determine its significance.

Back 71

risk analysis

Front 72

An analysis that provides a method for evaluating and comparing the value and cost of risk treatment options.

Back 72

cost-benefit analysis

Front 73

Examples of two assessment paths:

Back 73

tracing - chronologically tracking a process or risk event

process method - test a sequence of steps or interactions of activities

Front 74

The process or technique of selecting a representative part of a population for the purpose of determining parameters or characteristics of the whole population.

Back 74

sampling

Front 75

Two types of sampling methods:

Back 75

non-statistical sampling (knowledge, experience) and statistical sampling (probability theory)

Front 76

Examples of non-statistical sampling:

Back 76

judgmental sampling (deliberate choice), convenience sampling, haphazard sampling

Front 77

Examples of statistical sampling:

Back 77

random sampling, systematic sampling (every nth unit selected), stratified sampling, cluster/ block sampling

Front 78

An analysis that refers to multiple risk assessment techniques and approaches, at times applied as a series, which are designed to identify the underlying or initiating risk source or driver.

Back 78

root cause analysis (RCA)

Front 79

Three major steps to root cause analysis:

Back 79

define - what is the problem?

analyze - evidence? why? why? why?

solve - how can it be prevented, controlled, modified for success?

Front 80

A risk treatment procedure that defines the measures to be taken by the org to minimize the likelihood of a disruptive event or to minimize the potential for the severity of the consequences of the event.

Back 80

prevention and mitigation procedures

Front 81

A risk treatment procedure that defines the initial measures to be taken by the org in response to the disruptive event.

Back 81

response procedures

Front 82

A risk treatment procedure that defines the measures to be taken by the org to maintain and/or re-establish priority activities of the organization and its supply chain partners.

Back 82

continuity procedures

Front 83

A risk treatment procedure that defines the measures to be taken by the org to recover from a disruptive event and thus ensure it is able to meet its strategic and operational objectives.

Back 83

recovery procedures

Front 84

An analysis that provides a structured approach to gaining information about the critical activities, functions, and processes of the organization and the associated resources necessary for an organization to mitigate the impacts of the undesirable and disruptive events.

Back 84

business impact analysis (BIA)

Front 85

Output of business impact analysis includes:

Back 85

a) recovery time objectives, b) recovery point objectives, c) recovery capacity or performance, d) timeframe when org requires 100% op capability, e) prioritization of recovery resources, f) content for response and recovery strategies, g) reset of product/ service acceptable disruption periods

Front 86

Steps in risk management process (ISO 31000: 2009)

Back 86

1. establishing context

2. risk identification

3. risk analysis

4. risk evaluation

5. risk treatment

THROUGHOUT - monitor & review; communication & consultation

Front 87

A process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage the risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

Back 87

enterprise risk management

Front 88

Components of enterprise risk management (8):

Back 88

1. internal environment, 2. objective setting, 3. event identification, 4. risk assessment, 5. risk response, 6. control activities, 7. information and communications, 8. monitoring

Front 89

Categories of enterprise risk management objectives (4):

Back 89

1. strategic, 2. operations, 3. reporting, 4. compliance

Front 90

Providing value to an org through enterprise risk management encompasses:

Back 90

1. aligning risk appetite and strategy, 2. enhancing risk response decisions, 3. reducing operational surprises/ losses, 4. identifying multiple cross-enterprise risks, 5. seizing opportunities, 6. improving deployment of capital

Front 91

Types of external risks (PESTLE):

Back 91

1. Political, 2. Economic, 3. Socio cultural, 4. Technological, 5. Legal, 6. Environmental

Front 92

Five key aspects of addressing risk (T's):

Back 92

1. Tolerate, 2. Treat, 3. Transfer, 4. Terminate, 5. Take the opportunity

Front 93

Four different types of controls in "Treat"-ing the risk:

Back 93

1. preventative controls, 2. corrective controls, 3. directive controls, 4. detective controls

Front 94

The management of risk has to be reviewed and reported on for two reasons:

Back 94

1. to determine if risk profile is changing; 2. to gain assurance risk management is effective and identify further action, if necessary