Risk Management

The terms

• Asset-Liability Management (ALM)

  Asset-liability management is the practice of managing the gap between what a financial institution owns and what it owes, in timing, amount and rate, to keep liquidity, earnings and capital within set limits.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Automated Controls

  Automated controls are checks built into software that run without anyone pressing a button, such as approval limits, input validation and system-enforced access rules. The process cannot move on unless the rule is met.

  Subdomain: Controls and Risk Treatment

• Bank Run

  A bank run happens when many depositors try to withdraw their money at the same time because they fear the bank will fail, which can turn a worry into an actual collapse.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Basis Risk

  Basis risk is the chance that a hedge does not move in step with the exposure it is meant to offset, leaving a loss even though the hedge was put in place.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Bow-Tie Analysis

  Bow-tie analysis is a diagram that places one risk event in the centre, with its causes and preventive controls on the left and its consequences and recovery controls on the right.

  Subdomain: Risk Assessment and Quantification

• Catastrophic Risk

  Catastrophic risk is the chance of an event so severe that it causes losses far beyond normal experience and threatens the survival of an organisation, a market or a community.

  Subdomain: Risk Fundamentals and Frameworks

• Concentration Risk

  Concentration risk is the chance of heavy loss because exposure is bunched in one borrower, sector, region, product, funding source or supplier, so one adverse event hits a large share of the business.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Contagion Risk

  Contagion risk is the risk that distress at one firm, market or country spreads to others through links such as shared exposures, funding ties, confidence or common assets.

  Subdomain: Strategic and Systemic Risk

• Contingency Funding Plan (CFP)

  A contingency funding plan sets out how a financial institution would raise cash and manage outflows during a liquidity stress, naming the triggers, the funding sources, the actions and who decides.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Continuous Monitoring

  Continuous monitoring is the regular, often automated, checking of risks and controls through the year, so problems show up soon after they arise instead of at a yearly review or audit.

  Subdomain: Controls and Risk Treatment

• Control Effectiveness Testing

  Control effectiveness testing is the evaluation of whether a control is well designed and operates as intended over a period, using evidence such as samples, re-performance and system checks.

  Subdomain: Controls and Risk Treatment

• Country Risk

  Country risk is the chance of loss from political, economic or legal conditions in a country, such as default by its government, currency controls, nationalisation or unrest, which can stop borrowers from paying.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Credit Rating

  A credit rating is an opinion, usually expressed as a letter grade, on how likely a borrower or a bond is to pay interest and principal as promised.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Credit Risk

  Credit risk is the risk of loss because a borrower or counterparty does not pay what it owes, or pays late, or because its ability to pay worsens.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Detective Controls

  Detective controls are checks that find an error, loss or breach after it has happened, so it can be corrected, investigated and reported. Examples are reconciliations, exception reports and audits.

  Subdomain: Controls and Risk Treatment

• Disaster Recovery Plan (DRP)

  A disaster recovery plan sets out the steps, people and resources needed to restore IT systems, data and supporting facilities after a major outage or destructive event, within agreed time and data-loss limits.

  Subdomain: Business Continuity and Resilience

• Emerging Risk

  An emerging risk is a newly developing or changing threat whose causes, likelihood and impact are still poorly understood, so it cannot yet be measured with the usual tools.

  Subdomain: Risk Fundamentals and Frameworks

• Exit Strategy (Outsourcing)

  An outsourcing exit strategy is a documented plan for ending a supplier arrangement in an orderly way, by moving the service to another provider or back in house, with little or no disruption.

  Subdomain: Third-Party Risk

• Expected Loss (EL)

  Expected loss is the average loss a lender or insurer anticipates over a period from a portfolio, usually calculated as probability of default times loss given default times exposure at default.

  Subdomain: Risk Assessment and Quantification

• Exposure at Default (EAD)

  Exposure at default is the estimated amount a lender would be owed at the moment a borrower defaults, including any drawn balance and the part of unused credit lines likely to be drawn by then.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• False Negative

  A false negative is a case where a test, model or control says nothing is wrong when something actually is, so a real problem goes undetected.

  Subdomain: Risk Assessment and Quantification

• False Positive

  A false positive is an alert raised by a test, model or control when nothing is actually wrong, which costs reviewers time and can delay legitimate activity.

  Subdomain: Risk Assessment and Quantification

• Fault Tree Analysis (FTA)

  Fault tree analysis starts from one undesired event and works backwards, using logic gates to map every combination of faults that could cause it.

  Subdomain: Risk Assessment and Quantification

• Financial Risk

  Financial risk is the possibility of losing money or value through the way an organisation lends, invests, trades or funds itself. Credit, market and liquidity risk are its main forms.

  Subdomain: Risk Fundamentals and Frameworks

• Foreign Exchange Risk

  Foreign exchange risk is the chance of gain or loss from changes in exchange rates, affecting the value of money received or owed in a foreign currency, or of assets and liabilities held abroad.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Fourth-Party Risk

  Fourth-party risk is the risk that comes from the subcontractors and suppliers a firm's own vendors rely on, with whom the firm has no contract and often little visibility.

  Subdomain: Third-Party Risk

• Hazard and Operability Study (HAZOP)

  HAZOP is a structured team review of an industrial process design, in which guide words such as no, more or less are applied to each step to find hazards and operating problems.

  Subdomain: Risk Assessment and Quantification

• Hedging

  Hedging means taking a second position chosen to gain when an existing exposure loses, so the two largely cancel out.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Inherent Risk

  Inherent risk is the exposure an activity carries by its very nature, judged as if no safeguards were in place. It is the starting point before any control is credited.

  Subdomain: Risk Fundamentals and Frameworks

• Key Person Dependency

  Key person dependency is the exposure that arises when a business relies so heavily on one or a few individuals that losing them through illness, exit or death would disrupt operations, client relationships or decisions.

  Subdomain: Operational and Model Risk

• Key Risk Indicators (KRIs)

  Key risk indicators are measurable signals that show a risk is rising, usually with thresholds that trigger escalation before losses occur.

  Subdomain: Risk Assessment and Quantification

• Likelihood and Impact

  Likelihood and impact are the two basic measures used to rate a risk: how probable it is that the event happens, and how serious the effect would be if it does.

  Subdomain: Risk Assessment and Quantification

• Loss Given Default (LGD)

  Loss given default is the share of an exposure a lender expects to lose if the borrower defaults, after counting what can be recovered from collateral, guarantees and the borrower's remaining assets.

  Subdomain: Financial Risk (Credit, Market, Liquidity)

• Monte Carlo Simulation

  Monte Carlo simulation is a technique that runs thousands of trials with randomly drawn inputs to show the range of possible outcomes and how likely each one is.

  Subdomain: Risk Assessment and Quantification

• Moral Hazard

  Moral hazard arises when protection from loss changes behaviour: a party covered against the downside takes chances, or less care, that it would avoid if it paid for failure itself.

  Subdomain: Risk Fundamentals and Frameworks

• Outsourcing Risk

  Outsourcing risk is the risk of loss, disruption or regulatory breach that arises when an organisation hands a function or service to an outside provider but stays responsible for the result.

  Subdomain: Third-Party Risk

• Preventive Controls

  Preventive controls are measures that stop an error, loss or breach from happening in the first place, such as approvals, access restrictions, training and system blocks.

  Subdomain: Controls and Risk Treatment

• Project Risk Management

  Project risk management is the practice of identifying, assessing and responding to uncertain events that could help or harm a project's cost, schedule, scope or quality, from planning through delivery.

  Subdomain: Strategic and Systemic Risk

• Prudential Regulation

  Prudential regulation is the set of rules that keep financial firms financially sound, covering capital, liquidity, risk management and governance, so they can survive losses and protect depositors, policyholders and the wider system.

  Subdomain: Prudential and Capital Risk

• Recovery Point Objective (RPO)

  The recovery point objective is the maximum amount of data loss an organisation will accept after an outage, measured as time between the last good copy of the data and the moment of failure.

  Subdomain: Business Continuity and Resilience

• Recovery Time Objective (RTO)

  The recovery time objective is the target time within which a disrupted process, system or service must be restored after an outage, counted from the moment the disruption begins.

  Subdomain: Business Continuity and Resilience

• Regulatory Capital

  Regulatory capital is the amount and type of capital that supervisors require a financial firm to hold against its risks, defined by their rules about what counts and how much is needed.

  Subdomain: Prudential and Capital Risk

• Reputational Risk

  Reputational risk is the chance that negative opinion among customers, investors, regulators, staff or the public damages an organisation's standing, and through that its revenue, funding, right to operate or ability to hire.

  Subdomain: Strategic and Systemic Risk

• Residual Risk

  Residual risk is the level of risk that remains after existing controls and other responses have been taken into account.

  Subdomain: Risk Assessment and Quantification

• Risk and Control Self-Assessment (RCSA)

  RCSA is a process in which business teams themselves identify their risks, rate them, assess how well their controls work and agree actions for gaps.

  Subdomain: Risk Assessment and Quantification

• Risk Control Matrix (RCM)

  A risk control matrix is a table that lists the risks in a process, the controls meant to address each one, who owns them, and how often they run. It is a working record of control coverage.

  Subdomain: Controls and Risk Treatment

• Risk Governance

  Risk governance is the set of structures, roles, decision rights and reporting lines through which an organisation oversees and directs how risk is taken and managed, from the board down.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Identification

  Risk identification is the first stage of risk management: spotting what could go wrong, or unexpectedly go right, for an organisation's goals and recording each item clearly enough to act on.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Limit

  A risk limit is a measurable boundary on how much exposure a person, desk or business unit may take, set to keep activity inside the board's risk appetite.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Management Framework (RMF)

  A risk management framework is the structure of policies, roles, processes and tools an organisation uses to manage risk consistently, from setting objectives to reporting results to the board.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Management Maturity Model

  A risk management maturity model rates how developed an organisation's risk practices are, usually on a scale of stages from ad hoc to optimised, and shows what to improve next.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Matrix

  A risk matrix is a grid that plots risks by likelihood on one axis and impact on the other, with colour bands showing which combinations are low, medium or high.

  Subdomain: Risk Assessment and Quantification

• Risk Register

  A risk register is a living record of identified risks, with their ratings, owners, controls and planned actions, kept so that risks can be tracked and reported.

  Subdomain: Risk Assessment and Quantification

• Risk Taxonomy

  A risk taxonomy is a structured classification of risks into categories and sub-categories with agreed names and definitions, so that risks are described and reported the same way across the organisation.

  Subdomain: Risk Fundamentals and Frameworks

• Risk Transfer

  Risk transfer moves some or all of the financial cost of a risk to another party, usually through insurance, a contract or a hedge, while the original party stays responsible for the underlying activity.

  Subdomain: Risk Fundamentals and Frameworks

• Scenario Analysis

  Scenario analysis studies what could happen to an organisation under a specific set of plausible events, to measure the damage and test whether its plans and resources are enough.

  Subdomain: Risk Assessment and Quantification

• Sensitivity Analysis

  Sensitivity analysis tests how much a result changes when one input or assumption is varied, showing which inputs matter most to the outcome.

  Subdomain: Risk Assessment and Quantification

• Strategic Risk

  Strategic risk is the risk that an organisation fails to meet its goals because of poor strategic choices, weak execution of its plan, or a failure to adapt to changes in its market or environment.

  Subdomain: Strategic and Systemic Risk

• Stress Testing

  Stress testing measures how an organisation, portfolio or system would cope under severe but plausible shocks, such as a deep recession or a market crash, to see whether it stays sound.

  Subdomain: Risk Assessment and Quantification

• Supply Chain Risk

  Supply chain risk is the chance that disruption, failure or misconduct at any point in the network that makes and delivers goods and services interrupts supply, raises cost or harms the buyer's reputation.

  Subdomain: Third-Party Risk