Fundamentals of Risk Management

Risk training and communication
321
shared risk vocabulary
Part of communicating successfully on risk matters is the development of a common 
language of risk. Appendix B provides the vocabulary that is used in this book, as 
well as making reference to the definitions used in ISO Guide 73, which provides 
internationally recognized terms related to risk management. However, it is some-
times necessary for an organization to develop its own risk vocabulary, for aspects 
that may be particular and unique to it. A common understanding of risk based on 
the use of terminology within the organization is more important than arguments 
about precisely what a term means to different risk management practitioners.
In fact, as part of aligning risk management effort and embedding risk consider-
ations into routine operations, it may be appropriate for the risk manager to use the 
terminology already in place in an organization. Even if the vocabulary of the organ-
ization conflicts with strict risk management definitions, communication will be more 
successful if the established vocabulary is used.
In this book, a standard vocabulary has been used in order to assist with the
introduction and explanation of concepts relevant to risk management. Sometimes, 
this vocabulary contradicts ISO Guide 73, but it has been used to aid communica-
tion and understanding. The subject of a risk vocabulary and agreeing definitions 
can take a great deal of time and effort, and compromise is usually required.
A common language and agreed definitions are important so that all parties to
a discussion have the same understanding of the terminology being used. This is
illustrated by the summary in the box below.
The person to whom the disclosure is made will normally consider the information and decide 
whether there is a prima facie case to answer. He or she will decide whether an investigation 
should be conducted and what form it should take. This will depend on the nature of the 
matter raised and may be:
●
●
investigated internally;
●
●
referred to the external auditors;
●
●
the subject of independent enquiry.
Following investigation, some matters will need to be referred to the relevant outside body, 
including the police or funding council. If the person to whom the disclosure is made decides 
not to proceed with an investigation, the decision will be explained as fully as possible to the 
individual who raised the concern. It is then open to the individual to make the disclosure 
again either to another person or to the chair of the audit committee.
University of Cambridge
Whistleblowing investigation process

---