Part 2 — Risk Management

A firm-wide, integrated process for identifying, assessing, prioritizing, and responding to risks across the whole organization, aligned with strategy and aimed at creating and preserving value.

(1) Governance & culture, (2) Strategy & objective-setting, (3) Performance, (4) Review & revision, (5) Information, communication & reporting.

It integrates risk with strategy and performance: risk is considered when setting strategy and objectives, not bolted on afterward, so the entity can manage risk to value.

The amount and type of risk an organization is willing to accept in pursuit of its strategy and objectives, set at the entity level by the board/senior management.

Risk tolerance is the acceptable level of variation around a specific objective; it operationalizes the broader, entity-level risk appetite at the objective or measure level.