Fundamentals of Risk Management

15

---

Introduction to risk management
16
TAbLE 
1.1
Definitions of risk
Organization
Definition of risk
ISO Guide 73
ISO 31000
Effect of uncertainty on objectives. Note that
an effect may be positive, negative, or
a deviation from the expected. Also, risk is
often described by an event, a change in 
circumstances or a consequence.
Institute of Risk Management 
(IRM)
Risk is the combination of the probability of
an event and its consequence. Consequences
can range from positive to negative.
Orange Book from HM Treasury
Uncertainty of outcome, within a range of
exposure, arising from a combination of the
impact and the probability of potential events.
Institute of Internal Auditors
The uncertainty of an event occurring that
could have an impact on the achievement of
the objectives. Risk is measured in terms of 
consequences and likelihood.
The Institute of Internal Auditors (IIA) defines risk as the uncertainty of an event 
occurring that could have an impact on the achievement of objectives. The IIA adds 
that risk is measured in terms of consequences and likelihood. Different disciplines 
define the term risk in very different ways. The definition used by health and safety 
professionals is that risk is a combination of likelihood and magnitude, but this may 
not be sufficient for more general risk management purposes.
Given that there are many available definitions for the word risk, it is important 
that the organization chooses the definition that is most suitable for its own pur-
poses. The definition can be as narrow or as comprehensive as the organization 
wishes. As a version of a comprehensive definition of the word risk, the author offers 
the following:
An event with the ability to impact (inhibit, enhance or cause doubt about) the 
effectiveness and efficiency of the core processes of an organization.
Risk in an organizational context is usually defined as anything that can impact
the fulfilment of corporate objectives. However, corporate objectives are usually
not fully stated by most organizations. Where the objectives have been established,
they tend to be stated as internal, annual, change objectives. This is particularly
true of the personal objectives set for members of staff in the organization, where 
objectives usually refer to change or developments, rather than the continuing or 
routine operations of the organization.

---