Glossary

Risk management techniques are the methods for treating risks. Traditional risk management techniques for handling event risks include risk retention, contractual or noninsurance risk transfer, risk control, risk avoidance, and insurance transfer. Other techniques used for other types of risk (e.g., credit, operational, interest rate risks) include financial tools such as hedges, swaps, and derivatives.

A risk manager is the individual responsible for managing an organization's risks and minimizing the adverse impact of losses on the achievement of the organization's objectives. Traditionally, risk managers have focused on event risks, but some organizations have broadened the role to include other types of risk (e.g., operational risks). The risk manager is charged with identifying risks, evaluating risks, selecting the best techniques for treating identified risks, implementing the chosen risk management techniques, and regularly evaluating and monitoring the program. This person is also involved in the managerial processes of planning, organizing, leading, and controlling those activities in a business that deals with various types of risk. Another type of risk manager manages the effects of financial risks on the organization. This individual is usually a treasury department employee who must maintain certain critical financial metrics within acceptable parameters. For example, interest rate risk is a bank's most important financial risk. Using various hedging tools and techniques such as derivatives, the risk manager makes sure that the bank's exposure to interest rate volatility is satisfactorily managed.

A risk map is a graphical depiction of a select number of a company's risks designed to illustrate the impact or significance of risks on one axis and the likelihood or frequency on the other. Risk mapping is used to assist in identifying, prioritizing, and quantifying (at a macro level) risks to an organization. This representation often takes the form of a two-dimensional grid with frequency (or likelihood of occurrence) on one axis and severity (or degree of financial impact) on the other axis; the risks that fall in the high-frequency/high-severity quadrant are given priority risk management attention.

Risk pool refers to multiple subjects of insurance insured or reinsured by a single insurer where, to avoid risk concentration and improve risk distribution, different combinations of exposures, perils, and hazards will be underwritten.

Risk prioritization is the ranking of material risks on an appropriate scale, such as frequency and/or severity.

A risk profile is a measure of expected losses for a finite time period based on various items of historical data such as total losses, number of losses, average loss size, and payout patterns. The term is usually reserved to refer to a book of business, an individual account, or an individual policy with a sufficiently large exposure base to lend credibility to analysis of the data.

A risk purchasing group (RPG) is a group formed in compliance with the Risk Retention Act (RRA) of 1986 authorizing a group of insureds engaged in similar businesses or activities to purchase insurance coverage from a commercial insurer. This is in contrast to a risk retention group (RRG), which actually bears the group's risks rather than obtaining coverage on behalf of group members.

Risk quantification refers to the forecasting of loss frequency and severity to make risk financing decisions. Dependable estimates of the likelihood and dollar amount of loss-causing events allow an organization to take appropriate steps now and in the future to minimize their financial impact.

Risk reduction is a measure to reduce the frequency or severity of losses, also known as loss control. This may include engineering, fire protection, safety inspections, or claims management.

In a practical enterprise risk management framework, a risk register is a list of the internal and external risks that confront a business. This becomes the common risk language for the company. It should not only define the risks but also clearly define the risk owner(s) for each risk. This enhances alignment and accountability.