Chapter 1: Risk Identification Tools Flashcards
How should risk identification be done?
Top down - Senior management
Bottom up - Business process level
How often should top-down risk analysis be performed?
Between 1-4 times a year
What is the aim of top-down risk analysis?
Identify key organizational risks
What are some examples of top down and bottom up risk?
Top-down: the crow’s nest:
- Risks to strategy
- Emerging risks
- Global trends
- Major threats
Bottom-up: the engine’s room
- Operational efficiency:
- Organized processes
- Efficient systems
- Competent staff
What is the most common form of risk analysis?
Bottom up
What are exposures and vulnerabilities?
Exposures are the risks you a exposed to, e.g. big clients, systems, regulations
Vulnerabilities are the weak links in the company, old process, businesses unmonitored
What can be used to check against risks reported?
Ready made lists from industry bodies or Basel
What is process mapping?
Most common risk and control identification tool
IT/PM
Can be too granular or too detailed
What is the risk wheel?
Presents risks in a circular way, helping managers make connections between risk types
What is an amazement report?
Report from interviews with staff on differences in job from new hires, things that surprise them
What is important to have in a culture for near misses to be reported?
No-blame culture
What is good practice to do after a peer has a incident?
Ask - “could this happen to us”
