Risk owner
The designated party responsible and accountable for ensuring that a risk is maintained in accordance with enterprise requirements (NIST IR 8286r1).
Risk register
A structured record of identified risks that typically holds a description of each risk, its impact and probability, mitigation, owner and a ranking to identify higher-priority risks (OMB Circular A-11, as cited in NIST IR 8286r1).
Risk appetite framework
The policies, processes, controls and systems through which risk appetite is established, communicated and monitored, including the statement, limits and roles (FSB, 2013).
Risk profile
A point-in-time assessment of gross and, where appropriate, net risk exposures aggregated within and across risk categories (FSB, 2013).
Risk limits
Quantitative measures based on forward-looking assumptions that allocate the aggregate risk appetite to business lines, legal entities, risk categories and concentrations (FSB, 2013).
Risk appetite statement
The written articulation of the aggregate level and types of risk an institution will accept, or avoid, to achieve its objectives, with qualitative statements and quantitative measures (FSB, 2013).
Risk capacity
The maximum level of risk an institution can assume before breaching constraints set by capital, liquidity, the operating environment and obligations to stakeholders (FSB, 2013).
Risk tolerance
The acceptable level of variation relative to achievement of a specific objective, often best measured in the same units as the objective (COSO, as quoted in the 2012 COSO risk appetite paper).
Risk appetite
The aggregate level and types of risk an institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan (FSB, 2013).
Estimate ranging
A class of quantitative methods that replaces fixed estimate values with three-point or uniform distributions, sets correlations and runs Monte Carlo simulation to obtain a cost distribution (AACE RP 118R-21).