Risk Management Vocabulary in English

Inherent risk is the level of risk present in a situation before any controls, safeguards, or mitigation measures are applied — it is the “raw” risk. Residual risk is the risk that remains after controls have been put in place. For example, the inherent risk of a fire in a factory may be high, but after installing sprinklers, fire alarms, and training staff, the residual risk is much lower. Risk managers aim to reduce residual risk to an acceptable level within the organisation’s risk appetite.

A risk register (also called a risk log) is a document used to record, track, and manage all identified risks within a project or organisation. It typically includes: a description of each risk, the likelihood and impact scores, the risk owner (the person responsible for managing it), the mitigation actions planned or taken, and the current status. Maintaining an up-to-date risk register is a key requirement in project management frameworks such as PRINCE2 and Agile.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. A conservative risk appetite means the organisation prefers to avoid most risks, even at the cost of potential gains. An aggressive risk appetite means the organisation is willing to accept higher risks for higher potential rewards. Risk appetite is set by the board or senior leadership and guides all risk management decisions across the organisation.

There are four main responses to risk: avoidance (eliminating the risk entirely, e.g. not entering a high-risk market), mitigation (reducing the likelihood or impact, e.g. installing security systems), transfer (passing the risk to another party, e.g. through insurance), and acceptance (acknowledging the risk and deciding to proceed without specific action). Mitigation does not eliminate risk — it reduces it to a more manageable level.

Due diligence is a thorough investigation carried out before entering into a significant business transaction — such as an acquisition, merger, or major contract. It involves examining financial records, legal documents, operational processes, and risk exposures to identify any hidden liabilities or problems. Failure to conduct proper due diligence can result in significant financial loss or legal liability.

Scenario planning is a strategic risk management technique where organisations develop and analyse multiple hypothetical future situations — typically a best case, worst case, and most likely case. By thinking through how different scenarios would affect the organisation, managers can prepare better responses, identify vulnerabilities, and allocate resources more effectively. Shell famously developed scenario planning as a corporate discipline in the 1970s.

Compliance in risk management refers to adhering to external laws, regulations, and standards as well as internal policies and procedures. Non-compliance is itself a risk — it can result in fines, legal penalties, reputational damage, or loss of operating licences. Compliance risk management involves identifying applicable regulations (e.g. GDPR, FCA rules), monitoring adherence, and reporting breaches promptly.

A contingency plan is a predetermined course of action prepared in advance to deal with a specific risk if it materialises. Unlike a mitigation plan (which aims to prevent or reduce the risk), a contingency plan describes what to do after the risk has occurred. For example, a contingency plan for an IT system failure might include switching to backup servers and notifying customers within a specified time. Well-prepared contingency plans reduce the impact of unexpected events.

In project management, escalation is the process of raising a risk or issue to a higher level of authority when it exceeds the project manager’s ability to handle it within their remit. Escalation thresholds are usually defined in the risk register or project governance documents. For example, any risk with a financial impact above £50,000 might require escalation to the project board. Clear escalation paths ensure that serious risks receive appropriate attention quickly.

In project management, a risk is an uncertain future event that may or may not occur — it has not happened yet. An issue is a problem that has already occurred and needs to be addressed. For example, “the key supplier may go out of business” is a risk; once the supplier actually fails, it becomes an issue. Risk registers track potential future problems; issue logs track current problems. The distinction matters because the responses are different.