Thread by @SAH16928046

Which are some interesting stylized facts about Risk Management and IAD Failures across global corporations?
@PRMIA @GARP_Risk @BIS_org

Quantitative Risk Management when turned into a profession, does not work in reality in most cases, as witnessed now outside the Insurance Sector!
Insurance is different because the profession is led by well-trained quantitative professionals such as Actuaries!

The multiple reasons for the failure of Risk Management and Auditing Departments at firms could be the following =>

1.The maturity level of each organization is different and not naturally adapted to act, by giving a timely response to risk flags and control violations, as required.

2.Auditing and Risk Management continues to be dominated by Accountants, who are poor at understanding mathematics and statistics/ econometrics etc.

#Accounting drove Auditing lingua franca which uses financial auditing lexicons, terminologies and taxonomies to understand firm-wide hazards, usually, confine all #risks within one branch of specialism across the boardroom.
Not going beyond Materiality Misstatement Risks!

An e.g. of ignorance and certain underserved areas are IT /MIS /Cyber risks and design of appropriate controls and monitoring mechanisms by both the Audit and the Risk Departments.

3.Developing risk departments without undertaking GAP Studies.
4.Not updating risk registers.
5.Not understanding the difference among risk registers, RCSA Forms and templates, and Risk GAP Studies

6.Using #KRIs to develop RCSAs(when it should be the other way around) and update the timeline on given risk exposure, with the wrong information.

7.Delay in processing and flagging key operational and financial risks control violations.

8.Lack of actionable BI and Risk Research Information to further solidify the risk registers and the risk reporting frameworks in place.

By BI, I am implying Business Intelligence.

9.Reactive risk management is auditing. Risk Management should not be reactive but pro-active. But how? This requires extensive training and discussion.

10 Lack of Risk Culture
Will other members of the organization understand the jargon?
Problems related to risk communications?

11.Confusion across the three lines of defence. The 3 -LOD Model is neither well understood nor well entrenched to prevent risks from cascading across an organization, especially during a crisis.

12.Firms willing to implement some form of risk taxonomy and methodology using a CBOK(Common Body of Knowledge), do not have adequate well-trained or utilized Risk MIS based Automated Systems to effectively implement risk-based actions and escalation procedures in real-time

13.Risk Theory never equal to what we observe and deal with in reality.
What we learn in risk management or quantitative finance or financial engineering degree program does not apply in the real-world scenarios.
for e.g. on using the Gaussian distribution to model risks.

14.Poorly coordinated #GRC Activities.
15.Lack of Oversight from the BODs.
16.Lack of qualified director-level appointment within the Boardrooms.

A complete litany of failures of Internal Auditing, Quantitative Risk Management, Internal Controls and now the last in line to follow is ERM /IRM, both as a process and methodology, presents several challenges for the practitioner.

The ERM, IAD, QRM, FRM, or any other model framework of risk management based on a standard or guidelines as issued by the regulator, or the ISO that does not add to shareholder value, is a waste of => money, time and resources.

@threadreaderapp unroll