Risk Control, Mitigation and Reporting
Core Concepts
Risk control involves actions to reduce likelihood or impact. Mitigation includes avoidance, reduction, transfer (insurance, hedging), and acceptance. Controls can be preventive, detective, or corrective. Control testing ensures effectiveness. Risk reporting communicates risk exposures to stakeholders, including the board. Key reports include risk dashboards, heat maps, and KRIs. Risk appetite statements guide reporting. Incident reporting and lessons learned close the loop. Regulatory reporting requirements (e.g., Basel Pillar 3) mandate disclosures. Data quality and aggregation are common challenges.
Traps in Questions
- Confusing risk transfer with risk elimination; transfer shifts risk but may introduce counterparty risk.
- Assuming all controls are equally effective; detective controls do not prevent losses.
- Overlooking the need for timely and accurate reporting to the board.
- Forgetting that reporting should be tailored to the audience.
Worked Example
A firm faces FX risk on foreign receivables. It enters a forward contract to lock in the exchange rate. This transfers market risk to the counterparty but introduces counterparty credit risk. The risk report shows reduced FX exposure but notes the new credit exposure. The board reviews the net effect.
Rule of thumb: Controls should be proportionate to the risk; report residual risk, not just gross exposure.