Thread by @SAH16928046

Every socio-economic, political, legal, natural disaster, man-made disaster, or another process, which leads to a negative outcome must be recorded and taxonomized as an incident having material or near-miss risk characteristics, in the right category box in the risk register.

Modern #ERM & Traditional Risk Management are getting more and divided.
ERM is not just about Operational Loss Management and Materiality Assessment based on Assurance and Risk Review drove Internal Controls and Testing, but, it goes beyond that!
@IASassociation @TheIIA @BIS_org

More and more #Analytics is being used in both Auditing and Risk management, to understand the organizational dynamics of commercial strategy and the vulnerabilities associated thereof.
Especially the design, inserting and removal of Internal Controls is an analytical exercise.

KPIs Key Performance Indicators
KRIs Key Risk indicators
KCIs Key Control Indicators
All should be excogitated using #diagnostic, #descriptive, #predictive and #prescriptive #analytical processes and models.
Enter into BIG DATA, Data Science and Machine Learning, etc

Risk and Strategy should be tied together by appropriate controls.
Where you have a risk you have controls, and there you require random control testing.
Unfortunately, Control Testing is still a contested area between Auditing and ERM Desks.
Should it exist independently?

#ERM is proactive.
#Auditing is "mostly" Reactive.
#Internal #Controls monitoring should be done by the risk department or a go-between function that deploys, monitors and reports violations of controls both vertically and horizontally.
The 3-LOD Model does not work well!

In some Financial Institutions, such as Commercial Retail Banks, the MLRO in branches, do not report AML/KYC Control violations, because branch managers and RMs have to meet deposit targets.
That makes the first line of defence, the customer units, defunct and dysfunctional

In #private #banking and wealth management, I have come across terrible violations of internal controls. For e.g. the forms were not properly filled, the disclosures were not attached, the special lessons learned documents were not complied with, and the due diligence not done

SARs Suspicious Activity Reports should be a tick off for Compliance, Auditing & Risk professionals working at banks, etc.
These SARs should be counter checked at the branch banking level, by asking the RMs and the branch mngr to fill out #SRAC forms on a periodic basis

That's why it's important to have a fully functional ERM Desk/ Department which reports directly to the Board Risk Committee.
Never work as a risks manager at any firm, especially, at banks, or elsewhere within financial services, where the Board Audit Committee hijacks Risk Mgmt

Auditors, usually and mostly, are Accountants, who analyze gaps and internal control violations from an accounting embedded process.
Their lingua franca is debt and credit, etc
In the financial services industry, risks registers are no longer taxonomized using mundane acct terms

The definition of #Materiality might have conflicting connotations across the #GRC Silos.
Accountants define materiality using the IFRS and industry benchmarks.
Risk Professionals in terms of actual or potential losses?
Auditors either as cash or book loss or near-miss event?
Etc

e.g. Material Control violation for a Compliance Desk might be a manual violation of either any law, rule, procedure, process or specific regulatory instruction issued by the supervisor such as the SEC or the Central Bank, at a retail bank.

For the Risk Department, a Materiality posited event leads to the actual financial penalty, if regulatory instructions are violated.
non-quantifiable risks are usually considered to be immaterial and uncontrollable.

Hence, the materiality of risks lies in the eyes of the beholder.
Quantifiable->Measurable->Controllable->Material Risks->Financial Risks->Credit,Liquidity, Market, etc.

I dont want to discuss Exogenous and Endogenous Risks in this thread.

Operational Risks may or may not have quantifiable aspects?
Not all ORs are measurable.
Some Operational Risks have distinct frequency and severity occurrences, which further complicates the academic discussion.
Color Coded bars such as Heatmaps are basically all useless tools!

@BIS_org does not want banks to follow the AMA Advanced Measurement Approach to measure Operational Risks.
Banks are no longer required to compute Ops VaR!
Economic capital modelling for Ops Risk has been simplified.

@threadreaderapp unroll