{"id":13490,"date":"2021-09-30T09:39:19","date_gmt":"2021-09-30T06:39:19","guid":{"rendered":"https:\/\/www.naris.com\/concepts-of-risk-management-and-grc\/"},"modified":"2021-10-04T14:32:21","modified_gmt":"2021-10-04T11:32:21","slug":"concepts-of-risk-management-and-grc","status":"publish","type":"page","link":"https:\/\/www.naris.com\/en\/concepts-of-risk-management-and-grc\/","title":{"rendered":"Concepts of risk management and GRC"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n
\n

Concepts GRC and Risk Management<\/h1>\n<\/div>\n<\/div>\n
\n
\n

Practice shows that jargon raises question marks. We have therefore drawn up a list of risk management concepts. Do you have more questions about risk management? Then contact us!<\/p>\n<\/div>\n<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What is GRC software? What is a GRC tool?<\/h2>\n

GRC software is the collection of software that supports Governance, Risk and Compliance (GRC) activities. GRC is the integral set of capabilities that enables an organization to confidently achieve goals, address uncertainty, and act with integrity.<\/p>\n

In addition to the GRC activities, modern GRC software also supports the ability to perform an audit, handle incidents and support mitigation strategies such as through insurance and contracts with third parties. A supplier of GRC software must of course also be certified, such as the ISO 27001 standard.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n
Promotion holder
<\/strong>The person or organization (part) designated to implement the \u00a0risk management measure\u00a0<\/em> to be carried out under the responsibility of the \u00a0risk manager.<\/em><\/p>\n

Actor
<\/strong>See\u00a0action holder<\/em><\/p>\n

Administrator
<\/strong>See\u00a0risk manager<\/em><\/p>\n

Control measure
<\/strong>An activity that in any way aims at eliminating , avoiding or minimizing the \u00a0cause<\/em>\u00a0or the\u00a0effect<\/em>\u00a0of an unwanted event >> see\u00a0NARIS\u00ae<\/sup>\u00a0Risk management<\/em><\/p>\n

Gross risk
<\/strong>Risk without control measures<\/p>\n

Corrective measure
<\/strong>A measure that aims to achieve the intended objectives after an undesirable event has occurred<\/p>\n

Endogenous risk
<\/strong>A risk of which the suggestibility and responsibility lies within one’s own organization (seen from the person who reports on it)<\/p>\n

Severity
<\/strong>See\u00a0consequence<\/em><\/ p><\/p>\n

Owner
<\/strong>See\u00a0risk owner<\/em><\/p>\n

ERM model or risk management model
<\/strong >A standard risk management model. For example; COSO Enterprise Risk Management (integral), ISO 31000 guidelines (integral), RISMAN (projects), Management of Risk (M_o_R)<\/p>\n

Exogenous risk
<\/strong>A\u00a0 risk<\/em>\u00a0whose suggestibility and responsibility lies outside one’s own organization (as seen from the person reporting on it).<\/p>\n

Facilitator
<\/strong>A person who supervises risk meetings. Process supervisor<\/p>\n

Event
<\/strong>An event that has or may affect the achievement of the intended objectives.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Consequence
<\/strong>The effect resulting from the occurrence of a \u00a0risk<\/em>.<\/ p><\/p>\n

GRC framework
<\/strong>Governance risk and compliance is a model in which the risks are linked to the governance and compliance activities of the organization. As a result, it is better integrated into the organization.<\/p>\n

Initial risk
<\/strong>The assessment of the \u00a0risk<\/em>\u00a0without the effects of\u00a0control measures< \/em>.<\/p>\n

Approaches
<\/strong>Perspectives to look at a project in different ways to aid in the identification of risks.<\/p>\n

Impact
<\/strong>See\u00a0consequence<\/em><\/p>\n

Incident
<\/strong>See\u00a0event<\/em><\/p >\n

Internal control
<\/strong>Processes aimed at providing reasonable assurance about achieving objectives.<\/p>\n

Opportunity
<\/strong >The possibility of an event occurring expressed as a value between 0 and 1.<\/p>\n

Qualitative risk analysis
<\/strong>A\u00a0risk analysis<\/em>\u00a0in which the risks of are ranked in order of importance on the basis of a qualitative assessment.<\/p>\n

Quantitative risk analysis
<\/strong>A\u00a0 risk analysis<\/em>\u00a0in which the magnitude of the \u00a0opportunity<\/em>\u00a0and of the \u00a0consequence<\/em>\u00a0of the\u00a0risks<\/em>\u00a0and\u00a0uncertainties<\/em>\u00a0quantitatively, so in numbers, are estimated.<\/p>\n

Mitigating measure<\/strong><\/p>\n

See\u00a0control measure<\/em><\/p>\n

Net risk
<\/strong>Risk including control measure, also called residual risk<\/p>\n

Undesirable event
<\/strong>An event that has or may have a negative influence on the achievement of the intended objectives.<\/p>\n

Undesirable top event
<\/strong>An event that is used in the \u00a0risk analysis\u00a0<\/em> as the most\u00a0undesirable event<\/em> em>.<\/p>\n

Uncertainty
<\/strong>Unfamiliarity with the actual and\/or future situation.<\/p>\n

Operational Risk Management
< \/strong>Operational risk refers to the risk that arises as a result of the failure or inadequacy of internal processes, human and technical deficiencies, e n unexpected external events. The risks are known and it is especially important whether the control measures are actually operational.<\/p>\n

Organization
<\/strong><\/p>\n