32 plain-language terms
Business Risk Glossary
Working definitions for risk management, operations, contracts, liability and insurance.
- Acceptance
- A deliberate decision to retain a risk after considering its likelihood, impact, controls and alternatives.
- Additional insured
- A person or organization added to another party’s liability policy for specified interests or activities, subject to wording and endorsements.
- Business continuity
- Planning that helps priority activities continue or resume after disruption.
- Business interruption
- Loss of income or extra expense associated with an interruption, sometimes addressed by insurance subject to policy terms.
- Control
- A policy, process, safeguard or action intended to reduce likelihood, impact or uncertainty.
- Contingency
- A prepared alternative action or resource used when normal operations are disrupted.
- Deductible
- The amount or structure of loss retained before an insurer contributes, subject to policy wording.
- Dependency
- A person, system, location, vendor, resource or condition on which an activity relies.
- Enterprise risk management
- A coordinated approach to viewing risk across objectives, functions and categories rather than in isolated silos.
- Exposure
- The condition of being subject to possible loss, liability, disruption or adverse change.
- Impact
- The consequence of a risk event, often considered across financial, operational, legal, safety, customer and reputational dimensions.
- Indemnification
- A contractual arrangement that may allocate responsibility for specified losses, claims or costs.
- Indicator
- A measurable sign that exposure, control performance or operating conditions may be changing.
- Inherent risk
- Exposure before considering controls or treatment.
- Likelihood
- An estimate of how plausible or frequent a risk event may be within a stated period or context.
- Limit
- The maximum amount or boundary of coverage or responsibility defined by a policy or agreement.
- Mitigation
- Action intended to reduce the likelihood or impact of a risk.
- Operational resilience
- The ability to continue or restore important services despite disruption.
- Owner
- The person accountable for monitoring a risk, maintaining the response and escalating changes.
- Professional liability
- Liability associated with errors, omissions or failures in professional services, subject to legal and policy wording.
- Residual risk
- Exposure remaining after controls and treatment are considered.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain in seeking objectives.
- Risk assessment
- A structured process for identifying, analyzing and evaluating risk.
- Risk register
- A working record of risks, owners, scores, controls, actions and review information.
- Risk transfer
- Shifting some financial or contractual consequence to another party, often through insurance or contracts.
- Scenario
- A plausible sequence of events used to explore impacts, dependencies and response needs.
- Severity
- The seriousness of a consequence; often used similarly to impact.
- Supply-chain risk
- Exposure arising from suppliers, logistics, materials, concentration, geography or downstream dependencies.
- Third party
- An external organization or person that provides services, access, products, data processing or another dependency.
- Tolerance
- A boundary or acceptable variation around a risk or performance objective.
- Treatment
- The selected response to a risk, such as avoid, reduce, transfer, share or accept.
- Velocity
- How quickly a risk event can develop and begin causing harm.
Definitions are simplified for education. Controlling legal, contract, policy, regulatory and professional meanings may differ.