Bow-tie analysis
A technique that maps the causes of an unwanted event, its possible consequences and the controls on each side; IEC 31010:2019 lists it among techniques for analysing controls (B.4.2).
Confidence level
The probability that the outcome will not exceed a given value; P80 is the value with an 80% chance of not being exceeded.
Contingency
The difference between the point estimate and the estimate at the confidence level management chooses to fund (GAO-20-195G).
Current risk
Risk that has been at least partially addressed by management actions; the rating after existing controls (NIST IR 8286r1).
Escalation factor
A condition that can make a barrier fail or weaken it, such as poor maintenance or fatigue; it can have its own barriers.
Estimate ranging
A class of quantitative methods that replaces fixed estimate values with three-point or uniform distributions, sets correlations and runs Monte Carlo simulation to obtain a cost distribution (AACE RP 118R-21).
Inherent risk
Risk conditions that would exist without any organisational interventions (NIST IR 8286r1).
Key performance indicator
A metric that gives a high-level view of performance, usually focused on results that have already occurred (COSO, 2010).
Key risk indicator
A metric used to provide an early signal of increasing risk exposure in an area of the enterprise (COSO, 2010).
Leading indicator
An indicator that changes before the risk event it relates to, often by tracking a root cause or intermediate event, so action can be taken in advance.
Monte Carlo simulation
A technique that randomly samples values for uncertain inputs many times to simulate a model and build the probability distribution of its output (GAO-20-195G).
Preventive barrier
A control on the left of the bow-tie that stops a threat from leading to the top event.
Recovery barrier
A control on the right of the bow-tie that limits the severity of consequences once the top event has occurred.
Risk appetite
The aggregate level and types of risk an institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan (FSB, 2013).
Risk appetite framework
The policies, processes, controls and systems through which risk appetite is established, communicated and monitored, including the statement, limits and roles (FSB, 2013).
Risk appetite statement
The written articulation of the aggregate level and types of risk an institution will accept, or avoid, to achieve its objectives, with qualitative statements and quantitative measures (FSB, 2013).
Risk capacity
The maximum level of risk an institution can assume before breaching constraints set by capital, liquidity, the operating environment and obligations to stakeholders (FSB, 2013).
Risk detail record
A companion record to a register entry that holds historical information, detailed analysis and accountability details that do not fit in the register (NIST IR 8286Ar1).
Risk driver
A discrete risk modelled with a probability and an impact range that can affect several activities at once, used in AACE RP 57R-09 to integrate cost and schedule risk.
Risk limits
Quantitative measures based on forward-looking assumptions that allocate the aggregate risk appetite to business lines, legal entities, risk categories and concentrations (FSB, 2013).
Risk management
Coordinated activities to direct and control an organisation with regard to risk (ISO 31000:2018).
Risk matrix
A table that maps likelihood and consequence ratings to a level of risk; listed in IEC 31010:2019 as a technique for recording and reporting.
Risk owner
The designated party responsible and accountable for ensuring that a risk is maintained in accordance with enterprise requirements (NIST IR 8286r1).
Risk profile
A point-in-time assessment of gross and, where appropriate, net risk exposures aggregated within and across risk categories (FSB, 2013).
Risk register
A structured record of identified risks that typically holds a description of each risk, its impact and probability, mitigation, owner and a ranking to identify higher-priority risks (OMB Circular A-11, as cited in NIST IR 8286r1).
Risk source
An element which alone or in combination has the potential to give rise to risk (ISO 31000:2018).
Risk tolerance
The acceptable level of variation relative to achievement of a specific objective, often best measured in the same units as the objective (COSO, as quoted in the 2012 COSO risk appetite paper).
Root cause event
The underlying event that sets off a chain of intermediate events leading to a risk event; KRIs tied to root causes give the earliest warning (COSO, 2010).
Three Lines Model
The Institute of Internal Auditors’ model that separates management (first line), specialist risk and compliance roles (second line) and independent internal audit (third line) under board oversight.
Triangular distribution
A distribution defined by minimum, most likely and maximum values; widely used for expert-elicited ranges in cost and schedule models.
Trigger point
A pre-determined level of a KRI that, when reached, requires defined action or escalation by management (COSO, 2010).
Uncertainty
A state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence or likelihood (ISO 31073:2022, 3.1.3).