Half the people configuring this app are Jira administrators rather than risk professionals. This page is for them — and for settling arguments about what a word means.
Risk vocabulary
Term
Means
Risk
An uncertain event that would affect an objective if it happened.
Threat
What could cause the event.
Vulnerability
The weakness that allows the threat to succeed.
Inherent risk
The score before any controls.
Residual risk
The score with the controls you actually have.
Target risk
The score you expect after delivering planned controls.
Risk appetite
The threshold above which a risk needs a decision rather than monitoring.
Risk tolerance
How far above appetite you will accept a specific risk temporarily.
Treatment
What you do about a risk: mitigate, transfer, avoid or accept.
Controls
Term
Means
Control
A safeguard that reduces likelihood or impact.
Preventive control
Stops the event happening.
Detective control
Tells you it happened.
Corrective control
Limits the damage afterwards.
Control effectiveness
How well the control works when operating as designed.
Mitigation coverage
How much of a specific risk a specific control addresses.
Control testing
Evidence that the control is actually operating, not just documented.
Governance
Term
Means
Three lines model
First line owns and manages risk; second line oversees and challenges; third line (internal audit) provides independent assurance.
Segregation of duties (SoD)
No single person controls all stages of a sensitive process — for example assessing and approving their own assessment.
Risk acceptance
A documented decision to live with a risk above appetite.
RCSA
Risk and Control Self-Assessment — a business unit assessing its own risks and controls on a cycle.
SoA
Statement of Applicability — which ISO 27001 controls apply to you and why the rest do not. Mandatory for certification.
KRI
Key Risk Indicator — a measured value with a threshold that signals a risk is increasing.
BIA
Business Impact Analysis — how badly and how quickly a disruption hurts.
App-specific terms
Term
Means
Workspace
A folder of registers plus the defaults new registers copy.
Register
A domain of risk, and the unit of configuration.
Custom asset list
A list of things risks are about, with attributes.
Factor
One scored question inside a dimension.
Dimension
A grouping of weighted factors — Impact, Likelihood.
Assessment methodology
Dimensions, matrix, formula and bands: the scoring model.
Layout
Which fields appear on a form, where, and who may edit them.
Stage
A phase in the risk lifecycle.
Grant
One row of access: who, where, what role.
Baseline access
A low role everyone in scope holds automatically.
Closed register
A register that org-tree inheritance does not reach.
Sealed workspace
A workspace only its independence group can enter, administrators included.