Chapter 1 - Risk Identification Tools Flashcards
(50 cards)
What are the most dangerous risks
those we ignore, as they can lead to nasty surprises
What must be done before organizing risks in a register
identify risks specific to your business, not just an external list, and then assess, mitigate and monitor them
How should Risk identification in an organization take place
top-down at senior management level, and
bottom-up at business process level
What does top-down Risk identification at senior management level look at
the large exposures and threats to the business
What does bottom-up Risk identification at business process level look at
local or specific vulnerabilities or inefficiencies
Do you need top down and bottom up risk identifcation or can you survive with just one
both are vital because it is not sufficient to have one without the other
How often should Top-down risk analysis be performed
between one and four times a year
What determines the frequency of top down risk analysis
the growth and development of the business and the level of risks
What is the aim of Top-down risk analysis
identify key risks, the major threats that
jeopardize objectives
Who do Top-down risk identification sessions typically include
Senior risk owners, Executive committee members, Heads of business lines
How are Top-down risk identification sessions organized as
brainstorming workshops
What is Top-down risk identification exercises similar to
scenario generation, which is the first phase of scenario analysis
For small to medium-sized firms, how should top down risk ident. meetings take place
with both risk identification and scenario generation in mind in order to save time
what can the result of top down risk ident. meetings be used as inputs for
risk and control self-assessment (RCSA) exercises and scenario analysis
What 4 risks does top down look at
- Risks to strategy
- Emerging risks
- Global trends
- Major threats
What 4 things does bottom up look at
- Operational efficiency:
- Organized processes
- Efficient systems
- Competent staff
what is one of the most efficient ways to identify important threats to a business
Top-down risk analysis
is top down or bottom up more common in the industry
bottom-up
who tends to employ only bottom up risk identification
firms new to the discipline, where the practice is the least
mature.
If the scope of the bottom-up risk identification exercise is too restricted what happens?
the output will be a disparate collection of small risks, eg manual errors/process risks, not much value to senior management.
what are the most common bottom-up risk identification techniques
process mapping and interviews
What are the typical large exposures for a business
large company projects and critical third parties
What are an increasing focus in operational risk management
Operational risks related to projects and
to outsourcing practices
Large exposure typically relates to what category of risk?
high impact/low probability risks
