Fundamentals of Risk Management

implementing/measuring
4. Adopt suitable risk 
assessment tools and
an agreed risk classification
system
Risk protocols
Risk management 
guidelines
Risk classification 
systems
Risk description
FIRM
PESTLE
SWOT
Chapter 6
Chapter 10
Chapter 11
Chapter 12
5. Establish risk benchmarks 
and undertake risk
assessments
Benchmark tests of 
significance
Risk register
EM3
RMIS
Chapter 11
Chapter 19
Chapter 20
Chapter 35
6. Determine risk appetite
and risk tolerance levels
and evaluate the existing 
controls
Risk appetite
Risk matrix
Loss control
4Ts
PCDD
Chapter 10
Chapter 13
Chapter 14
Chapter 25

---

Appendix C
448
activity
Concepts/tools and 
techniques
acronym references
Measuring/learning
7. Evaluate effectiveness of 
existing controls and 
introduce improvements
Risk improvement plans
Reaction planning
BIA
BCP/DRP
Chapter 13
Chapter 17
Chapter 18
Chapter 23
8. Embed risk-aware culture 
and align RM with other 
activities in the organization
Control environment
Resource allocation
Risk communications
Business model
LILAC
CRAM
Chapter 21
Chapter 22
Chapter 24
Chapter 33
learning/planning
9. Monitor and review risk 
performance indicators to 
measure ERM contribution
Audit plan
Sources of risk assurance
STOC
CRSA
Chapter 24
Chapter 27
Chapter 29
Chapter 34
10. Report risk performance in 
line with obligations and 
monitor improvement
Risk reporting
Corporate governance
FRC/Sarbanes–Oxley
CoCo
GRC
Chapter 26
Chapter 33
Chapter 34
Chapter 36

---

InDex
4Cs of comfort, caution, concern and 
critical 128
4Es of opportunity
benefits of risk management 65
potential rewards and 183–84
4Ns of risk maturity 297, 298, 301
matrix of 300
4Ts of hazard response 51, 52, 60, 61, 148–49
application of 190
description of 175–77
and ‘take the risk’ 161
terminate 176–77, 181–82
tolerate 176, 177–79
transfer 176–77, 181
treat 176–77, 180
5Cs of communication 331
5Es 148
5Ts 161
8Rs of hazard risk management 51, 52, 60
AA plc 116
accidents
damage limitation 157
accountability
Birmingham City Council and 68–9
risk-aware culture 293, 294–95
African Bank Investments Ltd (ABIL) 12–3
Airmic 72, 73
Alarm 72, 73
ALARP (as low as possible) levels 146
AMEC Foster Wheeler 220
American National Standards Institute
107–08
analytical skills 332–33
CRAM skills 327–28
internal audit and 414
Annex SL 111–13
appetite for risk 424
definitions of 303
lifestyle decision and 313–15
nature of 302–03
risk matrix and 304–06
statements and 310–13
tolerance and 179
archaeological remains 377–78
AS 4360 3
approach of 71
risk management development 48
three contexts 82
updated 80
asbestos and lung disease 276
ASIS SPC.1-2009 107–08
Organizational Resilience 80
Association of Project Management 378
Project Risk and Management 80
audit committees
added value of 405
risk assurance 405–06
tasks and responsibilities 402–04
audits, external 410, 421
audits, internal
activities 420
in ERM 412–14
risk management and 416–19, 419
scope and role of 411–14
undertaking 414–15
Australian Mines Ltd 173
authorization procedures 149
balanced scorecard
risk awareness and 296
banks see financial institutions
Basel Committee on Banking Supervision
definition of operational risk 361
Basel II
analytical skills and 332
operational risks and 142, 360, 361, 364,
366
ORM principles 363–64
requirements 101
risk exposure 368
Basel III 101, 363
Birmingham City Council 68–9
bow-tie model 33–4
controls 188–89
loss prevention 156
project management 373–74
risk assessment 133–35, 155, 188–89
STOC 33–4, 133–35
uncertainty and 373–74
brainstorming and workshops
risk assessment 123, 124
brand protection 281–82
British Broadcasting Corporation (BBC) 220–21
British Land plc 116–17
broadcasting organization disruption 213