Risk Management: Glossary
Plain-language explanations of terms used in CERN’s risk-management principles. This glossary may be extended as supporting guidance develops.
Find a term
Assurance
Evidence-based confidence that risks and controls are understood and managed appropriately. Assurance may come from checks, monitoring, testing or specialist review; independent Third Line assurance is provided by Internal Audit.
Control
An existing measure that helps manage a risk by reducing its likelihood or consequences. Examples include preventive maintenance, access restrictions, approval checks or tested recovery arrangements.
Control effectiveness
How well a control works in practice. A control’s existence alone does not demonstrate its effectiveness; evidence of its design, operation and performance matters.
Dependency
A reliance on another activity, service, system, organisation or resource. Dependencies can connect risks across organisational boundaries and may require coordinated management decisions.
Escalation
Bringing a risk or a required decision to an authority with the necessary mandate, resources or organisational scope. Escalation enables an appropriate decision; it does not transfer operational risk ownership.
Impact
The consequences if a risk materialises. These may include operational impacts on activities and services, financial impacts on resources and budgets, health impacts on people, reputational impacts on credibility and trust, and mission impacts on CERN’s objectives and scientific programme.
Likelihood
How likely an event or consequence is to occur over a specified period. The period and assumptions used should be clear.
Objective
An intended result that CERN, a department, a service, a project or a programme seeks to achieve. Objectives provide the context for understanding why a risk matters.
Residual risk
The exposure remaining after taking account of existing controls. It describes the current position, rather than the improvement expected from actions that have not yet been implemented.
Risk
The effect of uncertainty on objectives. Risk management considers what could affect the achievement of an objective, including possible adverse consequences and opportunities.
Risk acceptance
An explicit decision by an authorised person or body to retain a defined residual exposure under stated conditions. The decision requires a recorded rationale and review arrangements. Acceptance does not remove the duty to maintain controls or reconsider the risk when circumstances change.
Risk aggregation
Considering risks together to understand their combined exposure. Several individually tolerable risks may collectively threaten an objective or critical capability and require escalation.
Risk appetite
The amount and type of risk CERN is generally willing to pursue or retain in achieving its objectives. Appetite guides judgement; it does not automatically determine a decision or authorise non-compliance with mandatory obligations.
Risk owner
The named individual responsible for managing a specific risk within the relevant line-management accountability structure. This includes keeping the assessment current, coordinating action, monitoring change and escalating when necessary.
Risk tolerance
The boundary within which an authorised management level may retain residual risk without further escalation. Other escalation triggers, such as insufficient authority, significant uncertainty or cross-organisational dependencies, still apply.
Risk treatment
Action to change a risk’s likelihood or consequences. It may include changing an activity, introducing or strengthening controls, or sharing part of the exposure through arrangements such as insurance.
Three Lines model
A way of distinguishing responsibilities: the First Line owns and manages risks; the Second Line provides frameworks, specialist standards, advice, monitoring and challenge; the Third Line, Internal Audit, provides independent assurance. The Three Lines model does not create an additional management hierarchy.