Three Lines Model
The Institute of Internal Auditors’ model that separates management (first line), specialist risk and compliance roles (second line) and independent internal audit (third line) under board oversight.
Risk source
An element which alone or in combination has the potential to give rise to risk (ISO 31000:2018).
Uncertainty
A state, even partial, of deficiency of information related to understanding or knowledge of an event, its consequence or likelihood (ISO 31073:2022, 3.1.3).
Risk management
Coordinated activities to direct and control an organisation with regard to risk (ISO 31000:2018).
Risk matrix
A table that maps likelihood and consequence ratings to a level of risk; listed in IEC 31010:2019 as a technique for recording and reporting.
Risk detail record
A companion record to a register entry that holds historical information, detailed analysis and accountability details that do not fit in the register (NIST IR 8286Ar1).
Current risk
Risk that has been at least partially addressed by management actions; the rating after existing controls (NIST IR 8286r1).
Inherent risk
Risk conditions that would exist without any organisational interventions (NIST IR 8286r1).