Elliot Book Chapter 1: Introduction to Enterprise Risk Management

Comprehensive vocabulary based on Chapter 1 of the Elliot Book, covering Enterprise Risk Management concepts, risk classifications, theoretical foundations, and regulatory drivers.

Traditional Risk Management

Managed at a departmental level, primarily concerned with an organization’s pure risk and hazard risk.

Enterprise Risk Management (ERM)

A methodology developed to manage all of an organization’s risks, including operational, financial, and strategic risk.

Risk (ISO definition)

The effect of uncertainty on objectives.

Risk Management (ISO 2009 definition)

Coordinated activities to direct and control an organization with regard to risk.

Interdependence (ERM Pillar)

The concept that risks managed together are different than those managed separately, and that the probability of one event may affect another.

Correlation

A relationship where events are statistically linked; correlation increases risk, while uncorrelated risks can provide a hedge or balance.

Portfolio Theory

A theoretical pillar of ERM that assumes risk includes both individual risks and their interactions in a combination.

Chief Risk Officer (CRO)

A high-level facilitator who engages management in conversations regarding risk strategic goals and helps create a risk culture.

Risk Owners

Managers for the organizations’ divisions and units, and eventually individual employees, who are responsible for identifying and managing risk in their areas.

Dodd-Frank Act

A 2010 U.S. law requiring certain types of financial companies to appoint board risk committees.

Risk Management Information System (RMIS)

A technological system, often originating from brokers or insurers, used to collect and analyze relevant risk data.

Pure Risk

A classification of risk with a chance of loss or no loss, but no possibility of gain.

Speculative Risk

A classification of risk that involves a chance of gain, making it potentially desirable.

Price Risk

Uncertainty over the size of cash flows resulting from possible changes in the cost of raw materials or outputs.

Credit Risk

The risk relevant to any organization with accounts receivable, particularly significant for financial institutions.

Market Risk

The risk associated with fluctuations in prices of financial securities, such as stocks and bonds.

Inflation Risk

The risk associated with the loss of purchasing power due to an overall increase in the economy’s price level.

Interest Rate Risk

The risk associated with a security’s future value because of changes in interest rates.

Liquidity Risk

The risk that an asset cannot be sold on short notice without incurring a loss or being unable to liquidate an investment easily at a reasonable price.

Subjective Risk

The perceived amount of risk based on an individual’s or organization’s opinion.

Objective Risk

The measurable variation in uncertain outcomes based on facts and data.

Diversifiable Risk

Risk that is not highly correlated and affects only some individuals, businesses, or small groups.

Nondiversifiable Risk

Correlated risks that affect a large segment of society at the same time, such as inflation or natural disasters.

Systemic Risk

Generally nondiversifiable, these risks have the potential for major disruption in the function of an entire market or financial system.

Hazard Risk Quadrant

Risks arising from property, liability, or personnel loss exposures, generally the subject of insurance.

Operational Risk Quadrant

Risks arising from people or failures in processes, systems, or controls, including information technology.

Financial Risk Quadrant

Risks arising from market forces on financial assets or liabilities, including market, credit, and price risk.

Strategic Risk Quadrant

Risks arising from trends in the economy and society, demographic shifts, or changes in political and competitive environments.

Risk Appetite

The total exposed amount that an organization wishes to undertake based on risk-return trade-offs for expected outcomes.

Risk Tolerance

The amount of uncertainty an organization is prepared to accept in total or within a specific business unit or initiative.

Sarbanes-Oxley Act (SOX)

2002 U.S. legislation requiring CEOs and CFOs to personally attest to financial results and requiring an enterprise-wide approach to risk profiles.

SOX Section 404

The specific section of the Sarbanes-Oxley Act requiring organizations to provide an assessment of internal risk control measures.

SAS 115

A 2009 auditing standard requiring external auditors to focus on a corporation’s internal controls and risk assessment.

Corporate Social Responsibility (CSR)

Actions by companies over and above legal obligations towards society and the environment, often serving as a driver for ERM.

Risk Radar

A scanning process used by an organization to analyze relevant risk factors and identify emerging risks in real time.