Fundamentals of Risk Management

Glossary of terms
445
Term
Definition
reference
Tactics
Developments, projects and programmes of 
work to implement strategy and move the 
organization from where it is now to where 
it wants to be in three or five years time
Chapter 19
Target risk
The ultimate level of risk that is desired by
the organization when planned additional
controls have been implemented
Figure 12.2
Terminate
Risk response that is appropriate when
the level of risk is not acceptable to the
organization or outside risk appetite, also
referred to as ‘avoid’ or ‘eliminate’
Table 15.1
Tolerate
Risk response that is appropriate when
the level of risk is within risk appetite,
also referred to as ‘accept’ or ‘retain’
Table 15.1
Transfer
Risk response for risks outside risk appetite 
that the organization wishes to transfer or 
share, by means of insurance, contract or 
(perhaps) joint venture
Table 15.1
Treat
Risk response for risks that can be (further) 
treated by introduction of cost-effective 
(corrective) controls, also referred to as 
‘control’ or ‘reduce’
Table 15.1
Upside of risk
Additional benefits available to the 
organization by taking risk – see Table 14.1 
for a range of interpretations of the ‘Upside 
of risk’
Table 14.1

---

APPenDIx C
Implementation guide
t
he following table provides a detailed overview of the steps involved in the
implementation of a successful enterprise risk management (ERM) initiative.
It uses the structure described in Figure 23.3 to indicate the steps involved in learning 
from controls.
Successful implementation of an ERM initiative is an ongoing process that
involves working through the 10 steps set out below on a continuous basis. Also, 
because it is sometimes difficult to recognize the distinction between planning,
implementing, measuring and learning, the 10 steps in implementing an ERM
initiative are presented under the headings:
●
●
planning/implementing;
●
●
implementing/measuring;
●
●
measuring/learning;
●
●
learning/planning.
The information in the table below is an extended version of the steps involved
in achieving successful risk management, as set out in Table 24.1. In addition to 
identifying the 10 steps involved in the successful implementation of an ERM initi-
ative, the table also describes the concepts or tools and techniques that are required 
to deliver each step.
The plan, implement, measure and learn (PIML) structure used in this appendix is 
sometimes referred to as plan–do–check–act (PDCA). PIML is preferred because it 
implies a more structured and proactive approach that places specific emphasis on 
measuring and learning to improve risk management performance. The American 
National Standards Institute Organizational Resilience Standard ASIS SPC.1-2009 
specifically mentions PDCA, whereas the