ISO 31000

The overall process of risk identification, risk analysis, and risk evaluation. Risk assessment identifies what can go wrong (hazard identification), determines how likely it is and what the consequences would be (risk analysis), and compares the results against risk criteria to determine whether the risk is acceptable or requires treatment (risk evaluation). It is the systematic application of the ISO 31000 risk management process.

A structured repository that records all identified risks, their assessments (probability, consequence, risk level), treatment plans, residual risk after treatment, risk owners, review dates, and current status. The risk register provides a single authoritative view of an organization's risk landscape and serves as the primary governance tool for tracking risk management activities.

A formal, documented decision to accept a specific risk without further treatment, based on a determination that the risk level is within the organization's risk tolerance criteria or that further risk reduction is not reasonably practicable (ALARP). Risk acceptance requires explicit authorization from a designated decision-maker, documented rationale, a defined review period, and specified conditions or limitations.

The degree of risk that an organization is willing to withstand in pursuit of its objectives, expressed as specific thresholds or boundaries for different risk categories. Risk tolerance defines the upper boundary of acceptable risk — risks exceeding tolerance levels must be treated, transferred, or avoided. Risk tolerance is more specific than risk appetite and is typically expressed as quantitative criteria.

The amount and type of risk that an organization is prepared to seek, accept, or tolerate in pursuit of its long-term objectives. Risk appetite is a strategic, board-level statement that sets the overall tone for risk-taking across the organization. It is broader and more directional than risk tolerance, which provides specific measurable thresholds.