Module 6 - Midterm Pt 2

Question 1

Heat Map Strength & Weakness

Answer 1

Strength: Easy to communicate and visualize

Weakness: May oversimplify risks

Question 2

Heat Map User

Answer 2

Risk managers, executives

Question 3

Bow-Tie Analysis Strength & Weakness

Answer 3

Strength: Comprehensive view of causes and consequences

Weakness: Time-consuming and complex to create

Question 4

Bow-Tie Analysis User

Answer 4

Risk professionals, control experts

Question 5

RCSA User

Answer 5

Operational staff, risk managers

Question 6

What is the Risk and Control Self-Assessment (RCSA)

Answer 6

• Integral part of operational risk management frameworks
• Structured approach to understand the effectiveness of the control environment by identifying and assessing operational risks and associated controls
• Helps determine whether the residual risk is within approved risk boundaries

Question 7

What is the value RCSA

Answer 7

• Correct internal control gaps on a timely basis
• Improve value
• Provide assurance
• Enhance risk culture

Question 8

What can RCSA lead to

Answer 8

• Corrective actions
• Review of risk boundaries
• Accepting the level of risk for a period of time
• Management and board reporting

Question 9

RCSA Key Considerations

Answer 9

• What risks to cover?
• What elements are required?
• Who does what?

Question 10

RCSA Pros

Answer 10

• Interaction with other control processes
• a real-time view of the enterprise control environment
• Improve business value and enhance risk
  culture

Question 11

RCSA Cons

Answer 11

• Can be time-consuming and manually intensive
• Relies heavily on the quality of inputs
• Only captures what is known (room for bias)

Question 12

KRIs First Line

Answer 12

Business Units
- Identifies KRIs
- Sets thresholds
- Monitors positions
- Escalates breaches of limits to management

Question 13

KRIs Second Line

Answer 13

Risk Management
- Creates KRI framework and provide training
- Challenges / provides guidance to KRI selection process
- Facilitates reporting / escalation of breaches
- Identifies trends

Question 14

KRIs Third Line

Answer 14

Internal Audit
- Provides validation/assurance around KRI processes

Question 15

KRI Lifecycle

Answer 15

1. Develop KRIs
2. Establish KRI thresholds
3. Monitor and report on KRIs
4. Manage breaches of KRIs
5. Revise KRIs as needed

Question 16

As much as possible, KRIs should be developed to align to the

Answer 16

root causes of risk events

Question 17

To Develop KRIs Some key considerations include

Answer 17

• an iterative and continuous process
• consistent KRI definitions and data inputs
  required
• KRIs sometimes present the best early warning signals when seen together
• Important to consider frequency of data collection

Question 18

Effective KRIs should be

Answer 18

Measurable, Predictable, Comparable, and Informational

Question 19

KRIs are

Answer 19

measures summarizing the frequency, severity, and impact of an event or corporate actions during a reporting period so they can be articulated that way

Question 20

What are KRI thresholds?

Answer 20

These are the values that, if breached, should prompt a review of the causes and ascertain that no major issue is brewing

Question 21

Important steps in setting KRI thresholds

Answer 21

• Determine and validate trigger levels or thresholds
• Based on industry tolerance or internal acceptance
• Board of Directors should approve thresholds (sometimes)
• Should coincide with risk appetite statement

Question 22

KRI Monitoring and Reporting

Answer 22

• Frequency
• Format
• Escalation
• Hierarchy
• Outcomes

Question 23

Examples: Key Risk Indicators

Answer 23

• Compliance
• Process, System, People
• Credit
• Balance Sheet Growth
• Capital Adequacy
• Profitability / Earning