Risk Management and Internal Controls
From Identification to Reporting
Candidates must be fluent in the risk management cycle: identify, assess (likelihood and impact), treat (avoid, reduce, transfer, accept), monitor, and report. Understand the difference between inherent and residual risk, the role of risk registers, key risk indicators, and control testing. Know the main risk categories: credit, market, liquidity, operational (including conduct, technology, and outsourcing), compliance, and reputational. Familiarity with stress testing, scenario analysis, recovery and resolution planning, and business continuity is expected.
Traps
Examiners like to test whether a control is preventive or detective, and whether a residual risk rating is justified by evidence of control effectiveness. Another common trap: describing risk transfer (insurance, hedging) as risk elimination. Also watch for confusion between a risk event and a risk indicator, and between a control gap and a control failure.
Rule of thumb
No control testing, no comfort. A residual risk rating is only credible if the underlying controls have been tested and the results documented. If a question offers a lower residual rating without test evidence, it is the distractor.
Worked example
A firm's payment error rate rises. The root cause is a manual input step with no second check. The fix is a preventive control (system validation or maker-checker), not more detective reconciliation. The residual risk falls only after the new control is tested over a defined period.