Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
5.2
Risk management process
| Term | Definition |
|---|---|
| Risk assessment frequency | the regularity with which risk assessments are conducted in an org |
| Ad-hoc risk assessments | conducted as and when needed |
| Recurring risk assessments | conducted at regular intervals |
| One-time risk assessments | conducted for a specific purpose and are not repreated |
| Continuous risk assessments | ongoing monitoring and evaluation of risks |
| Risk identification | recognizing potential risks that could negatively impact an org's ability to operate or achieve its objectives |
| Risk management Step 1 | risk identification |
| Business impact analysis (BIA) | process that involves evaluating the potential effects of disruption to an org's business functions |
| Recovery time objective (RTO) | the max acceptable length of time that can elapse before the lack of a business function severely impacts the org |
| Recovery point objective (RPO) | the max acceptable amount of data loss measured in time |
| Mena time to repair (MTTO) | the average time required to repair a failed component/system |
| Mean time between failures (MTBF) | average time between failures |
| Risk register/log | document detailing identified risks, including their description, impact likelihood, and mitigation strats |
| Risk level/threshold | determined by combining the impact and the likelihood |
| Risk tolerance/acceptance | an org/individual's max amount of risk they are willing to accept |
| Risk appetite | an org's willingness to embrace or retain specific types and levels of risk to fulfill its strategic goals |
| Expansionary risk appetite | org is open to taking more risk in the hopes of getting greater returns |
| Conservative risk appetite | an org favors less risk even if it leads to lower returns |
| Neutral risk appetite | a balance between risk and return |
| Key risk indicators (KRIs) | essential predictive metrics used by orgs to signal rising risk levels in different parts of the org |
| Risk owner | person/group responsible for managing the risk |
| Qualitative risk analysis | a method of assessing risks based on their potential impact and the likelihood of their occurrence (low, med, high) |
| Quantitative risk analysis | a method of evaluating risk that uses numerical measurements |
| Exposure factor | proportion of an asset that is lost in an event, expressed as a percentage (0 - no loss) |
| Single loss expectancy (SLE) | monetary value expected to be lost in a single event |
| Annualized rate of occurrence (ARO) | estimated frequency with which a threat is expected to occur within a year |
| Annualized loss expectancy (ALE) | expected annual loss from a risk (SLE*ARO) |
| Risk transference/sharing | shifting the risk from the org to another party |
| Risk acceptance | recognizing a risk and choosing to address it when it arises |
| Exemption | provision that grants an exception from a specific rule or requirement |
| Exception | provision that permits a party to bypass a rule or requirement in certain circumstances |
| Risk avoidance | strategy of altering plans or approaches to completely eliminate a specific risk |
| Risk mitigation | implementing measures to decrease the likelihood or impact of a risk |
Created by:
crly