Risk and control self-assessment

Key risk indicator

A metric that signals a change in exposure to a risk, ideally before a loss materialises.

Residual risk

The risk remaining after treatment. It must be explicitly accepted by a body with the authority to do so.

Loss data collection

Systematic collection of incidents that caused an operational loss, with amount, cause, business line and event type. Without root cause analysis, collection produces nothing.