Risk Tracking

The inherent risk

facing an organization is the original level of risk that exists before implementing any controls

The residual risk

is the risk that remains after an organization implements controls designed to mitigate, avoid, and/or transfer the inherent risk

An organization’s risk appetite

is the level of risk that it is willing to accept as a cost of doing business

The risk threshold

is the specific level at which a risk becomes unacceptable. It is the actual boundary that, when crossed, will trigger some action or decision

An organization’s risk tolerance

is its ability to withstand risks and continue operations without any significant impact

Key Risk Indicators (KRIs)

are metrics used to measure and provide early warning signals for increasing levels of risk

The risk owner

is an individual or entity responsible for managing and monitoring risks, including implementing necessary controls and actions to mitigate them