Glossary

Quick reference for essential risk management terms. Each definition explains what the term means and when you'd use it in practice.

Plain-English definitions of 200+ risk management, GRC, compliance and audit terms — RCSA, KRI, risk appetite, bow-tie analysis and more — each with its own page.

A

Accepted Risk: Risk that has been acknowledged and consciously retained without further risk treatment, within the risk appetite.
Anti-Money Laundering (AML): Set of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income.
Audit Committee: Committee of the board responsible for overseeing financial reporting, internal controls, and audit functions.
Audit Trail: Chronological record providing documentary evidence of activities and events to enable reconstruction and examination.

B

Back-testing: Method of validating a model by comparing its predicted outputs against actual historical results.
Bank Secrecy Act (BSA): US law requiring financial institutions to assist government agencies in detecting and preventing money laundering.
Basel Accords: International banking regulations issued by the Basel Committee on Banking Supervision (BCBS) setting standards for capital requirements and risk management.
Basel Committee on Banking Supervision (BCBS): The primary global standard setter for the prudential regulation of banks, providing a forum for cooperation on banking supervisory matters.
Basel II: Second Basel Accord establishing minimum capital requirements, supervisory review, and market discipline for banks.
Basel III: Third Basel Accord strengthening bank capital requirements and introducing new regulatory requirements on liquidity and leverage.
Board of Directors: Governing body responsible for overseeing the management and strategic direction of an organization.
Bowtie Analysis: Risk evaluation method that visually displays the connection between hazards, threats, consequences, and controls.
Business Continuity Management (BCM): Holistic management process that identifies potential threats to an organization and provides a framework for building resilience.
Business Continuity Plan (BCP): Documented set of procedures designed to ensure critical business functions continue during and after a disaster or disruption.
Business Impact Analysis (BIA): Process of determining the potential impacts resulting from interruption of time-sensitive or critical business processes.

C

Capital Adequacy Ratio (CAR): Measure of a banks capital expressed as a percentage of its risk-weighted assets, used to protect depositors and promote stability.
Capital Planning: Process of determining capital requirements and allocating capital resources to support business objectives.
Change Management: Structured approach for transitioning individuals, teams, and organizations from a current state to a desired future state.
Chief Compliance Officer (CCO): Executive responsible for overseeing and managing compliance within an organization, ensuring adherence to regulatory requirements.
Chief Information Security Officer (CISO): Executive responsible for establishing and maintaining the enterprise vision, strategy, and program for information security.
Chief Risk Officer (CRO): Executive responsible for identifying, assessing, and mitigating significant competitive, regulatory, and technological threats to a firms capital and earnings.
Climate Risk: Risk arising from climate change and its potential impacts on organizations, including physical and transition risks.
Code of Conduct: Written guidelines establishing ethical standards and expected behaviors for employees and stakeholders.
Collateral: Asset pledged as security for a loan or obligation, which can be seized by the lender if the borrower defaults.
Common Equity Tier 1 (CET1): Highest quality regulatory capital, consisting primarily of common shares and retained earnings.
Compensating Control: Alternative control that provides equivalent protection when a primary control cannot be implemented.
Compliance: The act of adhering to laws, regulations, standards, and internal policies relevant to an organizations operations.
Compliance Program: Formal program to ensure an organizations compliance with applicable laws, regulations, and internal policies.
Concentration Risk: Risk arising from lack of diversification in a portfolio, creating excessive exposure to a single counterparty or sector.
Conduct Risk: Risk of financial losses or regulatory sanctions resulting from inappropriate behavior by employees or the firm.
Consumer Duty: UK regulatory principle requiring firms to act in good faith to deliver good outcomes for retail customers.
Contingency Planning: Process of developing advance arrangements to ensure business continuity during unexpected events.
Continuous Monitoring: Ongoing process of observing and analyzing control effectiveness and risk indicators in real-time.
Control Activities: Policies and procedures that help ensure management directives are carried out.
Control Deficiency: Weakness in internal control design or operation that prevents timely prevention or detection of misstatements.
Control Environment: The set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.
Control Self-Assessment (CSA): Process through which internal control effectiveness is examined and assessed, typically involving managers and staff.
Control Testing: Evaluation of the design and operating effectiveness of internal controls.
Corporate Governance: System of rules, practices, and processes by which a company is directed and controlled, balancing stakeholder interests.
COSO Framework (COSO): Framework for evaluating and improving internal controls and enterprise risk management, developed by the Committee of Sponsoring Organizations.
Counter-Terrorist Financing (CTF): Efforts to detect, prevent, and disrupt the financing of terrorism.
Counterparty Credit Risk (CCR): Risk that a counterparty to a financial contract will fail to fulfill their contractual obligations.
Country Risk: Risk of investing or lending in a country arising from political, economic, or social factors.
Credit Risk: Risk of loss arising from a borrower or counterparty failing to meet their financial obligations.
Credit Value Adjustment (CVA): Adjustment to the fair value of derivative instruments to account for counterparty credit risk.
Crisis Management: Process by which an organization deals with disruptive and unexpected events that threaten to harm the organization.
Customer Due Diligence (CDD): Process of gathering information about customers to assess their risk profile and verify their identity.
Cyber Risk: Risk of financial loss, disruption, or reputational damage from failures of information technology systems.
Cybersecurity: Practice of protecting systems, networks, and programs from digital attacks, unauthorized access, and data breaches.

D

Data Breach: Security incident in which sensitive, protected, or confidential data is copied, transmitted, or accessed without authorization.
Data Protection: Legal control over access to and use of data stored in computers, particularly personal data about individuals.
Debt Value Adjustment (DVA): Adjustment to the fair value of derivatives to account for an institutions own credit risk.
Default: Failure to meet the legal obligations of a loan or bond, specifically failing to make required payments.
Deficiency Remediation: Process of addressing and correcting identified control weaknesses or gaps.
Detective Control: Control designed to identify errors or irregularities after they have occurred.
Digital Operational Resilience Act (DORA): EU regulation establishing requirements for ICT risk management, incident reporting, and resilience testing for financial entities.
Disaster Recovery Plan (DRP): Documented process for recovering IT infrastructure and systems after a disaster or significant disruption.
Due Diligence: Investigation or audit of a potential investment, acquisition, or business relationship to confirm facts and assess risks.

E

Economic Capital: Amount of capital a firm needs to remain solvent given its risk profile.
Enhanced Due Diligence (EDD): Additional due diligence measures applied to higher-risk customers, relationships, or transactions.
Enterprise Risk Management (ERM): Comprehensive approach to identifying, assessing, and managing risks across an entire organization.
Environmental Social and Governance (ESG): Framework for evaluating a companys exposure to environmental, social, and governance factors.
Ethics Program: Formal program establishing standards of ethical behavior and providing guidance on ethical decision-making.
Event Risk: Risk of loss arising from specific events such as mergers, acquisitions, or regulatory changes.
Expected Loss (EL): Average loss expected to occur over a given time period, calculated as PD × LGD × EAD.
Expected Shortfall (ES): Risk measure that considers both the probability and magnitude of losses beyond VaR.
Exposure at Default (EAD): Total value of exposure to a counterparty at the time of default.
External Audit: Independent examination of financial statements and controls by an external auditor.

F

Factor in Decision Making (FAIR): Quantitative analysis tool integrating risk metrics to inform risk-adjusted decision making.
Fair Value: Price that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants.
Fiduciary Duty: Legal obligation of one party to act in the best interests of another party.
Financial Conduct Authority (FCA): UK regulatory body responsible for regulating financial firms providing services to consumers and maintaining the integrity of financial markets.
Financial Crime: Criminal activities targeting financial assets, including fraud, money laundering, and terrorist financing.
Financial Risk: Risk arising from financial market movements or financial transactions, including market, credit, and liquidity risk.
FinCEN (FinCEN): Financial Crimes Enforcement Network, US bureau combating domestic and international money laundering and terrorism financing.
Findings Management: Process of tracking, prioritizing, and remediating issues identified through audits and assessments.
First Line of Defense: Business units and functions that own and manage risks as part of daily operations.
Foreign Corrupt Practices Act (FCPA): US law prohibiting bribery of foreign officials and requiring accurate books and records.
Foreign Exchange Risk (FX Risk): Risk that changes in currency exchange rates will adversely affect the value of assets or liabilities.
Fraud Risk: Risk of intentional deception or misrepresentation by employees, customers, or third parties for personal or organizational gain.
Fundamental Review of the Trading Book (FRTB): Basel Committee framework revising minimum capital requirements for market risk in the trading book.

G

Gap Analysis: Comparison of current state against desired state to identify deficiencies and improvement opportunities.
General Data Protection Regulation (GDPR): EU regulation on data protection and privacy, giving individuals control over their personal data.
General Risk Assessment: Broad evaluation of risks facing an organization to inform risk management priorities.
Governance: The system by which organizations are directed and controlled, including decision-making and accountability structures.
Governance Risk and Compliance (GRC): Integrated approach to managing organizational governance, risk management, and regulatory compliance activities.

H

Heat Map: Visual representation of risks using colors to indicate severity based on likelihood and impact.
Hedging: Risk management strategy using financial instruments to offset potential losses from adverse price movements.
High Risk Jurisdiction: Country or territory identified as having elevated money laundering or terrorist financing risks.
Horizontal Review: Regulatory examination comparing practices across multiple institutions to identify industry-wide issues.

I

ICT Risk: Risk associated with information and communication technology systems and infrastructure.
Impact Assessment: Evaluation of the potential consequences of a risk event or proposed change on an organization.
Incident Management: Process for identifying, analyzing, and responding to incidents that disrupt normal business operations.
Information Security: Practice of protecting information by mitigating information risks, including unauthorized access, use, disclosure, or destruction.
Inherent Control: Control that is built into a process or system by design rather than added as a separate activity.
Inherent Risk: The raw or untreated risk that exists before any controls or mitigating factors are applied.
Insider Threat: Risk posed by individuals within an organization who may exploit their access for malicious purposes.
Insurance Risk: Risk arising from insurance operations including underwriting, pricing, and claims.
Integrated Risk Management (IRM): Approach that considers all types of risk in a unified framework aligned with business strategy.
Interest Rate Risk: Risk that changes in interest rates will adversely affect the value of assets or liabilities.
Internal Audit: Independent assurance function that evaluates and improves the effectiveness of risk management, control, and governance processes.
Internal Capital Adequacy Assessment Process (ICAAP): Process by which banks assess their capital needs relative to their risk profile.
Internal Control: Process designed to provide reasonable assurance regarding achievement of objectives related to operations, reporting, and compliance.
ISO 27001: International standard for information security management systems (ISMS), providing requirements for establishing, implementing, and maintaining security.
ISO 31000: International standard providing principles and guidelines for effective risk management applicable to any organization.
Issue Management: Process of identifying, tracking, and resolving problems and deficiencies.
IT General Controls (ITGC): Controls over IT infrastructure and operations that support the functioning of application controls.

K

Key Control: Control that is critical to achieving control objectives and mitigating significant risks.
Key Performance Indicator (KPI): Quantifiable measure used to evaluate the success of an organization or activity in meeting objectives for performance.
Key Risk Indicator (KRI): Metric used to provide an early signal of increasing risk exposures in various areas of the enterprise.
Know Your Customer (KYC): Due diligence process used by financial institutions to verify the identity of clients and assess potential risks.

L

Legal Risk: Risk arising from legal and regulatory obligations, including litigation and contract disputes.
Leverage Ratio: Measure of a banks capital relative to its total assets, used to constrain excessive leverage.
Limit Framework: System of risk limits used to control and monitor risk exposures within approved tolerances.
Liquidity Coverage Ratio (LCR): Basel III requirement ensuring banks hold sufficient high-quality liquid assets to survive a 30-day stress scenario.
Liquidity Risk: Risk that an organization cannot meet its short-term financial obligations or cannot sell assets quickly without significant loss.
Loss Data Collection: Systematic gathering of information about operational loss events for analysis and capital modeling.
Loss Given Default (LGD): Proportion of exposure that is lost when a borrower defaults, expressed as a percentage.

M

Market Risk: Risk of losses in on and off-balance sheet positions arising from movements in market prices.
Markets in Financial Instruments Directive (MiFID II): EU legislation regulating firms providing services related to financial instruments and the venues where those instruments are traded.
Material Risk: Risk that could have a significant impact on the organization or its stakeholders.
Material Weakness: Significant deficiency in internal control that results in a reasonable possibility of material misstatement.
Maturity Assessment: Evaluation of an organizations capabilities against a defined maturity model or framework.
MiCA (MiCA): Markets in Crypto-Assets regulation establishing a framework for crypto-asset markets in the EU.
Model Risk: Potential for adverse consequences from decisions based on incorrect or misused model outputs.
Model Validation: Process of assessing whether a model performs as expected, meets regulatory requirements, and is appropriate for its intended use.

N

Near Miss: Event that could have resulted in a loss but did not, providing valuable insight for risk management.
Net Stable Funding Ratio (NSFR): Basel III requirement ensuring banks maintain a stable funding profile relative to the composition of their assets and off-balance sheet activities.
NIST Cybersecurity Framework (NIST CSF): Framework developed by NIST providing standards, guidelines, and best practices to manage cybersecurity risk.
NIST Risk Management Framework (NIST RMF): Framework providing guidelines for managing information security and privacy risks.

O

Operational Resilience: Ability of organizations to prevent, adapt to, respond to, recover from, and learn from operational disruptions.
Operational Risk: Risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events.
Operational Risk Capital: Capital held to absorb potential losses from operational risk events.
Outsourcing Risk: Risk arising from the use of third parties to perform business activities on behalf of the organization.

P

Payment Card Industry Data Security Standard (PCI DSS): Information security standard for organizations that handle branded credit cards from the major card schemes.
Penetration Testing: Authorized simulated attack on a computer system to evaluate its security.
Personally Identifiable Information (PII): Any data that could potentially identify a specific individual, requiring protection under privacy regulations.
Physical Risk: Risk from climate-related events including extreme weather and chronic changes in climate patterns.
Pillar 1: Basel framework component setting minimum capital requirements for credit, market, and operational risk.
Pillar 2: Basel framework component requiring supervisory review of capital adequacy beyond minimum requirements.
Pillar 3: Basel framework component requiring market discipline through public disclosure of risk and capital information.
Policy: High-level statement of management intent and direction regarding a specific topic or area.
Political Risk: Risk arising from political instability, regulatory changes, or government actions affecting operations.
Preventive Control: Control designed to prevent errors or irregularities from occurring in the first place.
Privacy: Right of individuals to control the collection, use, and disclosure of their personal information.
Probability of Default (PD): Likelihood that a borrower will be unable to meet scheduled debt payments over a specified time period.
Procedure: Detailed steps describing how to perform a specific activity or process.
Process Risk: Risk arising from deficiencies in process design, execution, or management.
Prudential Regulation Authority (PRA): UK regulatory body responsible for the prudential regulation and supervision of banks, building societies, credit unions, insurers, and major investment firms.

Q

Quantitative Risk Analysis: Process of numerically analyzing the probability of each risk and its consequences on project objectives.

R

Ransomware: Malware that encrypts data and demands payment for its release.
Recovery Point Objective (RPO): Maximum acceptable amount of data loss measured in time, defining how much data can be lost before significant harm occurs.
Recovery Rate: Amount recovered on a defaulted loan or bond, expressed as a percentage of the exposure.
Recovery Time Objective (RTO): Maximum acceptable length of time that a system, application, or function can be down after a failure or disaster.
Regulatory Capital: Minimum amount of capital that banks and financial institutions must hold as required by their financial regulator.
Regulatory Compliance: Adherence to laws, regulations, guidelines, and specifications relevant to business operations.
Regulatory Risk: Risk arising from changes in laws, regulations, or regulatory interpretation.
Remediation Plan: Documented approach for addressing and correcting identified deficiencies or issues.
Reputational Risk: Risk that an action, event, or inaction will damage an organizations reputation among stakeholders.
Residual Risk: Risk remaining after controls and mitigation measures have been applied to inherent risk.
Risk Acceptance: Informed decision to accept a risk without further treatment.
Risk Aggregation: Process of combining individual risks to understand total risk exposure at an enterprise level.
Risk Appetite: Amount and type of risk that an organization is prepared to pursue or retain in order to meet its objectives.
Risk Appetite Statement (RAS): Document articulating the aggregate level and types of risk an organization is willing to assume within its risk capacity.
Risk Assessment: Process of identifying, analyzing, and evaluating risks to determine appropriate risk responses.
Risk Avoidance: Risk treatment option involving withdrawal from or not undertaking an activity that gives rise to risk.
Risk Capacity: Maximum amount of risk an organization can absorb while remaining viable.
Risk Categorization: Classification of risks into groups based on common characteristics for management purposes.
Risk Committee: Board or management committee responsible for overseeing enterprise risk management.
Risk Concentration: Accumulation of similar or correlated risks that could result in significant losses.
Risk Control Self-Assessment (RCSA): Methodology enabling management to assess the effectiveness of controls and identify areas for improvement.
Risk Culture: Norms, attitudes, and behaviors related to risk awareness, risk taking, and risk management within an organization.
Risk Escalation: Process of elevating risk issues to higher levels of management for decision-making.
Risk Event: Occurrence or change of a particular set of circumstances that may affect objectives.
Risk Framework: Set of components that support and sustain risk management throughout an organization.
Risk Governance: Framework establishing how risk management is integrated with organizational governance and decision-making.
Risk Identification: Process of finding, recognizing, and describing risks that may affect achievement of objectives.
Risk Limit: Specific boundary placed on risk-taking activities to control exposures.
Risk Management: Coordinated activities to direct and control an organization with regard to risk.
Risk Matrix: Tool for ranking and displaying risks based on likelihood and impact ratings.
Risk Mitigation: Actions taken to reduce the likelihood or impact of a risk to an acceptable level.
Risk Monitoring: Continuous checking, supervising, or observing risks and risk indicators.
Risk Owner: Person or entity with accountability and authority to manage a specific risk.
Risk Profile: Description of an organizations overall exposure to risks.
Risk Quantification: Process of assigning numerical values to risks for measurement and comparison.
Risk Reduction: Risk treatment option involving actions to lessen the likelihood or impact of a risk.
Risk Register: Document used to record identified risks, their severity, and actions to be taken.
Risk Reporting: Process of communicating risk information to relevant stakeholders.
Risk Response: Action taken to address an identified risk, including acceptance, avoidance, mitigation, or transfer.
Risk Scenario: Description of a potential risk event including its causes and consequences.
Risk Scoring: Methodology for assigning numerical values to risks based on defined criteria.
Risk Taxonomy: Hierarchical classification system for organizing and categorizing risks.
Risk Tolerance: Organizations readiness to bear risk after risk treatment in order to achieve objectives.
Risk Transfer: Risk treatment option involving sharing or shifting risk to another party, such as through insurance or contracts.
Risk Treatment: Process of selecting and implementing options for addressing risks.
Root Cause Analysis (RCA): Method of problem-solving used to identify the underlying causes of faults or problems.

S

Sanctions: Penalties or restrictions imposed by governments on countries, entities, or individuals.
Sarbanes-Oxley Act (SOX): US law enacted to protect shareholders and the general public from accounting errors and fraudulent practices in enterprises.
Scenario Analysis: Process of analyzing possible future events by considering alternative possible outcomes or scenarios.
Second Line of Defense: Risk management and compliance functions that provide oversight and challenge to the first line.
Securities and Exchange Commission (SEC): US government agency responsible for enforcing federal securities laws and regulating the securities industry.
Segregation of Duties (SoD): Internal control that distributes critical tasks among multiple individuals to prevent fraud and errors.
Senior Manager and Certification Regime (SM&CR): UK regulatory framework for senior managers in financial services, establishing accountability and conduct standards.
Sensitivity Analysis: Study of how uncertainty in model output can be attributed to different sources of uncertainty in inputs.
Settlement Risk: Risk that a counterparty does not deliver a security or its value in cash as per agreement.
Significant Deficiency: Deficiency in internal control that is less severe than a material weakness but important enough to merit attention.
Social Engineering: Psychological manipulation of people into performing actions or divulging confidential information.
Sovereign Risk: Risk that a government may default on its financial obligations or restrict currency conversion.
Stakeholder: Person or group with an interest in the activities or performance of an organization.
Standard: Specific mandatory requirement establishing minimum acceptable levels of performance or behavior.
Strategic Risk: Risk arising from adverse business decisions, improper implementation of decisions, or lack of responsiveness to change.
Stress Testing: Risk management technique examining how portfolios or institutions perform under extreme market conditions.
Suspicious Activity Report (SAR): Report filed with FinCEN regarding transactions suspected of involving money laundering or fraud.
Systemic Risk: Risk of collapse of an entire financial system or market due to interconnected failures.

T

Tail Risk: Risk of asset or portfolio values moving more than three standard deviations from the mean.
Technology Risk: Risk arising from the use, ownership, operation, or adoption of technology.
Third Line of Defense: Independent assurance provided by internal audit on the effectiveness of governance, risk management, and controls.
Third Party Risk: Potential risk arising from an organizations reliance on external parties such as vendors, suppliers, and service providers.
Threat Assessment: Evaluation of potential threats to an organization and the likelihood of their occurrence.
Three Lines Model: Framework for defining roles and responsibilities for risk management and internal control across an organization.
Tier 1 Capital: Core capital of a bank consisting primarily of common shares and retained earnings.
Tone at the Top: Ethical atmosphere created by an organizations leadership through their actions and communications.
Transaction Monitoring: Ongoing review of customer transactions to detect suspicious activity.
Transition Risk: Risk arising from the transition to a lower-carbon economy, including policy and technology changes.

U

Unexpected Loss (UL): Potential loss above expected loss, representing the volatility of credit losses.

V

Value at Risk (VaR): Statistical technique used to measure the potential loss in value of a portfolio over a defined period for a given confidence interval.
Vendor Risk Management (VRM): Process of identifying and mitigating risks associated with third-party vendors providing products or services.
Vulnerability: Weakness that can be exploited by one or more threats.
Vulnerability Assessment: Process of identifying, quantifying, and prioritizing vulnerabilities in a system.

W

Whistleblowing: Act of reporting suspected wrongdoing, misconduct, or illegal activities within an organization to appropriate authorities.
Wrong-Way Risk: Situation where exposure to a counterparty is adversely correlated with the credit quality of that counterparty.