Mastering Risk and Resilience: Navigating the VUCA Landscape

Vocabulary practice flashcards covering risk governance, the Three Line Model, risk culture maturity levels, risk mitigation strategies (the 4 Ts), and COSO ERM communication principles from Week 4 of Mastering Risk and Resilience.

VUCA

An acronym describing a business landscape characterized as Volatile, Uncertain, Complex, and Ambiguous.

Tolerate

A risk treatment strategy (one of the 4 Ts) that involves accepting the risk with conscious documentation.

Treat

A risk treatment strategy (one of the 4 Ts) focused on reducing the likelihood and/or impact of an identified risk.

Transfer

A risk treatment strategy (one of the 4 Ts) that shifts the risk to a third party.

Terminate

A risk treatment strategy (one of the 4 Ts) in which an organisation avoids the risk entirely.

Risk Governance

The framework, structures, and processes organisations use to manage risk at strategic and operational levels.

Integrated (ISO 31000:2018)

A risk governance principle stating that risk management must be embedded into all organisational activities and decision making.

Structured (ISO 31000:2018)

A risk governance principle that requires a systematic and comprehensive approach to all risk management processes.

Inclusive (ISO 31000:2018)

A risk governance principle centered on active stakeholder engagement and transparency at all levels of the organisation.

Risk Appetite Statement

A documented element of the risk governance framework that explicitly defines acceptable risk levels for an organisation.

Board Oversight

A foundational component of the risk governance framework holding ultimate accountability for risk management.

First Line: Business Operations

The line of defense responsible for owning and managing risks, led by operational managers who perform day-to-day risk management, implement controls, and report risk exposures.

Second Line: Risk Management and Compliance

The line of defense whose role is to oversee and facilitate risk processes through compliance functions, policy development, and risk monitoring.

Third Line: Internal Audit

The line of defense whose role is to provide independent assurance through independent evaluation, objective assessment, assurance activities, and reporting directly to the board.

Boeing 737 MAX Failure

A real-world case study resulting in 346 fatalities between 2018 and 2019, demonstrating a systematic governance failure across all three lines of defense.

Reactive Risk Culture

The maturity level characterized as crisis-driven with no formal structure, where typical behaviours involve blaming individuals and ignoring warning signs.

Compliance Risk Culture

The maturity level characterized as rules-based with minimal engagement, displaying a checkbox mentality and a defensive posture.

Proactive Risk Culture

The maturity level characterized as forward-looking with embedded processes, featuring risk discussions in meetings and structured training programmes.

Embedded Risk Culture

The highest maturity level characterized by risk-aware decision making at all levels, accompanied by a speak-up culture and continuous improvement.

TRA Principles (COSO ERM)

Core risk communication principles requiring risk information to be Timely (shared when decisions need to be made), Relevant (tailored to audience needs and decision context), and Accurate (reliable, verified, and complete).