Hazard		Protocol that an organization implements when an identified risk event occurs.
Moral hazard		Expected monetary loss for an asset due to a risk over a one-year period; calculated by multiplying single loss expectancy by annualized rate of occurrence.
Principal-agent problem		Uncertainty that has an effect on an objective, where outcomes may include opportunities, losses, and threats.
Risk control		Metrics that provide an early signal of increasing risk exposures for an enterprise.
Risk Appetite		Potential for harm, often associated with a condition or activity that, if left uncontrolled, can result in injury or illness.
Risk		Reporting of an organization’s violations of policies and processes by employees.
Risk tolerance		Action taken to manage a risk.
Contingency plan		Organization's desired gain or acceptable loss in value.
Conflict of interest		A characterization of the amount of uncertainty (acceptable risk) an organization is willing to pursue or to accept to attain its risk management goals, defined in a range above and below a target.
Risk position		Amount of uncertainty that remains after all risk management efforts have been exhausted.
Risk scorecard		System for identifying, evaluating, and controlling actual and potential risks to an organization.
Annualized loss expectancy (ALE)		Situation in which an agent (for example, an employee) makes decisions for a principal (for example, an employer) potentially on the basis of personal incentives that may not be aligned with the principal’s incentives.
Residual risk		Principle that organizations should take all steps that are reasonably possible to ensure the health, safety, and well-being of employees and protect them from foreseeable injury.
Risk management		Situation in which one party engages in risky behavior knowing that it is protected against the risk because another party will incur any resulting loss.
Key risk indicators (KRIs)		Expected monetary loss every time a risk occurs; calculated by multiplying asset value by exposure factor.
Whistleblowing		Tool used to gather individual assessments of various characteristics of risk (for example, frequency of occurrence; degree of impact, loss, or gain for the organization; degree of efficacy of current controls).
Single loss expectancy (SLE)		Situation in which a person or organization may benefit from undue influence due to involvement in outside activities, relationships, or investments that conflict with or have an impact on the employment relationship or its outcomes.
Duty of care		A high-level characterization of the amount of uncertainty (acceptable risk) an organization is willing to pursue or to accept to attain its risk management goals.