Reference
Glossary
Risk and Monte Carlo terminology used across Beau-Tie and PRQ. Anchored to ISO 31000:2018 and ISO Guide 73:2009 vocabulary where it diverges from common usage.
A
- Appetite (risk appetite)
- The level of risk an organisation is willing to retain in pursuit of its objectives. Plotted on the matrix as the threshold above which the risk will not be tolerated. ISO Guide 73:2009 defines it as "the amount and type of risk that an organization is willing to pursue or retain". Optional in Beau-Tie because not every organisation maintains explicit appetite statements.
B
- Base estimate
- The deterministic cost figure against which a contingency is calculated. In PRQ, set on the project header and used to express the recommended contingency as both a dollar amount and a percentage. PRQ runs without a base estimate but the convergence diagnostic falls back to evaluating against the P90 directly when none is set.
- Bow tie
- A causal model linking causes (left side) through controls to a single risk event (centre) and out to consequences (right side). The model formalises a workshop conversation by enforcing one event per diagram, control typing, and a clean prevention / recovery split. See What is a bow tie?
C
- Cause
- A pathway through which a risk event could occur. Each cause sits on its own line on the left side of a bow tie, with its own set of preventive and detective controls. Distinct from the event itself — phrased as a precondition, not as the event ("phishing of staff credentials" rather than "data breach").
- Cholesky decomposition
- A factorisation of a positive-semi-definite matrix M as L · Lᵀ where L is lower triangular. PRQ uses Cholesky as a step inside the Iman-Conover correlation imposer to construct correlated normal samples that are then rank-mapped onto the user's marginal distributions. Implemented hand-rolled in packages/prq-engine/src/correlation.ts.
- Confidence interval
- A range with a stated probability of containing the true value of an estimated parameter. PRQ surfaces a 95% confidence interval on the P90 estimate via the convergence badge — the half-width tells you how stable the P90 is at the iteration count you ran.
- Contingency
- Funds set aside to cover risk events that materialise during a project. PRQ's recommended contingency at P80 is the dollar amount (above the base estimate) needed to give an 80% probability that risk events fit within the contingency line.
- Control
- Anything done (or planned) that changes the probability or consequence of a risk event. Each control on a bow tie has a type (preventive / detective / corrective / directive), a status (existing / planned), and an effectiveness rating.
- Convergence
- In Monte Carlo simulation, the property of an estimate (e.g. P90) becoming stable as iteration count grows. PRQ's convergence diagnostic computes the analytical 95% CI half-width on the P90 estimate; if the half-width is ≤ 2% of the base estimate, the simulation is treated as converged and the badge shows green.
- Correlation matrix
- A K × K square matrix specifying pairwise correlations between K random variables. Diagonal pinned at 1.0; symmetric; positive-semi- definite. PRQ accepts a rank correlation matrix and uses Iman-Conover to impose it on the per-risk impact samples while preserving each risk's marginal distribution.
E
- Effectiveness
- A judgement about how well a control performs. Beau-Tie supports four levels: ineffective, partially effective, effective, highly effective. Visually encoded via the matched-chroma palette (ink-red / ochre / confidence-green / deep green).
- Event (risk event)
- The single occurrence at the centre of a bow tie. Phrased noun- form. ISO 31000:2018 calls this the "top event" in fault-tree terminology; "risk event" is the more common usage in bow-tie practice.
H
- Higham nearest-correlation matrix
- An algorithm by Nicholas Higham (2002) for finding the closest valid (positive-semi-definite, unit-diagonal) correlation matrix to a user-specified matrix that isn't valid. PRQ surfaces this as the "Apply nearest correction" button when the user-entered matrix isn't PSD. The correction preserves structure as best it can while making the matrix usable in simulation.
I
- Iman-Conover method
- A rank-reordering algorithm (Iman & Conover, 1982) for imposing a target rank correlation on a set of independent samples while preserving each variable's marginal distribution. PRQ uses it when a non-identity correlation matrix is in play.
- Impact
- On a bow tie: a consequence pathway following the risk event. Each impact sits on its own line on the right side, with its own corrective controls. In PRQ: the dollar value (or distribution) of cost incurred when a risk triggers.
- Inherent risk
- The risk rating before any controls are accounted for. Beau-Tie doesn't plot inherent risk because it isn't actionable — controls already exist; the residual is the truth on the ground.
L
- Likelihood
- On a risk matrix, the qualitative chance that a risk event occurs — typically expressed in 5 bands (Rare → Almost Certain). Distinct from probability, which is the quantitative chance used in PRQ's per-risk simulation inputs.
M
- Mode
- For a probability distribution, the value at which the density function peaks — the most likely single outcome. In PRQ's triangular and PERT distributions, the mode is one of the three elicited parameters (low / mode / high).
P
- P50 / P80 / P90
- Percentiles of the simulated total-impact distribution. P50 is the median (half the iterations land below); P80 is the value 80% of iterations land at or below; P90 is the same for 90%. PRQ uses P80 as the recommended contingency and P90 as the tail check. See Monte Carlo basics.
- PERT distribution
- A four-parameter beta distribution used to model uncertainty when the most-likely value is genuinely the most likely outcome and the bounds are rare-tail. Originally from the US Navy's Program Evaluation and Review Technique (1958). Mean is (min + 4·mode + max) / 6.
- Positive-semi-definite (PSD)
- A property of a symmetric matrix: all its eigenvalues are non-negative. Required for a matrix to be a valid correlation matrix. PRQ validates user-entered matrices for PSD and offers Higham nearest-correlation correction when the check fails.
- Probability of occurrence
- In PRQ, the per-iteration chance that a risk triggers. Expressed as a value in [0, 1] (e.g. 0.30 = 30%). Combined with the impact distribution, it determines the risk's contribution to the total in any one iteration.
R
- Residual risk
- The risk rating after existing controls are accounted for. The truth on the ground — what you'd see today. Plotted as the teal dot on Beau-Tie's matrix.
- Risk matrix
- A two-dimensional grid of likelihood × consequence cells, each labelled with a band (Low / Moderate / High / Extreme). Used to compress qualitative risk judgement into comparable, action- triggering bands. Beau-Tie's default is 5×5 but the matrix is fully configurable. See Risk matrices and the residual / target / appetite triple.
S
- Sensitivity analysis
- Identifying which input variables drive most of the variance in a model's output. PRQ's sensitivity tornado ranks risks by their contribution — closed-form variance share when independence is assumed, Spearman ρ² to the totals when a non-identity correlation matrix is in play.
- Spearman rank correlation
- A measure of monotonic association between two variables: the Pearson correlation of their ranks rather than their raw values. Robust to non-linear monotonic relationships. PRQ uses Spearman ρ² as the variance-share input for the sensitivity tornado when correlation is in play.
- Status (control status)
- Whether a control is currently running (existing) or committed but not yet live (planned). Beau-Tie renders existing controls as solid filled circles and planned controls as dashed circles with the implementation timeline attached.
T
- Target risk
- Where the residual is intended to land once planned controls come online. Plotted as the confidence-green dot on Beau-Tie's matrix. The gap between residual and target tells you whether the treatment plan is ambitious or modest.
- Tornado chart
- A horizontal bar chart of risks ranked by their contribution to a model output's variance. Top contributor at the top, narrowing downward (the "tornado" shape). PRQ renders the top bar in teal as the singular "fix this first" cue.
- Triangular distribution
- A probability distribution defined by three parameters (min / mode / max) with linear-falloff probability density. Mean is (min + mode + max) / 3. PRQ's default impact distribution because it's easy to elicit and its hard bounds match how project-risk impacts often behave. See probability distributions in PRQ.
- Type (control type)
- Beau-Tie's four control types: preventive (P) reduces likelihood of the event; detective (D) reduces time-to-discovery once an event is in motion; corrective (C) reduces consequence if the event occurs; directive (Di) shapes behaviour to support the other three. From the BS/ISO 22301 business-continuity tradition.
V
- Variance share
- Each risk's contribution to the total variance of the simulated total impact, expressed as a percentage of total variance. The sensitivity tornado bars are sized by variance share. Closed- form when independence is assumed; ρ² (squared Spearman rank correlation) when correlation is in play.