Chapter 1: Risk Identification Tools Flashcards
What is the main focus of the Top-Down Approach in risk identification?
To identify what? Who is this conducted by, why?
Strategic risks, major threats, and emerging risks
Conducted by senior management to align with strategic objectives.
How often should the Top-Down Approach be conducted?
1-4 times a year, depending on business growth and risk levels.
What techniques are involved in the Top-Down Approach?
- Reviewing exposures
- Vulnerabilities
- Risk wheel
- Causal analysis
- Scenario generation
What is the primary focus of the Bottom-Up Approach?
Specific vulnerabilities and inefficiencies at the business process level.
Which technique is commonly used in the Bottom-Up Approach?
Process mapping and interviews.
What is a risk and control self-assessment (RCSA)?
A technique used to identify risks at a granular level.
What can result from focusing too granularly in the Bottom-Up Approach?
A collection of small risks, potentially missing the big picture.
Why are both Top-Down and Bottom-Up approaches necessary for risk management?
They provide different perspectives and are complementary for a holistic understanding of risks.
What is a “key client vulnerability” in risk exposure?
What does this involve?
Involves key clients, distribution channels, central systems.
What is one example of a vulnerability in an organization?
Outdated what?
Outdated products/processes.
What is the importance of identifying exposures and vulnerabilities?
What does this encourage?
Business-driven and specific, encouraging natural risk discussions.
What is the purpose of root cause analysis techniques?
To reflect on business risks beyond incident analysis.
What technique can help identify underlying causes of potential issues?
The ‘five whys’ technique.
What do internal losses reflect in a firm?
Concentrations of operational risk.
What are near misses in risk management?
Incidents that almost occurred but were avoided by luck or external intervention.
What is the purpose of process mapping?
Very simply
To identify risks and controls associated with specific tasks.
What is an important consideration in process mapping regarding the level of analysis?
Finding the what?
Finding the right balance in detail.
What are common symbols used in process mapping?
- Tasks/actions
- Decision points
- Documents
- Manual operations
- Outputs
- Data
What does ‘Auditing with Your Feet’ refer to?
Gathering information by walking around, talking to staff, and observing.
What is an ‘Amazement Report’?
Captures new employees’ initial impressions.
What are the benefits of interviewing key staff?
- Reveals qualitative insights into risks
- Encourages open communication
- Offers historical context and operational insights
