Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Test > Showcase 17th April (RP + CCA) > Flashcards

Showcase 17th April (RP + CCA) Flashcards

1
Q

What Risks should be included in a Division’s or a Critical Operation’s Risk Profile?

A

Only the Risks that may eventuate during the execution of the Division or Critical Operation’s processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a benefit of Risk Profiling being agnostic to Divisions/COs?

A

Risk Profiling will be consistent across the Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Will ownership of divisional Risk Profiles be aligned to FAR?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is FAR and what does it do?

A

Financial Accountability Regime.
Imposes a strengthened responsibility accountability and framework for entities in the banking, insurance, and superannuation industries and their directors and senior executives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When did FAR commence?

A

March 2024

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are two reasons to be process-led?

A
  1. CPS 230 requirement
  2. Industry best practice
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Will Divisional/Critical Operation boundaries simplify Risk Profiling?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who should perform Risk Profiling?

A

Risk Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Considering the risk bowtie, what are 3 components of risk (not considering controls)?

A
  1. Event (L3 Risk)
  2. Cause (what causes the event)
  3. Impact (impacts of the event)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Considering the risk bowtie, what is the flow of risks eventuating?

A

Cause > Event > Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a risk bowtie?

A

A visualization tool that helps us understand how the components of risk and controls work together.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In the context of the risk bowtie, what is the function of preventative controls?

A

Preventative controls aim to prevent the event from occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In the context of the risk bowtie, what is the function of detective controls?

A

Detective controls identify events before they cause significant damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In the context of the risk bowtie, what is the function of corrective controls?

A

Corrective controls correct for the impact of events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the first step in risk profiling?

A

Determine applicable L3 Risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why do we want to start risk profiling by looking at L3 risks?

A
  • It is too difficult to determine L1 MREs at first because they’re so broad.
  • We want to leverage risks existing in operations first.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How many L3 risks sit under the 20 non-financial MREs?

A

43

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Why do bottom-up instead of top-down?

A

More clarity at and a lot more to look at.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What level do we report risks at, and what level do we manage risks at?

A

Report at MRE (L1) level.
Manage at L3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When do we look at MREs?

A

After applicable L3 risks are determined.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How often is Risk Profiling performed?

A

Once per year (cyclical basis) unless something else triggers a Risk Profile refresh.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the current state of risk descriptions?

A

They are currently very poorly written and inconsistent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How do we want risk descriptions to be written in future?

A

Clear detail regarding the risk’s cause and impacts, with reference to relevant cause/impact taxonomies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a summary of the 11 steps of Risk Profiling (excluding steps for exclusion rationales) that VG made with ORM?

A
  1. Determine applicable L3 risks
  2. Complete MRE determination
  3. Create L3 risk records
  4. Prepare L3 risk description
  5. Complete CCA (L3)
  6. Complete RRA (L3)
  7. Complete TRA (L3)
  8. Determine risk response (L3)
  9. Create L1 risk record(s)
  10. Validate CCA, RRA & TRA (L1)
  11. Validate risk response (L1)
    * Risk profiling completed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

When do we start the CCA?

A

After robust risk description has been written, and controls have been linked to it.

26
Q

What are the 6 CCA steps (assuming no failures)

A
  1. Assess Coverage.
  2. Input Coverage into GRACE (Power BI will take this).
  3. Access Power BI CCA report.
  4. Assess Effectiveness
  5. Assess Efficiency.
  6. Determine overall CCA result.
    * CCA complete.
27
Q

Why do we assess Coverage?

A

To determine if any control coverage gaps exist.

28
Q

How is CCA Coverage assessed (as in what step will be followed)?

A

Utilise a template with a list of questions designed to establish if you have any control gaps in the identified overlayed controls linked to the risk.

29
Q

How is CCA Coverage determined (as in, what criteria are assessed)?

A
  • Primary assessment will be how well controls address event/cause/impact
  • Secondary assessment based on control taxonomy
  • This is done so CCA outcome is relevant to risk bowtie and helps form RRA (Residual Risk Assessment)
30
Q

What do we assess for Risk Taxonomies in the CCA template?

A

We try to match L3 Risk Taxonomy allocations with control buckets in the control taxonomy. This informs if we have appropriate controls for that risk type.

31
Q

Can we keep going if Coverage is Not Complete?

A

No, it is a hard stop.

32
Q

What do we do if Coverage is complete?

A

We fill the relevant GRACE field (TBD) that gets ingested into a Power BI report (in progress) that automatically calculates effectiveness and efficiency metrics for the CCA.

33
Q

Do we keep going if Effectiveness is rated Not Effective?

A

No, it is a hard stop.

34
Q

What do we do if all metrics for the CCA are green (i.e., CCA is Effective)?

A

We take a snapshot to show the CCA at a point in time, and upload this into GRACE as an artefact

35
Q

Is CCA outcomes from Power BI static?

A

Power BI is fluid and changes month-to-month, so you must take a snapshot to show the results of an analysis at a certain point in time and attach this to GRACE as an artefact.

36
Q

Can we update Risk Profiling with new CCA snapshots?

A

Yes, Risk Profiling is a dynamic process. Risk Profiling informs risk management going forward, so may revisit Power BI multiple times and update with new CCA snapshots.

37
Q

What is the workflow between the CCA, GRACE, and Power BI?

A
  • GRACE is the source of truth.
  • CCA and Power BI are driven by data from GRACE.
  • We update GRACE with outcome of CCA.
  • This completes the cycle.
38
Q

Since CCA draws data from GRACE, why do we need to update GRACE with CCA outcome?

A

CCA Coverage assessment is purely manual, so GRACE can’t automatically know the result.

39
Q

How many CCA templates will be made?

A

There must be 43 templates (one for every L3 risk) so they have CCA questions for each one.

40
Q

What is part of the reason the CCA template is aiming to be very granular and prescriptive?

A

To remove optionality and discretion (that leads to ambiguous or inconsistent results).

41
Q

When is the risk bowtie used?

A

After risks have been identified and CCA has been performed.

42
Q

What does RRA stand for?

A

Residual Risk Assessment

43
Q

What is the purpose of the RRA?

A

To see how much risk remains after the implementation of controls to address the risk

44
Q

What does TRA stand for?

A

Targeted Risk Assessment

45
Q

What is the purpose of the TRA?

A

Determine if residual risk is acceptable, understand what we want, and how we will get there.

46
Q

After the TRA, what do we do if we want lower residual risk?

A

Implement a risk response.

47
Q

After the TRA, what do we do if we think residual risk is too low?

A

We might be going too hard with controls, so we can look at removing some controls.

48
Q

We are looking at changes in how we will complete residual risk assessments. What will change in how people get data?

A

Currently, everyone is expected to get data themselves. In future, ORM will provide clear data points (capability to support making these accurate and helpful).

49
Q

We are looking at changes in how we will complete residual risk assessments. What will change in using the CCA?

A

Using the CCA will help us understand our risk bowtie and the balance/strength of our preventative/detective/corrective controls. Are we firefighting risks or actually preventing them?

50
Q

What is the traditional calculation used in risk management?

A

IRA – CCA = Residual Risk

51
Q

What is changing in how IRA is performed?

A

IRA will not be performed at the operational level; IRA will be performed centrally across the organisation.

52
Q

Why is IRA being removed from operational level?

A

There is minimal benefit, and it takes a lot of time and effort.

53
Q

When IRA is removed, what will be the start of risk profile analysis?

A

CCA

54
Q

Who is working on developing a strong reason not to use IRA?

A

KB. KB is confident we can move from MRE determination straight into CCA and get to the same point without using the IRA.

55
Q

What is happening to risk records for critical operations and divisional profiles?

A
  • They will need to be updated for critical operations.
  • Most of them for divisional profiles are already there
56
Q

What does ORP stand for?

A

Operational Risk Profiling

57
Q

What does ‘early adoption’ of the new ORP process involve?

A

Determination of risk profiles for two selected critical operations.

58
Q

How will the early adoption process go?

A

The Business/DCO will through the ORP process with the ORM and CCoE teams via a series of workshops followed by practical activities to be completed by the business in-between each workshop.

59
Q

What is the purpose of the ORP early adoption approach?

A

Use the experience to further develop the training and guidance required for full implementation in July.

60
Q

How does ORP early adoption approach benefit the Critical operation owner?

A

They will have a completed/partially completed profile for their CO completed ahead of time, with the assistance and guidance of the ORM/CCoE teams

61
Q

When will the ORP early adoption approach run?

A

24th April – 23rd May (5 weeks)

62
Q
A

Test (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions