The terms we use

Risk management has a vocabulary, and much of it means slightly different things in different firms. This is what each term means in PureTrace, and therefore on this site.

The platform

Governance core: The whole risk cycle in one record: the register, controls, indicators and collection cycles, risk events, breaches, remediation, committee packs, the dashboard and the audit trail. It is complete on its own and can be licensed with or without the modules.
Module: A capability licensed on its own or alongside the governance core: Supplier Due Diligence & Third-Party Risk, ICARA, Operational Resilience, Obligations Management and the Customer Oversight Portal.
Entity: A company, site or business unit within a group. PureTrace holds one record with a local position for each.
Group view and local position: The group view is the position held on the record itself. A local position is what an entity sets for itself where it differs. Anything not set locally inherits the group view.

Risks and controls

Risk register: The list of risks an organisation manages, in categories, each with an owner and inherent and residual scores.
Inherent and residual: The risk before controls and the risk after them.
Likelihood and impact: The two axes a risk is scored on. The platform works the score out from them rather than asking somebody to type it.
Appetite: How much of a risk the board is willing to carry, and why. A residual position outside appetite is one the platform's overnight checks will name.
Bow-tie: A way of structuring a risk as the causes that lead to it on one side and the consequences that follow from it on the other, with the risk event in the middle.
Risk event: An incident or a near miss, recorded against the risk it belongs to.
Control: Something that reduces a risk. Assessed for design effectiveness (is it the right control?) and for operating effectiveness (is it actually working?), separately.

Indicators, breaches and actions

Indicator (KRI): A key risk indicator: a measured value with green, amber and red thresholds that tests whether a control is working.
Threshold: The value at which an indicator moves from one band to the next. An indicator can run in one of three directions: higher is better, lower is better or within a range.
RAG: Red, amber, green. The band a value falls into against its thresholds.
Collection cycle: The window in which indicator values are gathered: monthly, quarterly, half-yearly or annual, one line per indicator per entity.
Threshold breach: A value crossing red, which raises a formal record with its own response.
Remediation action: A task raised from a breach, an event, a control failure or a quality finding, closed by two people.
Path to green: The view of every open remediation action across the organisation, and what it will take to bring each one back inside its threshold.

Reporting, evidence and control

Committee pack: The report assembled for a risk committee or board from live data.
Segregation of duties: The rule that the person who did a thing cannot be the person who approves it, often called four-eyes. PureTrace enforces it in the software rather than asserting it in a policy.
Three lines of defence: The business that owns risk, the function that oversees it and the audit function that checks both.
Audit trail: The record of every change: who, what, from what to what, when, in what role and in which line of defence. It is append-only.
Append-only: A record that only ever grows. Nothing in the system can edit an entry or remove one, and that holds for administrators as much as for users.
Quality check: One of a fixed set of rules that reads the register overnight and raises a finding, naming its rule and its evidence. No model is involved.
FCA: The Financial Conduct Authority, the United Kingdom regulator whose rules shaped the deepest domain work behind the platform.

A term missing, or one we use differently from you? Write to sales@puretrace.co.uk and we will add it.