The vocabulary, in plain words
Every term carries what it is and why a practitioner cares. The second line is the part that makes it usable. Free at every tier, because vocabulary is the first barrier into this work and the wrong thing to charge for.
Q
- Quantified risk FAIR-style analysis
-
A risk expressed as a range of loss over a period, built from stated frequency and magnitude estimates.
Ordinal scales cannot be compared against the cost of a control. A range with stated confidence can.
Taught in RSK-210 · See also: Risk appetite, Risk treatment
R
- Risk acceptance
-
A decision by someone with the authority to make it that a known risk will not be treated further for now.
It is a treatment with a date on it. Without an expiry it becomes a risk nobody is looking at, accepted by someone who may have left.
Taught in RSK-220 · See also: Risk treatment, Risk appetite
- Risk appetite
-
A statement of how much risk an organization is willing to carry, expressed so that exceeding it is observable.
Two tests decide whether it means anything: could we exceed it, and would we know.
Taught in RSK-230 · See also: Risk treatment, Quantified risk
- Risk treatment
-
The decision taken about an assessed risk: modify, share, avoid or accept, with the controls that deliver it.
Controls should be derived from treatment decisions. A control set chosen from a template cannot explain why any control is there.
Taught in RSK-201 · See also: Risk acceptance, soa
Maintained by the association. A term here is a summary; the course named beside it is where the practice is taught.