These concepts describe the possibility of harm or loss, how it could arise, who or what could be affected, and what it means to take, manage or accept a risk.
The first group helps describe a risk. The second helps explain what people do about it. A construction shows how a word is used; its explanation states what it means. A pattern makes the relationship explicit.
Understanding risk
Risk
A risk is a possibility of harm or loss.
There is a risk that [something happens].
Explanation
The harm or loss described is possible.
There is a risk that customers will be charged twice for the same purchase.
Customers could pay more than they owe. Assessing how likely this is, deciding what precautions to take and accepting the risk require further consideration.
A risk can exist even if the harm never occurs. The description should make clear who or what could be affected.
Cause
A cause is something that brings about, or helps bring about, an event or change.
Something brings about, or helps bring about, something else happening.
An event can have several causes. Identifying one contribution leaves open what else was involved and which conditions allowed it to occur. A possible cause needs to be examined before it is treated as established.
Example
A software fault could cause customers to be charged twice for the same purchase.
Related term: precursor
A precursor is an event or condition that can lead, alone or with others, to a harmful event.
An earlier event or condition can lead to a particular harmful event.
The term directs attention to what happens before possible harm. A precursor may be recorded even when the harm is prevented. Calling something a cause explains what brings an event or change about; the same occurrence may be both a cause and a precursor.
For example, a train enters a work area without permission but stops before reaching the workers. This is a precursor to a possible collision. Investigation can identify what caused the entry even though no collision occurred.
Consequence
A consequence is something that follows from an action, event or situation, directly or through further developments.
Something happens because of an action, event or situation.
Consequences can be close or remote: a duplicate charge can reduce the money available now and lead to a missed bill payment later. They can be beneficial, harmful or neutral. The same occurrence can be a consequence of one thing and a cause of another. Explain each connection and the conditions on which it depends.
Example
Customers being charged twice could be a consequence of the software fault. The duplicate charges could then leave some customers unable to pay other bills on time.
Affect
To affect someone or something is to make a difference to their condition, activities or prospects.
Something makes a difference to someone or something in a particular respect.
Explain who or what is affected and how. The difference can be beneficial, harmful or neutral, and can vary in extent and duration. Someone’s ability to act or their prospects can be affected before any visible damage occurs.
Example
Duplicate charges could leave customers with less money available for essential expenses.
Harm
Harm is injury, damage or loss suffered by someone or something.
Someone or something suffers injury, damage or loss.
Harm can affect health, property, finances or other interests. The same occurrence can affect different people differently. Consider how serious the harm could be, including its extent, duration and effects on those affected.
Exposure
Exposure is being in circumstances where someone or something could suffer harm or loss.
Particular circumstances mean that someone or something could suffer harm or loss.
Exposure identifies who or what could be harmed. In financial uses, it can also refer to the amount at stake.
Uncertain
Something is uncertain when it is unknown, unclear or unsettled.
Someone does not know whether something is, was or will be the case.
This can be about what happened, why it happened, or when and how much something might change. Knowing that harm is possible can coexist with uncertainty about whether it will occur.
Likelihood
Likelihood is the chance of something happening.
Something has a particular chance of happening within a particular period and under particular conditions.
Likelihood may be expressed in words or as a numerical probability. The grounds, period and conditions matter to the assessment.
Taking and managing risk
Taking a risk
Taking a risk is doing something that could lead to harm or loss.
Someone does something that could lead to harm or loss.
This can involve continuing an activity or choosing to do nothing. A person may take a risk without fully recognising it. Where the possibility is recognised and the person decides to proceed, the same situation may also involve accepting risk.
Control
A control is a measure intended to prevent harm, detect a problem or limit its consequences.
Someone puts a measure in place to prevent, detect or respond to a particular problem.
Controls may include checks, physical safeguards or recovery arrangements. Their intended purpose and actual effects can be examined separately.
Risk appetite
Risk appetite is the kind and extent of risk someone is prepared to take or accept.
A person or organisation is willing to face the possibility of particular harm or loss in specified circumstances.
An appetite statement explains this willingness and any conditions. Applying it to a particular decision requires consideration of that decision’s circumstances.
Risk tolerance
Risk tolerance is the set of limits and conditions under which a person or organisation is prepared to face possible harm or loss in a particular activity.
A person or organisation is prepared to proceed with an activity provided the possibility of harm or loss stays within specified limits and conditions.
Appetite expresses broad willingness; tolerance sets specific limits for applying it. Limits may concern how likely or serious harm could be, how long a situation may continue, or the conditions under which an activity may proceed. State what each limit measures and what should happen if it is exceeded. Capacity is the separate question of what harm or loss can be borne.
Example
A café permits a four-week menu trial provided any loss stays within $1,000 and supplier payments continue on time.
Accepting risk
Accepting risk means deciding to proceed or continue despite a recognised possibility of harm or loss.
Someone decides to enter or remain in a situation despite recognising that harm or loss is possible.
Acceptance describes a decision about an identified possibility. Taking a risk describes the action in which harm or loss is possible. The two can describe the same situation. The decision may set conditions or require continuing precautions. An organisation’s acceptance also depends on who has authority to make the decision.
Risk capacity
Risk capacity is the ability to bear a particular loss or other harm.
Someone can bear a particular loss or disruption while continuing to meet specified commitments.
Capacity depends on resources, timing and other commitments. What someone can bear and what they are willing to accept are separate questions.
Effect, result and impact
These words often overlap with consequence and with one another. Their use depends on what is being described. The same duplicate charge can be described as an effect, a result or a consequence of a software fault. Describing its impact directs attention to how customers are affected.
The terms can draw attention to different aspects of the same occurrence. They do not specify a fixed sequence of stages.
Effect
An effect is an outcome or change brought about by something.
A control’s effects can include preventing a change or maintaining a condition. Its actual effects may differ from its intended effects. Duplicate charges could be an effect of a software fault.
Result
A result is what an action, event or process brings about.
A result can be intended or unintended and can lead to further events. Customers being charged twice could be an unintended result of a payment process.
Impact
Impact describes how someone or something is affected.
Describe the difference made and then consider its seriousness, extent and duration. The impact of a duplicate charge could include having less money available when a bill falls due. Some risk frameworks use “impact” or “consequence” to name a severity scale; check what the scale measures.
Use the sentence patterns to make the elements of your description explicit.
Describe a riskPlain Risk, developed by Dr Julien Maréchal. © 2026 The Governance Practice.
Original materials: CC BY 4.0. Scope and attribution.
Logos, third-party material, and website software are excluded.