GRC glossary

What is IT risk? IT risk is the risk that technology systems, data, infrastructure, people, or digital processes could fail, be disrupted, be misused, or expose the organization to harm. It includes risks linked to cybersecurity, system availability, data confidentiality, access controls, third parties, operational resilience, regulatory compliance, and technology change. In governance, risk, and…

What is enterprise risk management (ERM)? Enterprise risk management (ERM) is the organization-wide process of identifying, assessing, managing, monitoring, and reporting risks that could affect strategic objectives. It gives leadership and the board a joined-up view of risk across the business, rather than leaving each function to manage risk in isolation. In governance, risk, and…

What is a risk assessment? Risk assessment is the process of identifying, analyzing, and evaluating risks so an organization can understand what might affect its objectives and decide what action is needed. It helps teams work out what could happen, how likely it is, how serious the impact could be, and whether the risk sits…

What is risk mitigation? Risk mitigation is the process of reducing the likelihood or impact of a risk through controls, actions, safeguards, or changes to the way an organization operates. It is one type of risk response, alongside accepting, avoiding, sharing, or transferring risk. In governance, risk, and compliance (GRC), risk mitigation matters because identifying…

Risk appetite vs risk tolerance is the difference between the level of risk an organization is willing to take in pursuit of its objectives and the specific level of variation it can accept before action is needed. Risk appetite is usually broader and strategic. Risk tolerance is usually more specific, operational, and measurable. In governance,…

Inherent risk vs residual risk is the difference between the level of risk before controls are applied and the level of risk that remains after controls, mitigations, or other responses are in place. Inherent risk shows the starting exposure. Residual risk shows what the organization is still carrying after action has been taken. In governance,…

What is a risk matrix? A risk matrix is a visual tool used to assess and prioritize risks by comparing their likelihood and impact. It usually presents risk on a grid, where 1 axis shows how likely a risk is to happen and the other shows how serious the impact would be if it did.…

What is risk? Risk is the effect of uncertainty on an organization’s objectives. In simple terms, risk is what could happen that may affect whether an organization achieves what it set out to do. In governance, risk, and compliance (GRC), risk matters because decisions are rarely made with perfect certainty. Organizations need a clear way…