The language of risk, explained. Technical terms, acronyms, practical interpretations and memorable risk wisdom — with a focus on what matters in practice.
A practical reminder that documentation or completion does not establish genuine risk reduction.
A memorable challenge where a control or activity should leave an auditable record.
AI systems able to plan, use tools and take actions toward objectives with varying levels of autonomy.
The possibility of adverse outcomes from limitations, errors or misuse of AI models.
Evidence-based evaluation providing confidence about the design or operation of arrangements.
Capabilities and arrangements for continuing or restoring activities following disruption.
The extent to which a control manages the risk it is intended to address.
A provider designated for oversight under the EU Digital Operational Resilience Act (DORA).
A provider formally designated under the UK's critical third-party regulatory regime.
A general expression for a provider whose failure could significantly affect firms or services; not necessarily a formal UK designation.
A control intended to identify events, anomalies or failures after or as they arise.
The EU framework covering ICT risk management, incident reporting, resilience testing and ICT third-party risk in financial services.
A boxing saying associated with Mike Tyson, illustrating the limits of untested plans.
Preparation for an orderly or stressed termination, transition or replacement of a third-party service.
The processes and often supporting technology used to manage governance, risks, controls and compliance.
The maximum tolerable level of disruption to an important business service, set in accordance with the applicable regulatory framework.
A service provided by a firm to external end users where disruption could cause intolerable harm or threaten relevant financial stability objectives, under the applicable UK framework.
Risk assessed before considering the effects of controls or mitigants.
The FCA explains that intolerable harm is harm from which consumers cannot easily recover. It is significantly more severe than inconvenience or remediable harm, and can arise where a firm cannot restore a consumer to the correct financial position following a disruption or where serious non-financial consequences cannot effectively be remedied. The concept helps firms identify Important Business Services (IBS) and set impact tolerances. It is distinct from the wider obligation under the UK Consumer Duty to avoid causing foreseeable harm to retail customers. Source: FCA PS21/3, section 3 (Intolerable harm).
An outsourcing arrangement between entities in the same corporate group.
A measure of whether a control is operating or performing as intended.
A metric providing insight into risk exposure or changes in the risk environment.
A third-party arrangement meeting applicable regulatory materiality criteria; the precise definition depends on jurisdiction and rule set.
The average elapsed time required to contain an identified threat or incident.
The average elapsed time before an incident or threat is detected.
JADEtc Academy's practical description of the three stages of the third-party relationship lifecycle.
Cryptographic algorithms designed to resist attacks by sufficiently capable quantum computers.
Risk remaining after taking account of relevant controls and mitigants.
A structured assessment of risks, controls and residual exposures.
The amount and type of risk an organisation is willing to take in pursuit of its objectives.
Shared behaviours, incentives and norms influencing how risk is understood and managed.
An occurrence that causes or could cause an adverse outcome.
Clear accountability for identifying, assessing, managing and reporting a risk.
A consistent classification of risks across an organisation.
The maximum targeted period of data loss, measured backwards from an incident.
A target time for restoring a process, system or service after disruption.
Structured exploration of plausible events and their potential consequences.
A challenging yet credible disruption scenario used to test resilience.
A widely cited observation associated with Charlie Munger about how incentives shape behaviour.
Ongoing monitoring, challenge and management of supplier performance, risks and compliance.
A widely adopted framework for clarifying responsibilities for managing risk, providing risk-related expertise, monitoring and challenge, and delivering independent assurance. The original Three Lines of Defence (3LOD) model was articulated in the Institute of Internal Auditors’ (IIA) The Three Lines of Defense in Effective Risk Management and Control (2013): operational management owns and manages risk (first line); specialist risk management and compliance functions support and oversee risk (second line); and internal audit provides independent assurance (third line).
The IIA revised the approach in its Three Lines Model: An Update of the Three Lines of Defense (2020; updated 2024). The revised model emphasises governance, achievement of objectives, collaboration and the distinction between roles rather than rigid organisational silos. First- and second-line roles are both part of management and may be blended; internal audit must retain independence from management responsibilities. The IIA further refreshed its guidance in the 2026 Statement of Position on the Three Lines Model, emphasising governing-body accountability, coordination and appropriate safeguards when internal audit leaders assume second-line responsibilities.
Pragmatic adoption, not universal regulatory prescription. Relatively few financial regulators explicitly mandate adoption of the IIA’s Three Lines of Defence or updated Three Lines Model. Nevertheless, many financial services firms voluntarily use one of these familiar approaches—often retaining the older 3LOD terminology—because supervisors, boards and employees recognise it. An alternative, such as a hypothetical Sheen–Hinchliffe Model, might be equally valid in principle if it delivered clear accountability, effective oversight and independent assurance. But it would undoubtedly raise eyebrows and require additional explanation to a supervisor. Using an established model is therefore often a pragmatic choice, not simply a compliance requirement.
What matters is understanding and application. The first line remains responsible for managing risk; the second line provides specialist support, monitoring and effective challenge; and the third line supplies independent assurance. Be particularly careful with hybrid functions combining first- and second-line activities: define responsibilities by activity, document who makes decisions and owns controls, manage conflicts, and ensure challenge and assurance remain credible. Staff should know their own roles and how they interact with other lines.
In our work with firms, we are often surprised by how many staff cannot confidently identify which line they sit in—sometimes around 10–30% of those we ask. This is our practical training experience, not a formal industry statistic. A well-known diagram achieves little if people cannot explain their responsibilities in practice.
IIA source references: Original IIA position paper, The Three Lines of Defense in Effective Risk Management and Control (2013; historical reference); 2020 Three Lines Model; 2026 IIA Statement of Position.
A common paraphrase of Goodhart's Law: targets can distort the behaviour they are intended to measure.
No matching entries. Try another term or category.
About this glossary: Definitions are concise educational summaries, not legal interpretations. Regulatory terminology and scope can differ across jurisdictions. JADEtc perspectives offer practical guidance; attributed sayings may be paraphrased and should not be treated as verbatim quotations without source verification. We will expand and refine this reference over time.